Europe's Invisible War: Why Russia's Sabotage Surge Is a Test of NATO's Nerves

Europe burned again this August. This time, the targets were not protest marches or election offices. They were warehouses, factories and companies that supply weapons to Ukraine.

Fourteen fires. Two drone attacks. Three arrests in Slovakia. A firm in Bulgaria declaring that human error was excluded. Across the continent, the evidence pointed to one conclusion, even as Moscow denied it: Russia was expanding its war onto European soil, using methods drawn from the Cold War playbook and updated for the age of drones and cyber operations.

The attacks did not happen in isolation. They formed a pattern — and patterns matter in intelligence work. What we are seeing is not a string of unfortunate coincidences but a deliberate campaign to probe, test and pressure.

The targets tell the story

Leipzig airport was the opening move. Drones packed with explosives were discovered there in July, used by Ukraine to ferry military supplies. Germany’s interior minister confirmed in August that Russia was behind the operation. The devices, according to German reports, appear to have malfunctioned — a detail that suggests either sloppy execution or an attempt to create a dramatic incident that would force a security response without crossing the line into mass casualties.

Then the fires began.

In Bulgaria, a warehouse belonging to defence firm EMCO caught fire on 10 August. The company said previous blasts at its facilities had also been investigated for links to Russia. In Italy, a fire at KNDS Ammo Italy outside Rome triggered a large explosion. In Estonia, the Milrem Robotics factory — which the Kyiv Post reported supplies drones to Ukraine — went up in flames. In Slovakia, police stopped an arson attack on a Ukrainian-owned drone manufacturer and seized a large amount of incendiary mixture. In Poland, two more fires were reported, one at a company producing helicopter components and another at a drone producer, where CCTV captured a masked man throwing incendiary devices.

Each attack was designed to look accidental. Each was designed to leave investigators reaching for answers.

Who is doing the hitting?

For years, Moscow has relied on what analysts call “gig economy saboteurs” — Russian-speaking operatives from former Soviet states, recruited online, motivated by cash rather than ideology. The International Institute for Strategic Studies compared them to kamikaze drones: cheap, disposable, and often sloppy. The parcel bomb plot of 2024, in which packages containing liquid explosive were sent from Lithuania to the UK and Poland, ended in failure when one sender could not find a pickup point.

The Leipzig operation may mark a shift. Reports suggest the men who loaded and launched the drones were Russian nationals who entered Germany specifically for the job. If true, it signals a move from proxy operations to direct action — a escalation in both method and intent.

Why now?

Several factors are converging. Ukraine has taken the war to Russian territory, striking deep inside borders that Moscow has long treated as inviolable. The pressure on Kremlin decision-makers is real. At the same time, Western governments have begun allowing Ukraine to use Western-supplied weapons deeper inside Russia, a policy shift that Moscow views as a red line crossed.

The IISS noted a previous surge in sabotage activity in 2024, around the same time. The current wave may be the next phase.

Daniela Richterova of King’s College London sees the campaign as coercive signalling — a way to pressure countries, particularly Germany, into reducing military aid to Kyiv. Keir Giles of Chatham House argues the goal is different: testing NATO’s responses, identifying vulnerabilities, and learning what works. Both interpretations may be correct. Coercion and reconnaissance are not mutually exclusive.

What happens next?

The most dangerous aspect of this campaign is not what has already occurred but what it reveals about Europe’s defences. Most of the fires are still being investigated. Some will be ruled accidental, exactly as the attackers hope. The uncertainty is the point. It creates doubt, it consumes resources, and it forces governments to react to events rather than anticipate them.

The risk of escalation is real. An exploding parcel on a cargo plane. A drone striking a civilian aircraft at Leipzig. A fire at a chemical facility releasing toxic materials. Each scenario could trigger a response that outpaces the original attack, pulling NATO into a crisis it did not plan for.

NATO’s doctrine was written for state-on-state conflict, not for a campaign of small, deniable attacks that individually fall below the threshold of armed aggression. How many incidents make an assault? Who decides? The questions remain unanswered, and the lack of clarity is itself a weapon.

The infrastructure gap

Europe’s defence against sabotage is fragmented. Germany has over 165 suspected cases this year, according to federal police reports, but no public attribution strategy. Poland’s prime minister called the attacks a continuation of Russia’s escalatory activities. Bulgaria and Italy are still investigating. Estonia arrested two suspects. Slovakia apprehended three. But none of these responses are coordinated.

The next strike may not target a factory. It could target energy grids, digital infrastructure, or transportation hubs — systems that keep societies running and that are far harder to defend than a warehouse in Tryavna. The saboteurs are already mapping the landscape. The question is whether Europe is mapping back.

The bottom line

Russia is waging a war that does not look like war. It is cheaper, deniable, and difficult to deter. The attacks on Europe’s defence sector are a stress test — of political will, of intelligence cooperation, and of the assumption that the continent’s borders are secure. So far, the test is ongoing. The results are not yet clear.