European Security — 2026-08-24

Russia Recruits Criminal Networks for Sabotage Campaign Against European Defense Plants

BLUFMoscow's use of criminal cutouts and cryptocurrency payments makes formal Western attribution within 60 days unlikely, allowing the sabotage campaign to expand unchecked across NATO supply chains.

The Telegraph reported, citing Western intelligence sources, that Russia has launched a fresh wave of sabotage attacks on European weapons factories, recruiting local criminal gang members to obscure Kremlin involvement and keep the attacks calibrated below the threshold that would trigger NATO's Article 5 mutual-defense clause 123. Latvia this week detained three of its own nationals on suspicion of the August 15 arson of a Milrem Robotics building in Tallinn, an Estonian firm supplying unmanned ground vehicles to Ukraine 12. The same reporting links the incident to explosions this month at Bulgaria's EMCO ammunition plant on August 10, reportedly sparked by a fire in a lorry parked near a storage warehouse, and at the KNDS Ammo Italy facility near Rome three days later, traced to an unexplained fire in a gunpowder processing unit, alongside an earlier fire at a Czech drone and thermal-optics plant that led to four detentions over suspected Russian involvement and an attempted arson at a Lithuanian factory supplying radio-wave scanners to Kyiv that resulted in six people being charged 123. Citing Latvia's state security service chief Normunds Mežviets, the Telegraph reported that GRU officers recruit intermediaries through Telegram rather than traveling to target countries, with local recruits paid in cryptocurrency 13. Italian and Bulgarian officials have not attributed their incidents to Russia 123.

Analysis
Formal Western attribution of these incidents to Moscow within 60 days is unlikely, since European governments have shown sustained reluctance to publicly link Russia to defense-sector sabotage even as the pattern spreads into Italy and Bulgaria. Calibrating each attack below the Article 5 threshold gives those governments continued cover to treat incidents as isolated criminal matters. Confidence is low, given reliance on a single intelligence-sourced account without independent government confirmation of GRU tradecraft. The dispersed causes cited, a lorry fire in Bulgaria and an unexplained gunpowder-processing blaze in Italy, are also consistent with industrial accident or uncoordinated criminal opportunism rather than a directed campaign. Formal attribution would force NATO into collective defense-industrial hardening and Article 5 consultations, while continued non-attribution leaves individual states funding plant security unilaterally as the campaign expands unchecked.
3 sources
  1. Russia sabotages weapons factories across Europe - The Telegraph
  2. The Telegraph: Russia launches wave of sabotage attacks on weapons factories in Europe - Ukrainska Pravda
  3. Russia recruits criminals for sabotage at European defense plants – The Telegraph - LIGA.net

View in full brief →

UNCLASSIFIED // OPEN SOURCE