Western intelligence sources believe Russia is running a sabotage campaign against weapons factories across Europe, recruiting local criminal gangs for attacks calculated to fall just short of triggering NATO’s Article 5 mutual defense clause, The Telegraph reported.
Russia’s military intelligence agency, the GRU, increasingly relies on intermediaries within criminal networks rather than sending its own officers abroad, according to Normunds Mežviets, head of Latvia’s State Security Service. GRU officers make contact over Telegram and pay recruits in cryptocurrency, and many of those carrying out the attacks never learn who they are actually working for.
“The Kremlin is recruiting local gang members to sabotage defence manufacturers to test Nato’s resolve.” https://t.co/aGALrEh3h9
— Michael Weiss (@michaeldweiss) August 23, 2026
This month, that pattern played out in Estonia, where a fire broke out overnight into August 15 at a Tallinn building used by Milrem Robotics, a manufacturer of unmanned ground vehicles that Ukraine’s military relies on for logistics and casualty evacuation. Estonian Prime Minister Kristen Michal said investigators were examining the fire as a possible act of Russian sabotage, warning that “attempts to intimidate us or undermine our security will not succeed.”
Western intelligence tells The Telegraph that Russia is stepping up covert sabotage against European defence plants supplying Ukraine.
— Open Source Intel (@Osint613) August 23, 2026
Moscow now recruits local criminals online and pays in cryptocurrency, staying below NATO's Article 5 line while keeping deniability.
Recent…
Estonian prosecutors said Latvian authorities had detained three suspects in connection with the fire. “We are working closely with Latvian law enforcement agencies,” state prosecutor Gardi Anderson said, adding that a court had granted requests to detain two of the three pending further proceedings. Milrem’s chief executive told Reuters the fire had not disrupted deliveries to Ukraine, where the company expects more than 200 of its systems to be in operation by year’s end.
The Milrem fire is one of several recent incidents Western officials are examining for a possible Russian hand, though not every one holds up. An explosion struck Bulgaria’s EMCO, a leading private producer of arms for Ukraine’s war effort, on August 10, and a similar blast hit the KNDS ammunition plant in Colleferro, near Rome, three days later.
Read: Is Russia Preparing to Attack NATO?
Italian investigators had already ruled that Rome-area explosion an accident earlier this month, a finding the new intelligence assessment doesn’t address. Czech investigators have detained four people over a fire that gutted a plant manufacturing drones and thermal-imaging gear for Kyiv, and Lithuanian prosecutors have charged six others in a separate attempted arson at a factory that supplies radio-wave scanners to Ukraine.
Eastern NATO members such as Poland and the Baltic states have been quick to publicly blame Moscow for the string of incidents, while officials in Italy and Bulgaria have been more reluctant to do so. Russia typically leaves little evidence tying such attacks directly back to the Kremlin, which is part of why attribution remains contested.
Latvian President Edgars Rinkēvičs, for his part, has stopped hedging. Speaking at a news conference near the Belarusian border this month about Russia’s hybrid war against Europe, he said simply, “it’s happening now.”