German industry expects Russian sabotage against the country’s companies to persist and take more forms, the deputy head of the Federation of German Industries (BDI) told Handelsblatt. His warning follows alarms from Germany’s intelligence services, which describe the country as a main target of Russia’s covert campaign in Europe.

Russia keeps striking Ukrainian cities and power plants every day while trying to weaken the European support that keeps Ukraine fighting. Germany is home to arms makers producing with and for Ukraine, so pressure on its companies targets the supply behind Ukraine’s defense.

Industry expects attacks to last and change form

The warning came from Holger Lösch, the BDI’s deputy managing director.

“German industry is preparing for the threat to persist and for attack methods to become more varied,” he told Handelsblatt. “Companies don’t end up in the crosshairs by chance,” he added.

Russian influence and sabotage operations are no longer an abstract scenario, and companies, critical infrastructure, and defense supply chains are already among their targets, Lösch said. Companies now receive more threat warnings, and their cooperation with the authorities has improved significantly, he noted. “What is still missing are joint procedures to quickly derive concrete measures from warnings,” Lösch said, calling the protection of the economy a cornerstone of national security.

German intelligence describes a Russian shadow war

The warning comes a week after a public hearing of the intelligence oversight panel of the Bundestag, Germany’s parliament, on 5 October. There, Martin Jäger, head of Germany’s Federal Intelligence Service (BND), said Russia was waging a shadow war against Germany. “Germany has become a main obstacle to Russian hegemonic power projection in Europe and thus a target of Russian action,” Jäger said. “The danger of attacks against targets in Germany remains real and present,” he warned.

Sinan Selen, head of the Federal Office for the Protection of the Constitution (BfV), Germany’s domestic intelligence agency, told the same hearing that Russia was showing a readiness for sabotage and killings.

German Chancellor Friedrich Merz said on 1 October that Germany was preparing for further hybrid attacks, “including serious ones,” and would respond “quickly and very clearly,” as it did after the drone attack at Leipzig airport.

Drone bombs, arson, and paid saboteurs on German soil

In August, a drone carrying Semtex explosives hit the wing of a Ukrainian An-124 cargo plane at Leipzig/Halle Airport but did not explode. Germany blamed Russia on 1 September, and German Foreign Minister Johann Wadephul said Germany was not at war with Russia but was a “target of war.”

German authorities suspect Russian intelligence of commissioning an arson attack near two Munich defense firms, and a confidential Federal Criminal Police Office (BKA) assessment counted more than 165 suspected sabotage cases in Germany between January and August. The same assessment recorded 747 suspicious drone incidents involving 1,068 drones over critical infrastructure, military sites, and defense companies.

Explore further

The throwaway agents Moscow sent after a Bavarian drone boss arming Ukraine—and how Germany stopped them

Germany’s Military Counterintelligence Service (MAD) warns that the threat from low-level agents, locals paid small sums for one-off jobs such as arson or photographing military sites, has increased significantly. European intelligence agencies also report that Russia is increasingly targeting defense company executives, including at smaller drone makers, and the BfV has advised some German firms to hire close protection.

As long as Germany keeps backing Ukraine, Russian pressure on its companies is unlikely to ease, and the gap between warnings and action that industry flagged leaves smaller firms, with fewer resources for security, the most exposed.

Russia is preparing to make daily life in Kyiv harder before winter, aiming at the ordinary places civilians use rather than at military sites, The Economist reported. Ukrainian officials say the push blends bombing, sabotage, and disinformation, and expect it to peak in November.

Every winter of its full-scale invasion, Russia has tried to freeze Ukrainians into surrender, and each year the strikes reach deeper into ordinary life. The civilian casualties recorded in 2026 have already passed the whole of last year, the UN says.

From the power grid to the grocery store

Russia has already turned its drones on Kyiv's supermarkets, food warehouses, and data centers this year. On 28 September, a Russian jet drone struck the National Academy of Sciences in central Kyiv. The strike killed two people, the Academy said. Survivors climbed from the windows of the burning building. A senior Ukrainian official told The Economist the Kremlin now wants shoppers too afraid to enter a store. Russia is also keeping its winter routine, hitting electricity, water, and sewage systems.

Cheaper jet drones that stream live to their pilots

Most of the damage now comes from Russia's cheap jet drones, The Economist said. Pilots guide them onto targets and watch a live video feed. They are hard to stop, and Russia's ballistic missiles are deadlier still as Ukraine's supply of Patriot interceptors dwindles. Ukrainian President Volodymyr Zelenskyy said Kyiv had agreed a new Patriot interceptor package, but it remains short of interceptors of its own. A security official told The Economist that Russia has thousands of drones stockpiled and plans to use its entire ballistic missile stock within two months.

Explore further

War is costing Ukraine $155 billion per year. With Western aid running late, Kyiv is freezing everything but army, pensions, and public wages

Sabotage, chaos, and a city that won't switch off

Ukraine's counter-intelligence services say they foil seven or eight Russian plots a week, and officials believe some sleeper cells remain. The campaign's third element, disinformation, targets war fatigue and corruption scandals. Russia runs the same plan every year, hoping its bot farms will push Ukrainians onto the streets to demand surrender, said Andrii Kovalenko, who heads the Center for Countering Disinformation at the National Security and Defense Council.

"It's nonsense," he told The Economist, adding that someone is feeding the idea to Putin so they can steal more money.

Kyiv is also far harder to shut down than Moscow assumes, Kovalenko said. The city's internet is too decentralized for a handful of strikes to knock out, The Economist noted. Energy expert Olha Babii said the test is how fast crews restore power, not whether it can be destroyed. The capital is emptying, its population down from about 3.7 million to 3.3 million by The Economist's count.

Estonia says Russia ordered the August arson attack on Milrem Robotics’ Tallinn premises, an Estonian defense company supplying Ukraine with military ground robots.

Russian sabotage operations have been expanding across Europe in recent months, targeting companies, infrastructure and supply chains connected to Ukraine’s defense effort. European authorities have linked or investigated suspected Russian involvement in arson and other sabotage attempts in several countries, as Moscow seeks to disrupt support for Ukraine and intimidate its European backers.

Foreign Minister Margus Tsahkna said on 29 September that information gathered by Estonia’s Internal Security Service showed the fire at Milrem’s Tallinn premises on the night of 14–15 August was a Russian intelligence-directed sabotage operation. Estonia summoned Russia’s chargé d’affaires over the attack.

Three suspects detained

Estonian authorities had already detained three suspects in connection with the arson, with the suspects apprehended in Latvia. Tsahkna said the perpetrators had been taken into custody and no longer posed a threat to Estonia.

When the investigation was first announced in August, Estonian authorities had not publicly established a Russian connection or disclosed evidence linking Moscow to the fire.

Milrem supplies robots to Ukraine

Milrem Robotics makes THeMIS unmanned ground vehicles, which have been used by Ukrainian forces since 2022 for tasks including transporting ammunition, food and other supplies, evacuating wounded troops, and mine clearance.

The company said in August that the fire had not disrupted its production or deliveries to Ukraine. More than 200 of its robotic systems are expected to be operating in Ukraine by the end of 2026, including more than 150 vehicles funded by the Netherlands.

The attack is part of a growing series of suspected sabotage operations targeting companies and facilities connected to Ukraine’s defense effort. In August, Slovak authorities foiled an attempted arson attack on a Ukrainian drone factory, while European investigations have also examined suspected Russian involvement in attacks on defense-related facilities in Czechia, Lithuania and Bulgaria.

Estonia says sabotage will not weaken Ukraine support

Tsahkna said Russia’s campaign is intended to intimidate European countries, divide allies and weaken their support for Ukraine.

“Russia’s sabotage campaign will not achieve its objectives,” the Estonian Foreign Ministry said, adding that Estonia and its allies would continue increasing pressure on Russia and supporting Ukraine.

Tsahkna said Estonia would respond to the attack by increasing both its support for Ukraine and pressure on Russia.

Several recent incidents across Europe were conducted by Russia or are likely attributable to Russia, ISW assessed in its 24 September report, though authorities have not officially linked the Polish and German incidents to Moscow.

Russia's full-scale war against Ukraine has expanded into a parallel campaign of provocations against European defense and logistical infrastructure. The Kremlin is using drones, arson, and undersea cable sabotage to degrade Europe's will and ability to support Ukraine, while deliberately intensifying the frequency of airspace violations to erode the boundary between hybrid and kinetic war.

Drones over Moldova and Romania

Four Russian drones flew over Bukovyna and targeted an energy facility and border crossings with Moldova and Romania, Chernivtsi Oblast Military Administration head Ruslan Osypenko reported. Ukrainian forces shot down three. The fourth flew toward Suceava County in northeastern Romania.

A drone crashed in Cernița, Florești district, Moldova—preliminarily identified as a Russian Gerbera type, the first such device found in the country. It carried an onboard camera, hit a tree, and exploded, Moldovan police said. Romania's Defense Ministry reported a second aerial vehicle entered Romanian airspace for four minutes and crashed near Solca in the same border region; geolocated footage confirmed it was also a Gerbera, ISW noted. Poland evacuated the Hrubieszów and Dorohusk border crossings for 30 minutes, Prime Minister Donald Tusk said. Three countries were put on alert by a single night of Russian strikes.

"Intentional and accidental Russian drone incursions into NATO and Moldovan airspaces are likely part of the Kremlin's efforts to normalize airspace violations by intensifying their frequency," ISW assessed.

Sabotage in Poland and Germany

A fire engulfed the power system and backup generator at a Starlink ground station in Wola Krobowska, central Poland, on the evening of 23 September. Deputy Prime Minister Krzysztof Gawkowski confirmed it was sabotage aimed at cutting internet access, including for Ukraine's military. Authorities have not identified who was responsible, but the act aligns with Russia's "new" doctrine of attacks, Gawkowski said. The station is now operating normally.

German authorities suspended operations at Berlin-Brandenburg airport for 45 minutes the same evening after staff reported a drone sighting, Die Zeit reported. Federal police could not confirm it. ISW assessed both incidents fit Russia's wider pattern of sabotage against European defense assets, though neither has been officially attributed to Russia.

Explore further

Russian attack puts three countries on alert as drones enter Moldova and Romania

Western intelligence warnings

A Lithuanian Defense Ministry source reported on 23 September that Russia could launch Gerbera drones from a shipping container in the Mediterranean against Spain, France, and Italy. Danish Defense Intelligence assessed on 24 September that Russia will intensify its hybrid war in coming months, including destructive cyber attacks and sabotage carrying a high risk of casualties, and that there is a low but growing risk of a limited Russian military attack on a NATO border state. It sees no indications of an outright invasion. The CIA reportedly warned Poland that Russia may sabotage underwater cables to disrupt its banking system, according to Newsweek Polska journalists.

NATO tracked and confronted Russian submersibles rehearsing deployment of a new cable-disabling weapon near Svalbard in spring 2026—no cables were damaged, but the operation demonstrated Moscow's intent, Reuters reported. Shadow fleet vessels likely served as drone-launch platforms for incursions into NATO airspace, ISW noted.

"The increasing frequency of such warnings suggests that Western intelligence agencies are picking up indicators that the Kremlin is looking to diversify its platforms and means for conducting attacks against NATO and European states and is considering conducting such attacks," ISW assessed.

ISW said it has not yet seen evidence that Russia has conducted the attacks the warnings describe.

Denmark's assessment—that a limited Russian military strike on a NATO border state could come in the coming months—suggests the boundary between hybrid provocations and military action is narrower than European policy has assumed. ISW's synthesis reframes what governments have treated as separate incidents into one campaign.

"Intentional and accidental Russian drone incursions into NATO and Moldovan airspaces are likely part of the Kremlin's efforts to normalize airspace violations by intensifying their frequency," ISW assessed.

"The increasing frequency of such warnings suggests that Western intelligence agencies are picking up indicators that the Kremlin is looking to diversify its platforms and means for conducting attacks against NATO and European states and is considering conducting such attacks," ISW assessed.

Investigators found what they believe is explosives meters from a crashed drone near the Bundeswehr's Wunstorf air base in Lower Saxony, Germany, and the device matches the construction of drones used in the GRU-attributed Leipzig airport attack, Süddeutsche Zeitung, NDR, and WDR reported on 22 September. Germany's federal prosecutor and the Federal Criminal Police Office (BKA) have taken over the investigation, and the same reporting traced one of the Leipzig suspects to a sanctioned GRU colonel who directs sabotage against countries arming Ukraine.

Russia's sabotage campaign against countries supporting Ukraine has escalated from arson packages and recruited proxies to explosives-laden drones targeting military infrastructure inside NATO. Germany's military counterintelligence has attributed repeated sabotage on German soil to Russia, while Finnish President Stubb called the broader alarm about Russian threats an "overreaction"—a position the accumulating evidence from Germany and Poland does not support.

Explosives found days after the drone crash

A farmer discovered the drone, broken into several pieces, on the evening of 14 September, about one kilometer from the Wunstorf air base, Militarnyi reported. Days later, police found a suspicious substance just meters from the crash site. Security sources told SZ, NDR, and WDR they believe it is an explosive, though forensic analysis has not yet been completed.

The drone's design is similar to the devices used in the Leipzig airport attack on 4 August, when attackers tried to destroy Ukrainian cargo planes with explosives-laden drones. At least one component was manufactured using a 3D printer, the reporting found. Investigators believe the drone may have been near the military airfield for a long time—possibly up to two years.

Wunstorf air base houses the Bundeswehr's entire A400M transport fleet. The facility is Germany's central hub for moving troops and materiel worldwide. An explosives-laden drone near this base would represent a direct threat to the Bundeswehr's central global logistics hub.

The Wunstorf find was discussed at the weekly intelligence briefing in the Chancellery on 22 September, the outlets reported.

Leipzig suspect linked to sanctioned GRU colonel

The federal prosecutor's investigation connects the Wunstorf case to the Leipzig attack. In that case, Germany's government has officially blamed Russia. Two suspects were identified: Oleg L., a Latvian with a Russian passport, and Andrei K., a dual Belarusian-Russian citizen whose DNA was found at the Leipzig scene.

SZ, NDR, and WDR reported that Oleg L. maintained years-long contacts with GRU Colonel Denis Smolyaninov. The EU sanctioned Smolyaninov for directing sabotage operations against countries supporting Ukraine. Andrei K. had previously been noticed for minor offenses in the Baltic states and Finland and entered Germany on an Italian tourist visa. Moscow denied involvement in the Leipzig attack.

A drone violated the no-fly zone around NATO's missile shield base in Poland

The Wunstorf case came to light in the same week that a drone violated the no-fly zone around the US-operated Aegis Ashore missile defense base in Redzikowo, northern Poland, on 15 September.

Polish troops guarding the facility called civilian emergency services instead of neutralizing the drone, TVP World reported. Poland's defense ministry said the drone was a civilian device that "posed no threat" and remained under military surveillance, but Defense Minister Władysław Kosiniak-Kamysz ordered a full report into the incident.

Illia Bilyk, a 21-year-old Ukrainian national, admitted five counts of racially and religiously aggravated criminal damage on 17 September over graffiti at five Muslim institutions in east London, the BBC reported.

The BBC and Hope Not Hate linked Bilyk’s attacks to the same Russian network behind arsons targeting properties connected to former UK Prime Minister Keir Starmer. The network operated Direct Action UK, a fake British far-right group that recruited people through Telegram and shared images of the resulting vandalism. Investigations have documented the same recruitment model across Europe for surveillance, sabotage, and other criminal assignments.

The Metropolitan Police said Bilyk sprayed offensive graffiti at three mosques, Noor Ul Islam Primary School, and the Islamic Shariah Council on 23 and 25 January 2025. Images then appeared in a Direct Action UK Telegram group. Russian operators created the group to pose as a British far-right movement, the BBC reported. Bilyk will be sentenced on 19 October.

The handler, known as EL or “El Money,” also recruited through Telegram groups used by Ukrainians seeking work, the BBC found. Ukrainian builder Roman Lavrynovych was paid in cryptocurrency and steered from posters and graffiti to arson.

In May 2025, Lavrynovych set fire to a car and properties connected to Starmer. Nobody was injured. Lavrynovych was jailed for seven years, while Ukrainian-born Romanian national Stanislav Carpiuc was also convicted.

The BBC identified EL as Yevgeny Lyukshin, a 23-year-old Russian diplomat and son of a senior Foreign Ministry official. It cited matching personal details, his presence in the Direct Action UK chat, family connections, and information-warfare training from Rybar, a sanctioned pro-Kremlin Telegram outlet.

However, the BBC could not conclusively establish that Lyukshin was EL, while British police said they had no evidence the attacks were state-sponsored. Lyukshin did not respond. The Russian Embassy denied any connection between Russia or its Foreign Ministry and unlawful activity.

Paid local recruits make Russia-linked attacks look homegrown

The London operation is one of several cases across Europe and other continents.

UK intelligence warned that Moscow increasingly relies on non-state actors, meaning hired civilians and criminals outside its formal services, for espionage, sabotage, assassination, and information operations.

This month, US prosecutors alleged that another Russian network recruited local residents for surveillance, sabotage, and murder-for-hire.

A US-based recruit was promised up to $1,500 to surveil a prominent Russian dissident before being offered $40,000 to “eliminate” or “disappear” the target, the US Justice Department (DOJ) said on 15 September.

The charges connect that alleged plot to what prosecutors describe as a wider Russian assassination network operating since at least 2024 against dissidents, defectors, and countries perceived as supporting Ukraine.

A federal grand jury in Manhattan indicted five alleged members of what prosecutors call the “RIS Network”:

• Yuri Khrameev, 63: A Russian national and former colonel in the Russian intelligence services who allegedly recruited people to kill Russian dissidents.
• Kirill Khrameev, 27: Yuri Khrameev’s son and an officer in the FSB, Russia’s principal security service and a successor to the Soviet KGB.
• Oemis Romagoza Durruthy, 35: A Cuban national living in Russia who allegedly coordinated attacks and arranged travel for operatives.
• Yaidel Delgado Suarez, 35: A Cuban national accused of recruiting people in the US for surveillance and murder.
• Angel Eduardo Castro, 22: A Venezuelan national accused of helping Suarez recruit US residents to spy on and kill a Russian dissident.

Suarez sent the US resident two locations associated with the dissident, according to the indictment. After the resident delivered photographs and videos, prosecutors say, Suarez and Castro made the $40,000 offer. When the resident declined to carry out the killing, they allegedly asked whether he knew “someone [who] can do the work.”

In 2025, the indictment alleges, Kirill Khrameev recruited a US citizen to photograph a target in Lithuania for a promised $200. Yuri Khrameev then offered approximately $25,000 to kill the man. When the recruit refused, Khrameev allegedly proposed a “simpler job”: burning a warehouse or attacking an electrical substation. He said the purpose was to target countries helping Ukraine, according to prosecutors.

Prosecutors also allege that Durruthy coordinated travel and logistics for attacks in Prague, Czechia, in June 2024 and in Lithuania that September. The Justice Department did not specify what either attack involved.

All five defendants are charged with conspiracy to finance terrorism, carrying up to 20 years in prison. Yuri Khrameev, Suarez, and Castro also face a murder-for-hire conspiracy charge carrying up to 10 years.

All five remain at large. Kremlin spokesperson Dmitry Peskov said Moscow saw no need to comment without “credible evidence,” Reuters reported. An indictment is an allegation, and the defendants are presumed innocent.

From military espionage to alleged murder plots

Since Russia’s full-scale invasion, its covert campaign against Ukraine’s Western allies has combined intelligence gathering with escalating sabotage. CSIS found that suspected Russian attacks in Europe nearly tripled from 2023 to 2024, often using locally recruited agents against infrastructure and industries supporting Ukraine.

In August 2025, US prosecutors charged active-duty soldier Taylor Adam Lee with trying to transmit Abrams tank information and deliver hardware to someone he believed represented the Russian government, allegedly in exchange for Russian citizenship. That case involved an American insider allegedly offering military secrets, not a proven Russian recruitment operation.