An investigation involving 17 European public-service news organisations has documented hundreds of suspected hybrid attacks across Europe in just over six months, revealing the scale of a security challenge that increasingly extends beyond conventional espionage and cyberwarfare.

The investigation, coordinated by the European Broadcasting Union, examined incidents reported between 1st April and 15th October 2026, including sabotage attempts, arson, airspace violations, suspicious drone activity and the exploitation of migration routes along the European Union’s eastern borders.

Published on 23rd October, the resulting interactive map provides a geographical picture of incidents publicly linked to Russia by intelligence agencies, law-enforcement authorities, government officials or reporting. The degree of attribution varies considerably, however, and many incidents remain under investigation.

The findings point to a fundamental problem for European security: hostile activities can be conducted across national boundaries without necessarily triggering the legal, military or political mechanisms designed to respond to conventional aggression.

Sabotage Without Conventional Warfare

Among the cases examined is an incident in Munich in September, when two Bulgarian nationals allegedly threw incendiary devices from a moving vehicle onto a construction site near several defence companies.

Police arrested the suspects after a witness reported the incident. Bavarian Interior Minister Joachim Herrmann and regional criminal investigators subsequently indicated that political motives were being considered. Investigators reportedly suspected possible involvement by Russia’s military intelligence service, the GRU, although the allegations have not been established in court.

The case illustrates growing concern about so-called disposable agents: individuals recruited to undertake relatively limited operations without formal intelligence training or a longstanding relationship with an intelligence service.

Such arrangements can complicate investigations. Even where perpetrators are identified, establishing a legally demonstrable connection between their actions and a foreign intelligence organisation may prove considerably more difficult.

Germany’s Federal Criminal Police Office has registered a mid-three-digit number of suspected sabotage and reconnaissance cases since the beginning of 2026, according to information provided to investigators involved in the European mapping project.

Only a small proportion have been publicly attributed to Russia. Four German incidents were included in the map, demonstrating the distinction between a broad national caseload and cases meeting the investigation’s publication criteria.

Europe’s Eastern Borders Under Pressure

The geographical distribution reveals substantial activity along NATO’s eastern flank, particularly around the Baltic states, Belarus and the Black Sea.

Incidents include repeated airspace violations, suspected reconnaissance operations and attempts to facilitate unauthorised border crossings. Lithuanian authorities have accused Belarus of deliberately exploiting migration as an instrument of political pressure.

Commercial shipping has also become increasingly exposed. Drone attacks involving vessels near Romania and Bulgaria have raised concerns about the extension of the war’s consequences into maritime areas adjoining EU and NATO territory.

These developments reinforce earlier warnings about Russia’s expanding sabotage campaign, particularly the difficulty of distinguishing isolated security incidents from coordinated operations intended to test national responses.

Teija Tiilikainen, director of the European Centre of Excellence for Countering Hybrid Threats, identified Russia’s invasion of Ukraine as an important factor behind the increasing pressure. According to her assessment, Moscow’s objectives include weakening Western unity and undermining continued support for Ukraine.

The Legal and Institutional Challenge

The central difficulty is not simply the absence of criminal legislation. Arson, espionage, sabotage and unlawful interference with critical infrastructure are already punishable under national laws.

Rather, the challenge involves establishing foreign direction, coordinating investigations across jurisdictions and identifying when a series of apparently separate offences constitutes a wider hostile campaign.

Germany’s domestic intelligence chief, Sinan Selen, has described the environment as a grey area between war and peace. German foreign intelligence chief Martin Jäger has similarly identified Russia as the country’s most dangerous adversary.

European governments are beginning to address these difficulties collectively. At their 15th–16th October summit, EU leaders condemned intensifying hybrid attacks and called for stronger resilience, greater use of existing countermeasures and accelerated work on drone security.

On 8th October, the Council also extended sanctions targeting Russian destabilisation activities until October 2027. The restrictions cover 80 individuals and 20 entities.

Meanwhile, a European Commission research initiative, published on 23rd October, proposes combining anticipation, active defence and retaliatory measures into a more coherent deterrence strategy.

From Individual Incidents to Collective Security

The investigation’s significance extends beyond the number of incidents recorded. By bringing together information previously dispersed among national authorities and separate investigations, it makes possible a wider assessment of the methods, geographical concentration and recurring characteristics of suspected hostile operations.

Nevertheless, the map does not establish Russian responsibility for every incident it records, nor does it constitute a complete European database. Russia has repeatedly denied conducting the hybrid attacks attributed to it.

For European governments, the unresolved question is how to move from recognising a pattern of hostile activity to demonstrating responsibility and responding effectively.

As EU foreign policy chief Kaja Kallas has warned, the consequences already extend beyond infrastructure disruption to risks affecting civilian lives.

The emerging security challenge therefore concerns not only the detection of individual perpetrators, but also Europe’s ability to connect incidents across borders, establish responsibility and prevent successive operations from becoming an accepted feature of the continent’s security environment.

Intelligence services from five European countries warn that Russia is expanding assassination and sabotage operations against defence manufacturers supplying Ukraine. The threats coincide with an alleged plot against Poland’s prime minister and defence minister, raising concerns about Moscow’s efforts to undermine European military assistance through intimidation and political destabilisation.

European intelligence agencies have warned that Russia is intensifying efforts to assassinate executives of defence companies supplying Ukraine, extending its campaign of sabotage and intimidation into the European military-industrial sector.

According to intelligence assessments obtained from five European security services, Moscow has ordered an expansion of covert operations targeting senior figures at major arms manufacturers and smaller companies producing drones and military components. Germany’s domestic intelligence agency, the BfV, has reportedly advised executives to strengthen personal security, while some manufacturers have already increased protection for senior personnel.

The warnings emerged alongside reports of an alleged assassination plot against Polish Prime Minister Donald Tusk and Defence Minister Władysław Kosiniak-Kamysz. Polish authorities convened an emergency security meeting and subsequently detained a suspect. No connection between the Polish case and Russian intelligence has been established.

Europe becomes Moscow’s principal target

The apparent expansion of Russian covert operations reflects a shift in Moscow’s calculations concerning Western military assistance.

President Vladimir Putin had reason to anticipate that Donald Trump’s return to the White House would weaken American support for Kyiv. Trump repeatedly questioned US military expenditure on Ukraine and advocated a negotiated settlement with Russia. A substantial reduction in American weapons deliveries could have increased pressure on Ukraine to accept Moscow’s territorial demands.

Instead, European governments assumed greater responsibility for sustaining Ukrainian defence capabilities, including financing weapons purchases and expanding domestic production.

The European Union’s €90 billion support programme for 2026–2027 allocates €60 billion to defence procurement and industrial capacity. The EU has also established mechanisms allowing Ukraine to participate in European joint procurement programmes.

Disrupting European manufacturers therefore offers Moscow a means of restricting Ukraine’s military capabilities without directly confronting NATO.

Assassination threats can interfere with procurement even when attacks are never carried out. Large manufacturers can afford extensive security arrangements, but smaller companies producing electronics, drone components and specialised equipment often lack comparable resources.

Intimidation could delay contracts, discourage investment and persuade individual suppliers to withdraw from Ukrainian defence programmes.

Sabotage as an instrument of political pressure

Russia’s alleged interest in targeting defence executives is not unprecedented. In 2024, American intelligence reportedly uncovered a Russian plot to assassinate Armin Papperger, chief executive of Rheinmetall, one of Germany’s principal suppliers of ammunition and military equipment to Ukraine.

As EU Today previously reported, Moscow has also publicly identified European factories involved in Ukrainian drone production, increasing concerns that civilian industrial facilities could become targets of Russian operations.

European authorities have investigated suspected Russian involvement in arson, infrastructure attacks and clandestine networks. An earlier cross-border investigation into alleged assassination and sabotage preparations demonstrated how intermediaries could be recruited to conduct operations while obscuring their sponsors.

Such activity also carries political consequences. Attacks against infrastructure and industrial facilities can reinforce public fears about confrontation with Russia, particularly during elections when parties advocating accommodation with Moscow seek to exploit security concerns.

Poland has already experienced mounting Russian hybrid pressure, including threats to critical infrastructure and information operations intended to aggravate domestic political divisions.

Putin’s strategy against European rearmament

Ukraine’s continuing strikes against Russian refineries and military-industrial facilities have added economic and operational pressures to Moscow’s prolonged war effort. Russia retains substantial military production capacity, but the costs of sustaining the conflict remain considerable.

Interfering with European weapons manufacturing could serve two objectives: restricting Ukraine’s access to equipment and obstructing Europe’s longer-term rearmament.

The Kremlin does not necessarily need European governments to abandon Ukraine formally. Production delays, disrupted contracts and reluctant suppliers could reduce the practical effect of military assistance even while political commitments remain unchanged.

European governments have acknowledged the industrial challenge. In its June conclusions on European defence, the European Council called for accelerated manufacturing capacity, stronger supply chains and closer cooperation with Ukraine’s defence industry.

Russia’s apparent strategy seeks to exploit the dependence of these programmes on private companies and skilled civilian personnel.

The warnings from European intelligence agencies suggest that protecting defence executives, engineers and contractors is becoming part of the continent’s wider security responsibilities.

For Moscow, intimidation offers the possibility of weakening Ukrainian military resistance without an open confrontation with NATO. For European governments, preventing covert operations from disrupting weapons production is increasingly inseparable from their commitment to sustain Ukraine’s defence.