Russia is said to have launched a new sabotage campaign against European factories supplying arms to Ukraine. Fires and explosions have been recorded recently in Estonia, Bulgaria, Italy, and the Czech Republic, but Moscow’s involvement has not been proven in all cases.
Western intelligence services believe that the operations are designed to disrupt Kiev’s supply chains and test the Alliance’s response, without crossing the threshold that could trigger the activation of Article 5 on collective defense.
The Kremlin is said to be using members of local criminal groups and individuals recruited through intermediaries, making it difficult to establish a direct link to Russia, according to The Telegraph, citing sources from Western intelligence services.
Fire at a supplier for the Ukrainian army
The most recent investigated case occurred in Estonia. A building of the company Milrem Robotics in Tallinn was set on fire on August 15.
The company is one of the two foreign providers of unmanned ground vehicles for the Ukrainian army. Three Latvian citizens were detained in Latvia, suspected of causing the fire.
Estonian Prime Minister Kristen Michal stated that investigators are checking whether it was an act of sabotage and whether Russia was involved.
Latvian authorities did not directly accuse Moscow, but specified that the suspects were detained under legislation targeting those who "provide assistance to a foreign state in actions against another state."
"In recent years, Russia has intensified its destabilization campaigns against allies through cyberattacks, assassination attempts, and acts of sabotage," a NATO official told the British publication.
Explosions in Bulgaria and Italy
Two other incidents occurred in August at major arms factories in Bulgaria and Italy.
On August 10, a powerful explosion affected a unit of EMCO, one of the largest private arms manufacturers in Bulgaria. The company produces artillery ammunition of 155 mm intended for Ukraine. The fire reportedly started from a truck near a warehouse.
Three days later, an explosion occurred at the KNDS Ammo Italy ammunition factory in Colleferro, near Rome. Authorities announced that the blast was preceded by a fire that broke out, for reasons still unknown, in a section where gunpowder was being processed.
Italian and Bulgarian authorities refrained from associating the incidents with Russia due to lack of evidence.
In the Czech Republic, a fire almost completely destroyed a drone and thermal imaging equipment factory for Ukraine earlier this year. Four individuals were detained in an investigation examining a possible involvement of Moscow.
Lithuania has prosecuted six individuals accused of attempting to set fire to a factory supplying Kiev with radio wave scanning equipment.
Recruits paid in cryptocurrencies
An assessment by Western services indicates that the Russian military intelligence agency GRU has changed its modus operandi. Instead of specially trained agents sent directly to the targeted countries, Moscow now allegedly uses members of criminal groups and local intermediaries.
"From our experience, we do not see GRU officers physically coming to our country. They stay in Russia, where they are safe. They do not take risks for their operational and physical security," explained Normunds Mežviets, head of Latvia's security service, in March.
GRU officers reportedly recruit intermediaries from the criminal world through applications like Telegram. These intermediaries then seek individuals willing to carry out various missions in exchange for payments in cryptocurrencies. Some of the recruits may not even be aware that they are acting in Russia's interest.
This method allows the Kremlin to maintain distance from the operatives and makes it much more difficult to attribute the attacks.
Moscow tests how far it can go
Western services believe that this campaign also aims to provoke disagreements among NATO members.
Poland and the Baltic states openly accuse Russia of hostile actions on European soil. Countries like Italy or Germany are more cautious and avoid implicating Moscow without clear evidence, including out of fear of escalation.
Following the explosions that destroyed the Nord Stream pipelines, several European officials warned that an attack of such magnitude could lead to the activation of Article 5. However, in the case of smaller incidents that are difficult to attribute, the allies' response has been much more reserved.
According to the assessment cited by The Telegraph, each operation left unanswered provides Russia with information on how far it can push NATO's boundaries.
NATO Secretary-General Mark Rutte has repeatedly described alleged Russian sabotage actions as "reckless and dangerous" and has called for a "clear, rapid, and decisive" response.
"NATO continues to strengthen its resilience and improve the tools it has to counter hybrid actions. We monitor hostile activities against allies, including those carried out through intermediaries," conveyed an Alliance official.
The unofficial communication channels that once facilitated the management of tensions between Moscow and European capitals have greatly diminished since the invasion of Ukraine. In these circumstances, Western officials fear that hybrid actions could pave the way for more serious confrontations.
Rutte warned that Russia may be preparing to use force against NATO in the next five years. The campaign conducted so far, especially in states on the Alliance's eastern border, seems to be expanding westward and risks becoming a new normal in the confrontation between Russia and NATO.