The FSB's sabotage campaign in Europe: Russia's war on Western arms makers – and what it means for Ukraine
A disaster was narrowly averted in Germany in summer 2026. On the night of 4-5 August, unidentified individuals attempted to attack Leipzig airport with three explosive-laden FPV drones. Their target was a Ukrainian Ruslan aircraft operated by Antonov Airlines. The Ruslans are an important link in the military logistics chain, transporting cargo not only for Ukraine but also for NATO countries more broadly.
A source familiar with the incident told Ukrainska Pravda that the Ukrainians had three strokes of luck that night. The explosive on the first drone failed to detonate, the second drone crashed into another aircraft, and the third never made it into the air. Police found it only a few weeks later on the outskirts of the airport. Something had apparently spooked the perpetrator.
According to Politico, investigators soon noticed similarities between the drone's warhead and other improvised explosive devices found in caches set up by Russian agents elsewhere in Europe.
The brazen sabotage attempt in Leipzig marked a new escalation in the hybrid war targeting Europe's military sites and defence industry facilities. OSINT analysts have noted that the attacks are becoming more frequent and increasingly systematic.
The Russians themselves are no longer hiding their hand: the arms factories of Ukraine's partners are in their sights.
"It's a secret. A military secret," Russian leader Vladimir Putin said when asked by reporters whether Russia could attack facilities in the UK defence sector.
Ukrainska Pravda looks at Russia's sabotage campaign across Europe and whether it could put continued support for Ukraine at risk.
Fifty incidents involving hybrid attacks in a month
Russia has repeatedly tried to put a bomb under EU support for Ukraine – both literally and figuratively.
The OSINT tracker Malcontent News has logged 497 acts of hybrid warfare across Europe since Russia launched its full-scale invasion in 2022. In 454 cases, its analysts identified direct links to Russian or Belarusian hybrid operations. The attacks have taken many forms: cyber-attacks, vandalism, sabotage, arson and incursions by unknown drones.
OSINT analyst Clément Molin estimates that 50 incidents have been recorded across Europe since the start of September alone, many of them likely linked to Russia's hybrid campaign. At least 10 incidents over the past two months have involved the defence industry or military logistics.
Russian intelligence services are behind the planning and organisation of these operations, but they turn to civilians to carry them out. Members of local criminal gangs serve as the Kremlin's intermediaries, seeking out recruits and paying them in cryptocurrency for each job. Former Wagner Group recruiters have also taken part in the process. Ukrainian migrants recruited by the FSB are also frequently among the perpetrators.
Using local residents gives sabotage operations a convenient cover, making them look like industrial accidents or acts of anti-war, environmental or pro-Palestinian activism. But the same approach can also undermine the operation itself. Untrained recruits are prone to mistakes that trained professionals would know how to avoid.
In Leipzig, it was precisely this kind of mistake that helped avert a tragedy.
Sabotage
Most acts of sabotage across Europe between 2022 and 2025 were not aimed at defence industry facilities. Instead, they appeared designed to threaten or intimidate. In most cases, police and counter-intelligence services managed to thwart the attacks – and, in some instances, even prevent assassination attempts.
For instance, in 2024, Russia planned to assassinate Armin Papperger, CEO of German defence giant Rheinmetall, which supplies weapons to Ukraine. The plot was foiled by the US and German intelligence services.
In 2026, the picture has changed dramatically. Defence industry facilities have been increasingly drawn into the sabotage campaign.
One of the most notable incidents was a fire at the Czech drone and optical systems manufacturer LPP Holding. The blaze damaged production facilities and destroyed stock in the warehouse.
Despite the damage, the company said the planned delivery of 40 attack drones to Ukraine remained on track. Czech police immediately determined that the fire had been deliberate and investigated it as a possible terrorist act.
A previously unknown pro-Palestinian group claimed responsibility, accusing LPP of manufacturing weapons for Israel. The company rejected the claim, saying it has no cooperation with Elbit Systems and does not manufacture equipment for Israel. LPP and Elbit Systems announced a partnership in 2023, but the deal was never realised.
LPP suggested that the pro-Palestinian cover story could have been a Russian covert operation aimed at disrupting the company's cooperation with Ukraine.
Another suspected act of sabotage targeted transformers and power-line pylons supplying KNDS and MBDA, major European defence companies that manufacture missiles and ammunition. The attack left 3,000 homes without electricity, and graffiti reading "Action against war" was found nearby.
And the Russians themselves did not stay silent.
On 15 April, Russia's Ministry of Defence released a list of 21 Ukrainian and European companies producing drones and drone components for Ukraine. It gave the addresses of their manufacturing facilities and named the sites themselves. The accuracy of the list is difficult to verify from open sources. But the message was hard to miss.
"When strikes become a reality depends on what comes next. Sleep well, European partners!" Dmitry Medvedev, former Russian president and current deputy chairman of the Security Council, wrote in a comment on the matter.
Four months after Medvedev's comment, a failed sabotage operation in Leipzig showed that Russia was prepared to take its confrontation with Europe a step further.
Fires and explosions hit ammunition depots belonging to arms maker EMCO in Bulgaria on 10 and 12 August. Three days later, a fire followed by explosions broke out at a KNDS ammunition factory in Italy.
Neither Bulgaria nor Italy has officially blamed Russia for the explosions. The authorities have instead attributed them to production problems and human error. EMCO tells a different story, directly linking the incidents to the company's operations and its owner, Emilian Gebrev.
This is not the first time the Bulgarian company has come under attack from Russia. Ukraine has been receiving ammunition from EMCO since 2014 – the same year the first explosions occurred at its depots. In 2015, Russia's GRU military intelligence service attempted to poison Gebrev himself. Similar arson attacks and explosions struck EMCO warehouses again in 2022 and 2023, and investigators found a Russian connection in each case.
In other cases, the Russians were directly accused of sabotage. On 15 August, unknown individuals set fire to Milrem Robotics in Tallinn, which supplies THeMIS ground robots to Ukraine.
The fire was quickly contained, no one was injured, and production carried on as usual. A month later, the Estonian government said the arson attack was an act of sabotage orchestrated by Russian intelligence.
Another incident took place in Slovakia in late August. Local police foiled an arson attack on a Skyeton production facility in the east of the country, where the Ukrainian company manufactures unmanned systems. Company representatives told Ukrainska Pravda that Russian operatives also regularly attempt to target its facilities in Ukraine.
Similar incidents have been reported in Poland, France and Germany. Fires at production facilities belonging to WB Electronics, Delair, Rohde & Schwarz and Helsing have been linked to Russia's military intelligence.
Explosions of unknown origin have also rocked Serbian defence factories producing weapons that end up in Ukraine.
Not every explosion or fire at a defence facility is necessarily an act of sabotage. Rising orders and the rapid expansion of production inevitably bring about the occasional accident.
For instance, a fire broke out on 17 September at ZVS Holding, an ammunition manufacturer owned by CSG (Czechoslovak Group), in Slovakia. CSG spokesperson Andrej Čirtek told Ukrainska Pravda that the company has no information linking the fire to sabotage.
Čirtek said: "The fire broke out during roof renovation work carried out by an external contractor. Based on the findings available so far, the most likely explanation is that the fire was related to the renovation work. However, the investigation by the relevant authorities is still ongoing, so we do not want to speculate about its final conclusions."
How Europe is responding
By carrying out such operations across Europe, the Kremlin is probing how far it can go. Moscow is gauging European countries' responses to sabotage and testing NATO's resilience, taking care not to cross the threshold that could trigger the Alliance's Article 5.
Beyond the immediate damage, acts of sabotage can help map the infrastructure supporting military logistics and reveal vulnerabilities that could become targets in a future conflict.
This is precisely why the arson attacks on defence factories are only part of the picture. There have also been reports of railway tracks being blown up, drones flying over strategic airfields, communications being jammed and other provocations.
Europe has yet to develop a unified response to these events. In the cases mentioned above in Bulgaria and Italy, the governments have refrained from directly accusing Moscow, apparently out of concern that doing so could further escalate tensions.
Other countries take a more sober view of the threat from the east and are seeking ways to counter Russian sabotage. Germany is perhaps the most active in this effort. Its law enforcement and security services are searching for weapons caches that Russian operatives may have set up in preparation for future attacks.
Germany is also putting together a broad package of measures to counter Russian sabotage and cyber-attacks. Special forces are being deployed in strategically important cities across the country to protect critical infrastructure against drones and deal with explosive devices. Police units will work alongside them. Ukraine has been sharing its experience with Germany in this area.
A source familiar with the situation in Leipzig told Ukrainska Pravda that the German law enforcement agencies handled the attempted attack on Ukrainian aircraft particularly well.
"The first thing the German authorities did after the investigation was not to disclose what they had found, but to explain how they would prevent this from happening again," the source said. "They thoroughly analysed everything that happened on the day of the attack and have since introduced a great many security measures to ensure that such acts of sabotage do not happen again. Yes, they were unable to prevent it, but ultimately, the situation served as a wake-up call for them."
Other European countries are also taking active steps to counter the threat. Romania and Germany, for example, have been detaining civilians suspected of collaborating with Russia. Poland has deployed 10,000 troops to protect critical infrastructure after explosions damaged railway tracks. Lithuania, Latvia and Estonia have set up joint investigation teams to investigate terrorist attacks and acts of sabotage.
A European intelligence official told AP that European intelligence services are now committing as many resources to countering Russian sabotage as they do to combating terrorism.
Defence companies are also tightening their security measures. Representatives of Milrem Robotics told Ukrainska Pravda that the company is changing its approach to security following the arson attack on its premises.
"Since Russia's full-scale invasion of Ukraine, the security situation in Europe has clearly changed, and defence companies must take this into account," says a Milrem Robotics representative.
Will acts of sabotage affect support for Ukraine?
Another clear aim of Russia's sabotage campaign is to weaken European support for Ukraine and reduce the flow of aid.
So far, Russia has failed to achieve this. Most companies have suffered financial losses, but supplies have continued uninterrupted. Some factories temporarily lost production capacity, only to return to normal levels later. The way these sabotage operations have been carried out also suggests that, for now, intimidation is the main objective rather than disruption.
The choice of targets is also telling: Russia is carrying out these operations in countries that are actively helping Ukraine strengthen its defences. By contrast, in countries that provide little support to Ukraine, such as Hungary, no such incidents have been recorded. Moscow is therefore trying to make ordinary Europeans feel the cost of supporting Ukraine.
As warnings of a potential conflict between the EU and Russia become more frequent, European and US intelligence agencies are increasingly highlighting the expansion of Russia's hybrid war against Europe. European governments, too, are beginning to recognise the scale of the threat.
One of the key messages at the 2026 Munich Security Conference was that European leaders must accept this reality and act on it.
Translated by Artem Yakymyshyn
Edited by Susan McDonald