Europe targeted by spiralling campaign of sabotage and Russia is the chief suspect

BySarah Rainsford Southern and Eastern Europe correspondent.

Key points

• 13 August Italy: A fire at KNDS Ammo Italy outside Rome triggers a sizeable explosion.
• It tracks sabotage cases, points to a previous surge in 2024 when Ukraine's allies began allowing it to employ Western-supplied weapons deeper inside Russia.
• When Russia was accused of sending packages containing liquid explosive to the UK and Poland, 2024 was the year of the parcel bomb plot.
• 15 August Estonia: The Milrem Robotics factory in Tallinn.
• Estonian Prime Minister Kristen Michal notes the possibility of Russian sabotage is being "taking seriously" by investigators.

As summer temperatures in Europe smashed records this summer and plenty of politicians shifted to holiday mode, Russia remained focused on its war.

Not only did its military attacks throughout Ukraine intensify last month, becoming ever more deadly for civilians, Russia additionally appears to have escalated its sabotage campaign throughout Europe. This time, military and defence sector sites were the prime target.

In practice, a full month after drones packed with explosives were discovered at Leipzig's airport, employed by Ukraine to transport military goods, Germany's interior minister has declared that "Russia is responsible".

As always, and his authorities call the accusation "absurd", russia's President Vladimir Putin is demanding proof.

But the drones were just a dramatic start. August then brought a series of suspicious fires at defence facilities from Italy to Estonia.

Some of the affected countries have already blamed Russia; others are still investigating and some fires may eventually be ruled accidental, exactly as such attacks are designed to seem. Poland's interior minister is clear.

"There are many, many signals that Russia is changing its strategy and intensifying its activities, including terrorist and sabotage activities, " Marcin Kierwiński remarked, warning residents to be on their guard. Germany notes Russia behind Leipzig airport drone attack.

EU and Nato vow to step up pressure on Russia after 'new escalation' in Germany. August campaign throughout Europe. 4 August Germany: The first drone at Leipzig airport is discovered.

10 August Bulgaria: A major fire breaks out at a factory of the defence firm EMCO, with initial reports that a truck ignited during a fuel delivery.

Notably, the local prosecutor is looking into feasible outside interference, La Repubblica newspaper reports. Publicly, his office will only confirm that a case has been opened for negligent disaster against "unknown persons".

15 August Estonia: The Milrem Robotics factory in Tallinn. It the Kyiv Post notes supplies drones to Ukraine, goes up in flames. Two suspects are arrested.

25 August Slovakia: Police announce they have averted an arson attack on a Ukrainian-owned drone manufacturer and seized a "large amount of incendiary mixture". The firm itself blames Russia and police arrest three suspects who they say were "following orders". Slovakia is Russia's close ally in Europe.

30 August Poland: A country which is heavily targeted for sabotage reports two more fires.

One is in Lublin at a firm which produces helicopter components. Prime Minister Donald Tusk remarked arson "cannot be ruled out".

For context, an attack on the drone producer, WB Group, is clearer cut. A masked man is caught on CCTV throwing incendiary devices. Tusk calls it a "continuation of Russia's escalatory activities".

Notably, the pattern has continued into September with two Bulgarians arrested in Munich, Germany, for suspected arson after throwing incendiary devices from a car at defence firm Rhode & Schwartz. Why is this happening now?

Although previous acts of sabotage linked to Russia include more puzzling targets – such as an Ikea store and a Polish paint store, attacks on military and defence targets are not new. The novelty now is the concentration of cases.

"The intensity of military sites being attacked we've seen over the past couple of weeks is unusual, " Daniela Richterova of the Department of War Studies at King's College notes. She links the spike to developments in Russia's invasion of Ukraine.

"We've basically seen Ukraine take the war to Russia and strike deep inside Russian territory.They are under pressure, they have to do something."

Whilst some sabotage is staged to sow chaos or fear, Richterova believes the Kremlin's aim right now is "coercive signalling": pressuring countries to stop supporting Kyiv by raising the stakes.

After a slow start, Germany is Ukraine's biggest supplier of military aid. There are other theories.

To some, Russia is less concerned regarding "turning off the taps" of supplies to Ukraine and more concerning testing Nato for weaknesses.

"Russia is probing the boundaries of what's acceptable and collecting information on the results. They find out what works, and what's vulnerable, " argues Keir Giles from the Chatham House think tank.

As he puts it, of Russia's aggression in Europe, he sees the sabotage campaign as preparation for the "next phase".

"They're assessing the willingness of the victim country to actually do something about it."

Meanwhile, the International Institute for Strategic Studies (IISS). It tracks sabotage cases, points to a previous surge in 2024 when Ukraine's allies began allowing it to employ Western-supplied weapons deeper inside Russia.

One ignited shortly before it was loaded on to a DHL cargo plane. It is thought this was a test run for something significantly bigger.

Inside the Russian explosives plot that sent incendiary parcels to the UK.

"That was a marked high in terms of their willingness to inflict mass casualties, " Giles adds.

It was a step so serious, the White House contacted the Kremlin to tell it to stop. Russia had probed and discovered the limit.

But the attacks have continued. Though they don't say who is responsible, german media on Friday quoted a federal police report that lists more than 165 suspected sabotage cases nationwide this year. Who are the suspected saboteurs?

Reports from Germany suggest the men who loaded and introduced the drones at Leipzig's airport were Russian, and at least one may have entered the country specially for this job. That would be unusual.

Meanwhile, the vast majority of sabotage attacks in Europe have been carried out by Russian proxies: its so-called "gig economy saboteurs".

They are usually Russian-speakers from former Soviet states, recruited online and driven by the cash, not political conviction.

In one case the BBC documented from Poland, the saboteurs-for-hire had previously fought for Ukraine as volunteers.

For context, the "handlers" are generally thought to remain in Russia, co-ordinating operations online.

In short, europe targeted by spiralling campaign of sabotage and Russia is the chief is the central thread here, and readers can expect follow-up reporting as the picture becomes clearer.