Adversary Intelligence — 2026-08-25
Western Intelligence Links Wave of Defense Factory Sabotage Across Five European Countries to Russian GRU
BLUFParallel investigations across multiple countries make formal GRU attribution likely within 90 days, but Moscow's proxy recruitment model ensures further sabotage of Europe's defense supply chain remains cheap to execute.
Western intelligence officials cited by The Telegraph suspect Russia is running a covert sabotage campaign against European defense manufacturers supplying Ukraine, using local criminal intermediaries rather than GRU officers operating abroad 1234. Estonian prosecutors are investigating an August 15 fire at a Milrem Robotics facility in Tallinn as suspected sabotage, and Latvia has detained three of its citizens in connection with the incident 14. The pattern includes an August 10 explosion at Bulgaria's EMCO ammunition plant and an August 13 blast at the KNDS Ammo Italy facility near Rome, though Italian and Bulgarian officials have declined to attribute either to Russia 124. Earlier incidents cited include a fire that heavily damaged a Czech drone and thermal-imaging factory, with four suspects detained, and a 2024 attempted arson at a Lithuanian radio-wave scanner supplier for which six nationals of Spain, Colombia, Cuba, Russia and Belarus were charged in January 2026 12. Latvian State Security Service chief Normunds Mežviets told The Telegraph that GRU officers recruit through intermediaries on Telegram rather than traveling to target countries themselves 134. Western officials assess the attacks are deliberately kept below the threshold that would trigger NATO's Article 5 mutual defense clause, testing alliance responses while preserving deniability 1234.
AnalysisDetection of a fire or explosion no longer requires GRU officers to set foot in a target country, which flattens the risk calculus for further strikes on Ukraine's European supply chain and complicates any single government's case for public attribution. At least one of Estonia, Latvia, Bulgaria, or Italy will
likely name Russia or the GRU in a formal attribution of one of these incidents within the next 90 days, given the volume of parallel investigations and detained suspects across four countries. Low confidence reflects that no government has yet closed an investigation or produced forensic evidence tying an attack to Moscow rather than to independent criminal actors.
5 sources
- Western Intelligence Suspects Russia of Covert Sabotage Campaign Targeting European Arms Plants - YourNews
- The Telegraph: Russia launches wave of sabotage attacks on weapons factories in Europe - Ukrainska Pravda
- Russia recruits criminals for sabotage at European defense plants – The Telegraph - LIGA.net
- Western Intelligence Links European Arms Factory Sabotage Wave to Russia - Mezha
- Russia targets weapons factories in new campaign - The Telegraph
View in full brief →