European Intelligence Agencies Attribute Pan-Continental Sabotage Campaign to Russian Military Intelligence

European defense contractors and military logistics hubs are operating under heightened security protocols this week after intelligence services across the continent formally attributed a wave of infrastructure sabotage to Russian military intelligence. The coordinated attribution moves a series of previously isolated arson attacks, drone incursions, and surveillance arrests into a unified framework of state-sponsored hybrid warfare directed by Moscow.[1][3]

The shift in posture follows the disruption of multiple active plots in early September 2026. On Tuesday, Romania's domestic intelligence service, the SRI, announced the detention of a Russian citizen who had been surveilling NATO communications centers and Ukrainian Antonov cargo aircraft on Romanian territory since February. The SRI stated the suspect was instructed by an intermediary to capture "photo-video materials with targets of strategic military interest."[4]

The Romanian operation mirrors warnings issued days earlier by Denmark's Security and Intelligence Service (PET). Emil Gresholm, PET's head of counter-espionage, confirmed that Russian operatives are actively recruiting citizens through social media and gaming platforms to prepare for physical attacks against companies supplying military aid to Kyiv. Gresholm noted that Russia is "both planning and carrying out acts of sabotage against defence companies and the defence industry in Europe."[2]

The tactical shift relies heavily on proxy actors rather than traditional intelligence officers operating under diplomatic cover. Following the expulsion of more than 700 Russian diplomats from European capitals since 2022, Moscow's military intelligence directorate, the GRU, has increasingly outsourced physical sabotage to local criminal networks and vulnerable individuals recruited online.[1][3]

This proxy strategy is designed to maintain plausible deniability while stressing European investigative resources. Recruits are often paid small sums—sometimes just 2,000 to 3,000 euros—to execute high-risk operations, such as the August 5 drone attack targeting a Ukrainian An-124 cargo plane at Germany's Leipzig/Halle Airport, which Berlin formally attributed to Russian state actors.[1][4]

The diplomatic fallout is accelerating alongside the physical security measures. On Tuesday, Hungary—a state that had previously maintained warmer relations with Moscow during former Prime Minister Viktor Orban's 16 years in power—ordered the expulsion of 10 Russian diplomats. Hungarian Foreign Minister Anita Orban cited activities "unacceptable for diplomats under the Vienna Convention," prompting Russian Foreign Ministry spokeswoman Maria Zakharova to promise a "harsh and painful" response.[5]

The reliance on local proxies lowers the operational barrier for attacks but increases the risk of miscalculation. Western intelligence officials note that while the campaign aims to disrupt supply lines and degrade public support for Ukraine, the use of untrained operatives raises the probability of mass-casualty events, such as the disrupted mid-2026 plot to place incendiary devices on cargo aircraft.[1][3]

The European Union is now drafting joint defense initiatives to counter the campaign, including a proposed anti-drone shield and enhanced intelligence-sharing protocols. The immediate challenge for the 32 NATO member states is defining the threshold at which a proxy sabotage campaign crosses from a law enforcement issue into an armed attack requiring a collective military response.[1][2]