Europe targeted by spiralling campaign of sabotage and Russia is the chief suspect

Europe has been hit by a widening sabotage campaign, with Russia the main suspect

Germany said the attack at Leipzig airport was part of a pattern of "Russian hybrid operations" in Europe

As Europe endured record summer heat and many politicians switched into holiday mode, Russia stayed focused on its war.

Not only did its military assaults across Ukraine intensify last month, becoming even deadlier for civilians, Russia also appears to have stepped up its sabotage campaign across Europe.

This time, military and defence industry sites were the main targets.

A month after drones packed with explosives were discovered at Leipzig airport, which Ukraine uses to move military supplies, Germany’s interior minister said that "Russia is responsible".

Vladimir Putin is, as ever, demanding proof, while his officials dismiss the allegation as "absurd".

But the drones were only the dramatic beginning. August then saw a string of suspicious fires at defence facilities from Italy to Estonia.

Some of the countries involved have already pointed the finger at Russia; others are still investigating, and some of the fires may ultimately be judged accidental, which is exactly how such attacks are meant to appear.

Poland’s interior minister is unequivocal.

"There are many, many signals that Russia is changing its strategy and intensifying its activities, including terrorist and sabotage activities," Marcin Kierwiński said, urging people to stay alert.

4 August Germany:

The first drone at Leipzig airport is found.

10 August Bulgaria:

A major fire breaks out at a factory belonging to defence company EMCO, with early reports saying a truck caught fire during a fuel delivery.

13 August Italy:

A fire at KNDS Ammo Italy outside Rome causes a major explosion.

La Repubblica reports that the local prosecutor is examining possible outside interference. Publicly, his office will only confirm that a case has been opened for negligent disaster against "unknown persons".

15 August Estonia:

The Milrem Robotics factory in Tallinn, which the Kyiv Post says supplies drones to Ukraine, is engulfed in flames. Two suspects are arrested.

Estonian Prime Minister Kristen Michal says investigators are "taking seriously" the possibility of Russian sabotage.

25 August Slovakia:

Police say they have foiled an arson attack on a Ukrainian-owned drone manufacturer and seized a "large amount of incendiary mixture". The company itself blames Russia, and police arrest three suspects whom they say were "following orders". Slovakia is Russia’s close ally in Europe.

30 August Poland:

A country already heavily targeted for sabotage reports two more fires.

One is in Lublin at a company that makes helicopter components. Prime Minister Donald Tusk said arson "cannot be ruled out".

An attack on drone maker WB Group is more clear-cut. A masked man is caught on CCTV throwing incendiary devices. Tusk calls it a "continuation of Russia's escalatory activities".

The pattern has carried into September, with two Bulgarians arrested in Munich, Germany, on suspicion of arson after throwing incendiary devices from a car at defence firm Rhode & Schwartz.

The 31 August fire at Skarżysko-Kamienna targeted one of Poland’s biggest defence companies.

Attacks on military and defence targets are not new, although earlier sabotage linked to Russia has included more puzzling targets, such as an Ikea store and a Polish paint shop.

What is new is the concentration of cases.

"The intensity of military sites being attacked we've seen over the past couple of weeks is unusual," says Daniela Richterova of the Department of War Studies at King’s College.

She connects the surge to developments in Russia’s invasion of Ukraine.

"We've basically seen Ukraine take the war to Russia and strike deep inside Russian territory…They [Moscow] are under pressure, they have to do something."

While some sabotage is staged to create chaos or fear, Richterova believes the Kremlin’s current goal is "coercive signalling": pressuring countries to stop backing Kyiv by raising the stakes.

After a slow start, Germany is Ukraine’s biggest supplier of military aid.

There are other theories.

To some, Russia is less interested in "turning off the taps" of supplies to Ukraine and more focused on testing Nato for weaknesses.

"Russia is probing the boundaries of what's acceptable and collecting information on the results. They find out what works, and what's vulnerable," argues Keir Giles of the Chatham House think tank.

He sees the sabotage campaign as preparation for the "next phase", as he puts it, of Russia’s aggression in Europe.

"They're assessing the willingness of the victim country to actually do something about it."

The International Institute for Strategic Studies (IISS), which tracks sabotage cases, points to an earlier surge in 2024, when Ukraine’s allies began allowing it to use Western-supplied weapons deeper inside Russia.

2024 was the year of the parcel bomb plot, when Russia was accused of sending packages containing liquid explosive to the UK and Poland.

One ignited just before it was loaded onto a DHL cargo plane. It is believed this was a test run for something much larger.

Four parcels were sent from Lithuania to the UK and Poland in 2024 - two caught fire, at a warehouse in the UK and at Leipzig airport

"That was a marked high in terms of their willingness to inflict mass casualties," Giles adds.

It was such a serious step that the White House contacted the Kremlin to tell it to stop. Russia had tested the boundary and found the limit.

But the attacks have continued. German media on Friday cited a federal police report listing more than 165 suspected sabotage cases nationwide this year, though it does not say who is responsible.

Reports from Germany suggest the men who loaded and launched the drones at Leipzig airport were Russian, and that at least one may have entered the country specifically for this mission.

That would be unusual.

The overwhelming majority of sabotage attacks in Europe have been carried out by Russian proxies: its so-called "gig economy saboteurs".

They are usually Russian-speakers from former Soviet states, recruited online and motivated by money rather than political belief.

In one case reported by the BBC from Poland, the hired saboteurs had previously volunteered to fight for Ukraine.

The "handlers" are generally believed to stay in Russia, coordinating operations online.

The IISS compared the proxies to kamikaze drones: cheap and easy to deploy in large numbers, but disposable.

The amateurs can also be careless or reckless. In the parcel plot, one man failed to find a collection point and the entire mission had to be called off.

So if Moscow did send professionals for the Leipzig drone launch, that would suggest it wanted precision - and success.

In fact, the devices appear to have malfunctioned.

Russia’s sabotage operations appear to come from the Cold War playbook. Daniela Richterova’s research shows very similar targets on Soviet sabotage lists, and agents-saboteurs were used in much the same way.

The idea, she says, was to carry out small, deniable attacks in peacetime that would escalate in wartime.

"I think we are still in the grey zone between the two, but the kind of attacks we've seen in the past weeks shrink that zone," she says. "And I think that increases the risk of what happens next."

As Nato rushes to respond, questions remain over how many small, individual attacks amount to a sustained Russian assault - and require action.

Perhaps the greatest danger is escalation by accident.

What if the exploding parcel had detonated in mid-air and caused a crash? What if the Leipzig drone had brought down a plane?

"I think it could result in a big attack," Richterova says. "Then Nato, in this heightened security environment, would not be able to ignore that, and have to react."