The Higher Regional Court in Düsseldorf has ordered two 19-year-old Germans held pending extradition to Bulgaria, which accuses them of setting fire to Starlink antennas at a satellite ground station near Sofia, the court and Düsseldorf prosecutors said on 29 October. The men, from Duisburg and Moers, were arrested on 23 October, German prosecutors told Reuters.

As Russia presses its war on Ukraine, Starlink keeps Ukraine’s drone units and front-line troops connected, and its ground sites in Europe have become targets. Within a month, fires and attempted fires hit Starlink sites in Poland, Bulgaria, and Lithuania, and Warsaw and Vilnius have linked them to Russia. The Bulgarian case now has its first arrests, and Sofia says the same pair struck another EU country, which would make it more than a one-off.

Sofia says the pair struck another EU country on 18 October

Bulgarian Interior Minister Ivan Demerdzhiev said he expected both suspects to be handed over to Bulgaria, and that the same two carried out a similar attack in another EU member state on 18 October, the state news agency BTA reported on 28 October. He did not name the country outright, but went on to cite Lithuania’s prime minister on an attempted arson there.

Overnight on 18 October, intruders tried to set fire to a Lithuanian company that stores Starlink equipment used by Ukraine, but tipped-off guards foiled the attempt. Lithuania’s prime minister called it part of Russia’s hybrid war.

Bulgarian Prime Minister Rumen Radev said the suspects had been detained in Germany several days earlier, and that disclosing their names sooner would have let them flee. The opposition wants to know whether a foreign security service warned Bulgaria at least a week before the attack, and how two 19-year-olds could enter the country and leave unnoticed. Parliament has failed three times to gather a quorum for a sitting to hear Radev and the security chiefs.

The suspects refuse a quick handover

The two did not agree to a simplified extradition, and the court will rule later on whether handing them over is admissible, according to the court’s statement carried by the dts news agency. Any extradition is to be approved only on the condition that, after a final sentence, they are offered a transfer back to Germany to serve it. Their lawyers plan to contest the Bulgarian warrant, dpa reported.

Bulgarian prosecutors say the pair crossed from Serbia as tourists on 9 October, set fire to eight antennas at the Plana teleport south of Sofia, and drove back to Serbia the same night. They were charged in absentia, a Sofia court confirmed European arrest warrants for them, and they face three to 12 years in prison if convicted.

Sofia City prosecutors announced the arrests on 27 October and said German authorities are gathering evidence for the case under a European investigation order. The pre-trial investigation continues, they said.

Romanian intelligence services say a Russian-directed network was responsible for a fire near an arms manufacturing facility in Brașov. Investigations involving Germany and Poland have exposed what authorities describe as a wider operation targeting military and industrial defence infrastructure across Europe.

Romania has accused Russia of coordinating a cross-border sabotage network responsible for an industrial fire near an arms manufacturing facility, prompting a diplomatic confrontation with Moscow and investigations involving several European countries.

Romanian intelligence and prosecutors announced on 26th October that they had identified three foreign nationals allegedly involved in the operation, which caused a fire on an industrial site in Brașov on 14th September.

The suspects, two Belarusian nationals and one Ukrainian, are alleged to have participated in a network directed by individuals operating from Russia.

Two suspects have been detained in Germany, while a third has been located in Poland.

Romania is seeking their extradition as investigators examine possible connections to other attempted attacks against military and industrial installations.

Russia has rejected the allegations.

The case has drawn attention to the security of European defence production facilities at a time when NATO governments are seeking to increase military manufacturing capacity and sustain assistance to Ukraine.

Fire near a Romanian arms manufacturer

The investigation concerns an industrial complex in Brașov, a city with an established defence manufacturing sector.

The fire occurred on 14th September at premises situated close to CARFIL SA, a subsidiary of Romania’s state-owned defence company ROMARM.

According to the Romanian Intelligence Service, the incident was caused by individuals belonging to a sabotage network coordinated from the Russian Federation.

The fire damaged premises occupied by several commercial businesses.

Although the industrial site is associated with the CARFIL complex, authorities have not established publicly that the arms manufacturing facility itself sustained damage.

That geographical distinction is important when assessing the consequences of the operation.

CARFIL manufactures military equipment and ammunition and has pursued partnerships involving drones, explosives and other defence technologies.

Its proximity to the incident has heightened concerns about the security of industrial facilities supporting Romania’s armed forces.

Suspects identified in three countries

Romania’s Directorate for Investigating Organised Crime and Terrorism, known as DIICOT, says the evidence connects three individuals to the incident.

According to Romanian national news agency AGERPRES, the Bucharest Court of Appeal issued European arrest warrants following the investigation.

Two suspects were detained in Germany while allegedly preparing similar operations.

The third was located in Poland, where authorities received a further European arrest warrant issued on 26 October.

Romanian prosecutors are pursuing extradition procedures.

The nationalities of the suspects do not establish responsibility on the part of Belarus or Ukraine. Romanian authorities attribute the alleged coordination to individuals based in Russia.

The investigation also indicates that the Brașov incident may not have been an isolated operation.

Romanian intelligence claims the network’s potential targets included government-owned and private arms manufacturers, military-related facilities and other strategic industrial sites in several European countries.

Those claims remain subject to ongoing criminal investigation.

Bucharest summons Russian ambassador

The Romanian government escalated the matter diplomatically on 27th October.

Foreign Minister Dan Neculăescu summoned Russia’s ambassador, Vladimir Lipaev, to deliver a formal protest concerning the alleged operation.

According to the Romanian Foreign Ministry’s account reported by AGERPRES, Bucharest stated that evidence gathered during the investigation demonstrated Russian responsibility.

The ministry described the operation as part of a broader pattern of hostile activity affecting European states.

President Nicușor Dan also condemned the alleged sabotage, linking it to attempts to undermine European security and solidarity.

Moscow rejected the accusations.

The Russian Embassy maintained that the allegations were unfounded and disputed Romania’s account of the evidence presented during the diplomatic meeting.

The conflicting positions mean the attribution remains contested, notwithstanding the conclusions announced by Romania’s intelligence authorities.

A recruitment model designed for deniability

The Romanian Intelligence Service has provided details about how it believes the wider network recruits and directs participants.

According to its statement, recruitment can begin through social media with offers of payment for apparently minor activities, such as photographing or observing particular locations.

Subsequent assignments may become more serious, involving property destruction, arson or other acts of violence.

Individuals may be targeted because of financial difficulties or other personal vulnerabilities.

The service also identified methods allegedly used to conceal movements, payments and communications.

These include encrypted messaging applications, telephone numbers registered outside the country of operation and accommodation or transport arrangements booked under other identities.

Such methods can complicate investigations because the individuals physically carrying out an operation may have limited knowledge of the organisers.

Romanian authorities emphasised that individual indicators should be assessed in context and do not themselves prove involvement in sabotage.

Defence factories become a security concern

The case has implications beyond Romania.

European governments are investing in ammunition production, air defence systems and military technologies, partly in response to the continuing war in Ukraine.

The resulting expansion of manufacturing capacity creates additional infrastructure requiring protection.

Industrial sites may be vulnerable not only to direct attacks but also to disruption affecting nearby businesses, transport networks, power supplies and specialist contractors.

The Brașov investigation illustrates how an incident outside a defence factory’s perimeter can nevertheless raise questions about the security of the wider industrial complex.

It also demonstrates the importance of cooperation between European intelligence services and criminal investigators.

The detention of suspects in Germany and the identification of another in Poland show that investigations into alleged sabotage may cross several jurisdictions.

The wider European response

Romania’s allegations come amid growing concern over hostile activities involving cyberattacks, disinformation, surveillance and physical sabotage.

Attributing such incidents to a foreign government requires intelligence assessments, criminal evidence and international cooperation.

The public allegations against Russia do not replace the judicial process concerning the three suspects.

However, the investigation has already prompted a diplomatic response and additional scrutiny of industrial security.

For European governments seeking to expand their defence industries, the immediate challenge is protecting production facilities and associated infrastructure without allowing relatively small-scale disruptive operations to undermine wider manufacturing programmes.

The outcome of Romania’s criminal proceedings will be important in establishing the responsibility of those accused and clarifying how the alleged network operated across national borders.

Main Image: By MAPN – http://www.mapn.ro/fotodb/20051020_expomil?page=1, CC BY-SA 3.0, https://commons.wikimedia.org/w/index.php?curid=14997305

The attack is "part of a larger campaign of sabotage operations attributed to the Russian Federation in Europe," according to the Romanian Intelligence Service.

Journalists from 17 European public service broadcasters, coordinated by the European Broadcasting Union’s (EBU) Eurovision News Spotlight network, published an interactive map on 23 October 2026. It documents hybrid incidents linked to Russia across 17 European countries between 1 April and 15 October. Journalists compiled a database of hundreds of reported incidents, categorizing each by type and the source and strength of its alleged links to Russia, then verifying them through open-source research.

The map comes as officials warn the campaign is growing. On 28 September, EU foreign policy chief Kaja Kallas said in Brussels that Russia was planning more acts of sabotage to divide societies and intimidate them into abandoning their support for Ukraine. The points on the map represent an incomplete list of publicly known cases attributed to Russia or suspected of being linked to it, the report states.

The map covers airspace violations, sabotage attempts, “disposable” agents with no formal intelligence training, migration used as a weapon, and Russian military activity near or across European borders. It excludes cyberattacks, influence operations, and espionage by trained intelligence officers.

The EBU calls the result a very conservative estimate, not an official tally. Russia has consistently denied responsibility for the incidents. Many single points represent several incidents of the same type in one area or in quick succession. In Moldova, for example, Defense Minister Anatolie Nosatîi said on 30 September that the government had recorded 84 drone incursions.

Four German incidents are on the map, out of many more

The map shows four incidents in Germany, according to BR.

• On 2 August, German authorities arrested a 33-year-old Ukrainian man in Thuringia on suspicion of photographing a Bavarian weapons manufacturer for a foreign intelligence service as part of an alleged sabotage plot.
• On 4 August, a drone carrying explosives and a detonator struck the wing of a Ukrainian An-124 cargo plane at Leipzig/Halle Airport but failed to explode.
• On 3 September, attackers threw firebombs from a car onto a construction site next to defense firms in Munich, and German security authorities suspect Russian intelligence.
• On 14 September, investigators learned of a crashed drone found near the Bundeswehr’s Wunstorf air base.

Internal papers from the new Joint Hybrid Defense Center, seen by Correctiv, record 163 suspected sabotage cases in 2026 up to 19 August. The targets included rail lines, military facilities, substations, and radio masts. The same papers record 1,034 drone overflights of critical infrastructure, military sites, and defense companies, and 25 espionage investigations. The papers cover possible attacks by Russia, China, and Iran, and media did not report a breakdown of the sabotage cases by country.

European leaders sound the alarm over Russian hybrid attacks

On 15 April, Swedish civil defense minister Carl-Oskar Bohlin said pro-Russian groups had moved from denial-of-service attacks to attempts at destructive cyberattacks, including one on a Swedish power plant in 2025. On 1 September, German Foreign Minister Johann Wadephul named Russia as the perpetrator of the Leipzig attack and accused Moscow of “blatant hostility” toward Germany.

On 18 September, French President Emmanuel Macron said Russia’s hybrid attacks would not go unanswered and ordered a plan to protect France’s critical infrastructure. On 1 October, German Chancellor Friedrich Merz said Germany was preparing for new hybrid attacks, “including serious ones.” NATO Secretary General Mark Rutte on 14 October called the attacks a sign of Russian weakness at a press conference in Tallinn and said NATO would react where needed without being “rattled.”

An investigation involving 17 European public-service news organisations has documented hundreds of suspected hybrid attacks across Europe in just over six months, revealing the scale of a security challenge that increasingly extends beyond conventional espionage and cyberwarfare.

The investigation, coordinated by the European Broadcasting Union, examined incidents reported between 1st April and 15th October 2026, including sabotage attempts, arson, airspace violations, suspicious drone activity and the exploitation of migration routes along the European Union’s eastern borders.

Published on 23rd October, the resulting interactive map provides a geographical picture of incidents publicly linked to Russia by intelligence agencies, law-enforcement authorities, government officials or reporting. The degree of attribution varies considerably, however, and many incidents remain under investigation.

The findings point to a fundamental problem for European security: hostile activities can be conducted across national boundaries without necessarily triggering the legal, military or political mechanisms designed to respond to conventional aggression.

Sabotage Without Conventional Warfare

Among the cases examined is an incident in Munich in September, when two Bulgarian nationals allegedly threw incendiary devices from a moving vehicle onto a construction site near several defence companies.

Police arrested the suspects after a witness reported the incident. Bavarian Interior Minister Joachim Herrmann and regional criminal investigators subsequently indicated that political motives were being considered. Investigators reportedly suspected possible involvement by Russia’s military intelligence service, the GRU, although the allegations have not been established in court.

The case illustrates growing concern about so-called disposable agents: individuals recruited to undertake relatively limited operations without formal intelligence training or a longstanding relationship with an intelligence service.

Such arrangements can complicate investigations. Even where perpetrators are identified, establishing a legally demonstrable connection between their actions and a foreign intelligence organisation may prove considerably more difficult.

Germany’s Federal Criminal Police Office has registered a mid-three-digit number of suspected sabotage and reconnaissance cases since the beginning of 2026, according to information provided to investigators involved in the European mapping project.

Only a small proportion have been publicly attributed to Russia. Four German incidents were included in the map, demonstrating the distinction between a broad national caseload and cases meeting the investigation’s publication criteria.

Europe’s Eastern Borders Under Pressure

The geographical distribution reveals substantial activity along NATO’s eastern flank, particularly around the Baltic states, Belarus and the Black Sea.

Incidents include repeated airspace violations, suspected reconnaissance operations and attempts to facilitate unauthorised border crossings. Lithuanian authorities have accused Belarus of deliberately exploiting migration as an instrument of political pressure.

Commercial shipping has also become increasingly exposed. Drone attacks involving vessels near Romania and Bulgaria have raised concerns about the extension of the war’s consequences into maritime areas adjoining EU and NATO territory.

These developments reinforce earlier warnings about Russia’s expanding sabotage campaign, particularly the difficulty of distinguishing isolated security incidents from coordinated operations intended to test national responses.

Teija Tiilikainen, director of the European Centre of Excellence for Countering Hybrid Threats, identified Russia’s invasion of Ukraine as an important factor behind the increasing pressure. According to her assessment, Moscow’s objectives include weakening Western unity and undermining continued support for Ukraine.

The Legal and Institutional Challenge

The central difficulty is not simply the absence of criminal legislation. Arson, espionage, sabotage and unlawful interference with critical infrastructure are already punishable under national laws.

Rather, the challenge involves establishing foreign direction, coordinating investigations across jurisdictions and identifying when a series of apparently separate offences constitutes a wider hostile campaign.

Germany’s domestic intelligence chief, Sinan Selen, has described the environment as a grey area between war and peace. German foreign intelligence chief Martin Jäger has similarly identified Russia as the country’s most dangerous adversary.

European governments are beginning to address these difficulties collectively. At their 15th–16th October summit, EU leaders condemned intensifying hybrid attacks and called for stronger resilience, greater use of existing countermeasures and accelerated work on drone security.

On 8th October, the Council also extended sanctions targeting Russian destabilisation activities until October 2027. The restrictions cover 80 individuals and 20 entities.

Meanwhile, a European Commission research initiative, published on 23rd October, proposes combining anticipation, active defence and retaliatory measures into a more coherent deterrence strategy.

From Individual Incidents to Collective Security

The investigation’s significance extends beyond the number of incidents recorded. By bringing together information previously dispersed among national authorities and separate investigations, it makes possible a wider assessment of the methods, geographical concentration and recurring characteristics of suspected hostile operations.

Nevertheless, the map does not establish Russian responsibility for every incident it records, nor does it constitute a complete European database. Russia has repeatedly denied conducting the hybrid attacks attributed to it.

For European governments, the unresolved question is how to move from recognising a pattern of hostile activity to demonstrating responsibility and responding effectively.

As EU foreign policy chief Kaja Kallas has warned, the consequences already extend beyond infrastructure disruption to risks affecting civilian lives.

The emerging security challenge therefore concerns not only the detection of individual perpetrators, but also Europe’s ability to connect incidents across borders, establish responsibility and prevent successive operations from becoming an accepted feature of the continent’s security environment.

The suspect allegedly collected relevant information in connection with Russia's war against Ukraine, including on the production of armored vehicles, ammunition, and explosives, as well as on military personnel and facilities on NATO's eastern flank.

"We are disabling the enemy's channels, disrupting command and control, and helping UAVs reach their targets," Atesh said.

Reviewing internal documents from Germany's armed forces, German media reports that this is the military's second-highest threat classification.

A former Ukrainian special forces officer has gone on trial in Hamburg over the 2022 Nord Stream explosions, with his lawyers arguing that Russian energy infrastructure used to finance aggression cannot automatically enjoy protection as a civilian installation.

The first criminal trial arising from the destruction of the Nord Stream gas pipelines has opened in Hamburg, confronting German judges with allegations against a former Ukrainian military officer and a dispute over whether Russian energy infrastructure constituted a legitimate wartime target.

Serhii Kuznietsov, 50, is accused of organising an operation that destroyed three of the four Nord Stream pipeline strands in the Baltic Sea in September 2022. German prosecutors have charged him with offences involving explosives, damage to infrastructure and participation in a war crime.

At the opening hearing on 14 October, Kuznietsov’s lawyers sought to have the proceedings dismissed, challenging both the evidence against their client and the prosecution’s classification of the pipelines as protected civilian infrastructure.

According to the account of the opening proceedings, the defence argued that the installations served Russia’s strategic interests and had been used to exert economic and political pressure on European countries.

Kuznietsov denies involvement in the explosions. His lawyers maintain that the prosecution has not established that he participated in, let alone directed, the operation.

German prosecutors allege Ukrainian involvement

The explosions occurred on 26 September 2022, approximately seven months after Russia launched its full-scale invasion of Ukraine.

Underwater detonations near the Danish island of Bornholm ruptured sections of Nord Stream 1 and Nord Stream 2, releasing large quantities of natural gas into the Baltic Sea.

German investigators allege that a group of Ukrainians used a rented sailing yacht, the Andromeda, to transport divers, explosives and equipment to the pipelines.

According to the prosecution, the operation involved military-grade explosive devices and was organised with the knowledge or direction of Ukrainian state authorities.

These allegations remain to be tested in court. Ukrainian officials have denied state involvement, and no German judicial finding has established responsibility on the part of Kyiv’s political or military leadership.

The defendant was arrested in Italy in August 2025 and subsequently extradited to Germany following lengthy legal proceedings.

As EU Today reported following the Italian Supreme Court’s ruling, Kuznietsov’s defence had challenged the legality of his transfer and questioned the evidence underpinning the German investigation.

His appearance in Hamburg now moves the case from extradition disputes to direct examination of the prosecution’s allegations.

Can a gas pipeline be a military target?

The central legal controversy concerns whether the Nord Stream infrastructure was entitled to protection as a civilian installation during an international armed conflict.

Under international humanitarian law, civilian objects are generally protected against attack unless their nature, location, purpose or use makes an effective contribution to military action and their destruction offers a definite military advantage.

Kuznietsov’s defence argues that Nord Stream had served Russian strategic interests by generating energy revenue and providing Moscow with leverage over European governments.

Defence lawyer Nicola Canestrini has described the pipelines as an instrument of Russian economic coercion rather than infrastructure serving an exclusively civilian purpose.

German prosecutors reject the proposition that those circumstances automatically justified their destruction. They maintain that the operation involved attacks against civilian infrastructure and therefore constituted a war crime.

The legal assessment is more complicated than determining who owned the pipelines.

Financial benefits to a belligerent state do not necessarily make every commercial installation a military objective. Equally, civilian ownership or use does not automatically exclude infrastructure from becoming a military target if the conditions established under the laws of armed conflict are satisfied.

The operational circumstances in September 2022 could become important. Nord Stream 1 had already ceased delivering gas, while Nord Stream 2 had never received German certification to begin commercial operations.

The court will therefore have to consider both the pipelines’ strategic significance and their actual contribution to Russia’s military operations at the time of the explosions.

Defence raises questions about state secrecy

Kuznietsov’s lawyers have also argued that his military status restricts his ability to discuss information that could be covered by Ukrainian state secrecy obligations.

According to the opening-day court reporting, the defence contends that these restrictions undermine his ability to challenge the prosecution’s case.

The proceedings also raise questions concerning the legality of his extradition from Italy and the precise offences for which his transfer was authorised.

These are separate from the underlying question of responsibility for the explosions. A procedural objection could affect the conduct of the trial without resolving the factual allegations.

Berlin faces an uncomfortable political dispute

The case has implications for relations between Germany and Ukraine, although criminal responsibility must be determined independently of diplomatic considerations.

Germany remains a major supplier of military and financial assistance to Kyiv. At the same time, German prosecutors are pursuing allegations that Ukrainian personnel damaged infrastructure in which German companies had invested heavily.

The pipelines themselves remain politically contentious. As EU Today previously examined, the owner of Nord Stream 2 has separately challenged the EU’s plans to eliminate Russian gas imports, demonstrating that the commercial and legal consequences of Europe’s former energy relationship with Moscow remain unresolved.

The Hamburg trial will not determine the legality of Russia’s invasion, nor will it establish Ukrainian government responsibility merely because a former officer stands accused.

It will examine the evidence against Kuznietsov and the circumstances in which the destruction of infrastructure connected to an aggressor state can constitute a criminal offence.

Further hearings are scheduled, with the evidentiary proceedings expected to begin on 27 October. The outcome will depend on whether prosecutors can establish the defendant’s alleged role and overcome the legal challenges raised by his defence.

Intelligence services from five European countries warn that Russia is expanding assassination and sabotage operations against defence manufacturers supplying Ukraine. The threats coincide with an alleged plot against Poland’s prime minister and defence minister, raising concerns about Moscow’s efforts to undermine European military assistance through intimidation and political destabilisation.

European intelligence agencies have warned that Russia is intensifying efforts to assassinate executives of defence companies supplying Ukraine, extending its campaign of sabotage and intimidation into the European military-industrial sector.

According to intelligence assessments obtained from five European security services, Moscow has ordered an expansion of covert operations targeting senior figures at major arms manufacturers and smaller companies producing drones and military components. Germany’s domestic intelligence agency, the BfV, has reportedly advised executives to strengthen personal security, while some manufacturers have already increased protection for senior personnel.

The warnings emerged alongside reports of an alleged assassination plot against Polish Prime Minister Donald Tusk and Defence Minister Władysław Kosiniak-Kamysz. Polish authorities convened an emergency security meeting and subsequently detained a suspect. No connection between the Polish case and Russian intelligence has been established.

Europe becomes Moscow’s principal target

The apparent expansion of Russian covert operations reflects a shift in Moscow’s calculations concerning Western military assistance.

President Vladimir Putin had reason to anticipate that Donald Trump’s return to the White House would weaken American support for Kyiv. Trump repeatedly questioned US military expenditure on Ukraine and advocated a negotiated settlement with Russia. A substantial reduction in American weapons deliveries could have increased pressure on Ukraine to accept Moscow’s territorial demands.

Instead, European governments assumed greater responsibility for sustaining Ukrainian defence capabilities, including financing weapons purchases and expanding domestic production.

The European Union’s €90 billion support programme for 2026–2027 allocates €60 billion to defence procurement and industrial capacity. The EU has also established mechanisms allowing Ukraine to participate in European joint procurement programmes.

Disrupting European manufacturers therefore offers Moscow a means of restricting Ukraine’s military capabilities without directly confronting NATO.

Assassination threats can interfere with procurement even when attacks are never carried out. Large manufacturers can afford extensive security arrangements, but smaller companies producing electronics, drone components and specialised equipment often lack comparable resources.

Intimidation could delay contracts, discourage investment and persuade individual suppliers to withdraw from Ukrainian defence programmes.

Sabotage as an instrument of political pressure

Russia’s alleged interest in targeting defence executives is not unprecedented. In 2024, American intelligence reportedly uncovered a Russian plot to assassinate Armin Papperger, chief executive of Rheinmetall, one of Germany’s principal suppliers of ammunition and military equipment to Ukraine.

As EU Today previously reported, Moscow has also publicly identified European factories involved in Ukrainian drone production, increasing concerns that civilian industrial facilities could become targets of Russian operations.

European authorities have investigated suspected Russian involvement in arson, infrastructure attacks and clandestine networks. An earlier cross-border investigation into alleged assassination and sabotage preparations demonstrated how intermediaries could be recruited to conduct operations while obscuring their sponsors.

Such activity also carries political consequences. Attacks against infrastructure and industrial facilities can reinforce public fears about confrontation with Russia, particularly during elections when parties advocating accommodation with Moscow seek to exploit security concerns.

Poland has already experienced mounting Russian hybrid pressure, including threats to critical infrastructure and information operations intended to aggravate domestic political divisions.

Putin’s strategy against European rearmament

Ukraine’s continuing strikes against Russian refineries and military-industrial facilities have added economic and operational pressures to Moscow’s prolonged war effort. Russia retains substantial military production capacity, but the costs of sustaining the conflict remain considerable.

Interfering with European weapons manufacturing could serve two objectives: restricting Ukraine’s access to equipment and obstructing Europe’s longer-term rearmament.

The Kremlin does not necessarily need European governments to abandon Ukraine formally. Production delays, disrupted contracts and reluctant suppliers could reduce the practical effect of military assistance even while political commitments remain unchanged.

European governments have acknowledged the industrial challenge. In its June conclusions on European defence, the European Council called for accelerated manufacturing capacity, stronger supply chains and closer cooperation with Ukraine’s defence industry.

Russia’s apparent strategy seeks to exploit the dependence of these programmes on private companies and skilled civilian personnel.

The warnings from European intelligence agencies suggest that protecting defence executives, engineers and contractors is becoming part of the continent’s wider security responsibilities.

For Moscow, intimidation offers the possibility of weakening Ukrainian military resistance without an open confrontation with NATO. For European governments, preventing covert operations from disrupting weapons production is increasingly inseparable from their commitment to sustain Ukraine’s defence.