Russia sabotage Europe concerns are rising as NATO countries investigate attacks and unexplained fires involving defence firms linked to Ukraine. Western officials say Russia increasingly uses proxies for hybrid operations, but direct Moscow involvement has not been established in every recent incident.
NATO hybrid threat draws fresh scrutiny
European security services are increasingly focused on suspected Russian hybrid operations targeting infrastructure and defence industries that support Ukraine. NATO says Russia has intensified activities across allied territory using sabotage, cyber operations, violence, disinformation and proxies designed to blur the line between peace and open conflict.
The method offers plausible deniability. Rather than relying only on intelligence officers, authorities have documented cases in which intermediaries or recruits carry out reconnaissance, arson or other disruptive acts. A German court this month convicted a man over a parcel operation prosecutors linked to a Russian-directed sabotage scheme, reinforcing concerns about proxy recruitment.
Milrem arson investigation reaches Latvia
The latest focus is Estonia, where a building used by defence company Milrem Robotics caught fire overnight on August 14-15. Estonia's Prosecutor's Office said initial evidence pointed to possible arson and that investigators were examining whether the incident constituted sabotage.
Three suspects living in Latvia were subsequently detained in connection with the fire. Estonian Prime Minister Kristen Michal has said investigators are examining a possible Russian link, but authorities have not established responsibility.
Milrem manufactures unmanned ground vehicles used by Ukraine. The company said the incident had not disrupted production or deliveries, making the immediate operational impact limited even as the security implications remain serious.
Arms factory fires remain under investigation
Other recent incidents have heightened concern, although their causes should not be grouped automatically as Russian sabotage.
On August 10, explosions followed a fire at an EMCO ammunition facility near Belitsa in Bulgaria. Bulgarian authorities said investigations were continuing, while company officials initially said there was no evidence of external interference.
Three days later, a powerful explosion struck KNDS Ammo Italy's plant in Colleferro near Rome after a fire in a gunpowder-processing area. All workers were accounted for and investigators were still examining the cause.
The incidents therefore strengthen concern about the vulnerability of Europe's defence supply chain, but they do not by themselves prove a coordinated Russian campaign.
GRU proxy tactics complicate attribution
European investigations have previously tied sabotage plots to Russia's GRU military intelligence service. In March, investigators identified 22 suspects linked to parcel explosions believed to have been organised by the GRU, while NATO has repeatedly warned that Moscow uses proxies as part of a broader destabilisation campaign.
Encrypted messaging, cryptocurrency and locally recruited intermediaries make attribution harder. Recruits may have little understanding of who ultimately directs an operation, allowing organisers to distance themselves from an attack.
That ambiguity is strategically useful because NATO's Article 5 collective-defence mechanism was designed around armed attacks, while hybrid operations often remain deliberately below that threshold.
Europe faces a difficult defence challenge
The growing concern is not that every factory fire or act of vandalism is Russian-directed. Treating unexplained incidents that way would weaken credibility.
The stronger evidence is the documented pattern: NATO says Russia is conducting increasingly aggressive hybrid actions, and European courts and prosecutors have tied several operations to Russian intelligence or suspected proxies.
Europe's challenge is therefore to protect factories, logistics networks and Ukraine-linked suppliers while distinguishing genuine sabotage from accidents. That balance matters because Moscow benefits both from successful disruption and from uncertainty over who caused it.
