Russia's Sabotage in Europe

The story so far

As of September 20, 2026

Europe is treating a wave of fires, arson attempts and now a foiled airport drone plot as a single campaign, and Germany has just said out loud who it believes is running it. Berlin has formally blamed Russia for a failed explosives drone attack inside the secure area of Leipzig/Halle Airport, a cargo hub used for shipments to Ukraine. Investigators cited the drone’s configuration, components, explosives and trigger as matching past Russian operations, and two suspects have been identified, one a Belarusian with a Russian passport and another holding Latvian and Russian passports. EU and NATO leaders called this a new escalation on EU soil, and EU foreign ministers met in Ireland to line up a response that could include tighter sanctions, visa limits and action against Russia’s oil shipping workarounds. The US secretary of state has since warned that Russia is intensifying sabotage and disruption against European allies, and that such incidents risk spreading the war through accident or miscalculation.

What ties the scattered incidents together is a shift in targets. Through August and into September, the focus moved to Europe’s defense supply chain and logistics, with suspicious fires at arms facilities in Bulgaria, Italy and Estonia, a thwarted arson plot at a Slovak drone maker, and incendiary devices thrown near a defense firm in Munich, where two Bulgarian nationals were arrested. Inside Germany, several improvised explosive devices were found at the Preilack substation that feeds power from the Jänschwalde coal plant; at least one detonated and caused a brief interruption before power was restored. In Baltic airspace, an Italian fighter on a NATO mission shot down a drone over Lithuania after it entered from Belarus and was believed to carry explosives. The pattern points to pressure on the transport nodes, factories and infrastructure that move equipment to Ukraine rather than on symbolic civilian targets.

The stakes have risen from covert disruption to open coercion. After Germany’s attribution and the closure of a Russian consulate in Bonn and the Russian House in Berlin, Moscow said it would shut Goethe-Institut branches in Moscow, St. Petersburg and Yekaterinburg. Vladimir Putin has publicly threatened possible strikes on British and German military facilities. European intelligence chiefs now warn that Moscow could try within months to test alliance resolve with a limited incursion, a staged incident or a surge in drone activity aimed at confusing the response to the treaty promise that an attack on one is an attack on all. Berlin is pushing for a coordinated EU package that could add up to 1,600 more people and entities tied to Russia’s war effort to travel bans and asset freezes.

Not every blaze or grid failure is proven sabotage, and German police are also hunting a domestic extremist suspect in other substation cases, but the density, timing and target set explain why governments now read these events together. Poland has treated the June shooting of Russian dissident artist Robert Kuzovkov near his home as part of the same foreign-directed threat environment, and Finland has just run Europe’s largest civil defense drill since World War II to practice for cyber cuts to power and water alongside missile alerts. The story has become a contest over whether Russia can make support for Ukraine feel risky on European soil, and whether European states can harden weak points in logistics and infrastructure fast enough to keep that support flowing while avoiding the kind of incident that could force an alliance decision.