How Russia’s New Proxy Sabotage Threatens Europe’s Defence Industry: Lessons from Denmark’s PET Warning

European governments have spent years dealing with Russian hybrid activity in forms that were difficult to attribute but relatively familiar: cyberattacks, disinformation, political pressure, surveillance and other forms of disruption.

The Danish intelligence assessment points to something more tangible.

During the spring, PET detected extensive Russian planning and target scouting, but relatively little execution. By early summer, that pattern changed. Russian services began selecting sites where physical disruption could affect the production or delivery of military equipment destined for Ukraine.

The development is consistent with a Russian Ministry of Defence list published in April that identified European manufacturers of drones and drone components as potential military targets.

The choice of defence production is significant. Europe is trying to expand its industrial capacity precisely because support for Ukraine increasingly depends on the ability to manufacture weapons, drones and components at scale. Disrupting that capacity offers Moscow a way to attack the military effort without confronting European armed forces directly.

The effect does not need to be spectacular to be useful. A damaged facility, disrupted logistics operation or compromised component supplier can create delays further down a supply chain whose vulnerabilities may not be visible at the point of attack.

That makes the industrial network itself a security concern.

The disposable operative

The most striking element of the Danish assessment is the recruitment model.

PET says Russian intelligence is increasingly using people who are neither trained intelligence officers nor professional saboteurs. Homeless people and individuals with substance-use problems are among those being recruited through platforms including Telegram and gaming channels.

The process can begin with something that appears almost innocuous: photographing a site, observing security arrangements, checking routes or collecting information about a logistics facility.

The next step can be physical.

According to PET, recruits may be directed towards arson, destruction of equipment or other forms of sabotage. The logic is deliberately crude. If one proxy is caught or fails, another can be recruited.

It is a form of operational outsourcing in which the person carrying out the attack is expendable.

For Russian intelligence, that creates a striking asymmetry. The recruitment cost is low, the pool of potential operatives is large and the consequences of losing an individual are limited. For the European state trying to prevent an attack, the problem is much more expensive: factories, logistics centres and component suppliers must identify suspicious behaviour before it develops into an incident.

The same model also complicates attribution. A person arrested near a damaged facility may provide evidence of the operation without providing the kind of direct link to the Russian state needed for immediate political or legal retaliation.

That ambiguity is not an accidental by-product. It is part of the advantage.

Europe’s defence industry has become security infrastructure

For decades, physical security around defence production was largely treated as an industrial concern, while the state concentrated its most sophisticated protection around military facilities and critical national infrastructure.

The expansion of European weapons production for Ukraine blurs that distinction.

A major defence contractor may already operate under extensive security measures. A smaller manufacturer producing a component for a drone or weapons system is a different proposition. Such companies can be embedded deep inside commercial supply chains and may not look like traditional military targets.

That creates a gap between the strategic importance of a facility and the security resources normally associated with it.

Dansk Industri, Denmark’s business association, has described hybrid sabotage as a permanent “new normal” for private companies. Businesses are responding with tighter access controls, stronger vetting of temporary workers, more robust physical and network security and closer cooperation with PET.

The burden is substantial because the threat is not confined to one perimeter.

Companies must increasingly think about who has access to their premises, who knows their logistics routes, who can photograph sensitive infrastructure and how apparently minor intelligence-gathering activity might feed into a later attack.

Security is moving down the supply chain.

Why attribution matters

PET has not named the Danish companies involved or disclosed the precise nature of completed attacks, damage or casualty figures. The agency cited operational security and ongoing police investigations.

That restraint is politically important.

Naming a target can reveal what Russian intelligence already knows, while detailed descriptions of an operation can help identify which security measures were bypassed and which vulnerabilities remain exposed. Public disclosure can also provide information to the very networks investigators are trying to penetrate.

Yet the absence of publicly presented physical evidence creates another problem.

Russia’s embassy in Copenhagen rejected PET’s assessment on October 7, accusing Danish authorities of making unfounded allegations. Moscow continues to deny responsibility for hybrid warfare and sabotage in Europe.

The resulting contest is not simply over whether an individual attack happened. It is over how much evidence democratic governments can disclose while protecting intelligence sources and active investigations.

That is precisely where the proxy model becomes useful to Moscow.

A state-directed operation carried out by a disposable civilian intermediary creates several layers between the intelligence service and the physical act. The more distance there is between the organiser and the person arrested at the scene, the harder it becomes to turn intelligence attribution into a publicly demonstrable chain of responsibility.

For NATO countries, that creates a space between an attack being serious enough to demand a response and being sufficiently attributable to trigger the mechanisms associated with direct state aggression.

A wider European problem

Denmark is not dealing with the issue in isolation.

A September 24 assessment by Denmark’s Defence Intelligence Service warned of increasing Russian operational boldness, including destructive cyberattacks, drone reconnaissance and targeted disruption of military rail transport in the West. Earlier drone swarms had disrupted six Danish airports, including Copenhagen, in September 2025.

Across Europe, authorities have also investigated suspected Russian-linked activity involving logistics, defence facilities, arson and physical reconnaissance. Cases and investigations have emerged in Germany, Poland, the Baltic states, Slovakia and the United Kingdom.

The pattern matters because the targets are increasingly connected to the same strategic objective: sustaining Europe’s ability to support Ukraine.

Recorded hybrid incidents in the Baltic Sea region have been spread across transport infrastructure, government and military facilities, energy infrastructure and the defence industry. The defence sector accounts for 21 per cent of the recorded incidents in the briefing’s dataset, equal to energy infrastructure and behind transport and government or military facilities.

The security challenge therefore extends beyond protecting weapons factories. It concerns the connective tissue that allows European military production and deliveries to function.

The gap between NATO planning and cheap sabotage

European security policy is built around sophisticated capabilities: surveillance, intelligence sharing, military deterrence and increasingly integrated protection of critical infrastructure.

The Russian proxy model attacks a different layer.

A sophisticated security architecture can still be forced to spend enormous resources dealing with a person recruited online to photograph a warehouse, scout a route or set fire to equipment.

That imbalance is precisely why the private sector is being pulled into the security system. The defence industry can no longer treat physical protection, personnel vetting and supply-chain monitoring as secondary corporate functions when its production directly affects the battlefield in Ukraine.

European institutions are beginning to adjust to that reality. The European Commission has proposed an EU-wide hybrid response mechanism modelled on NATO’s Article 4 consultations, while EU High Representative Kaja Kallas has pushed an Emergency Security Protocol covering sabotage, drone incursions and cyberattacks. NATO has also expanded regional surveillance through initiatives including Baltic Sentry and Eastern Sentry.

The harder question is whether these structures can connect military intelligence with police investigations and private-sector security quickly enough.

Europe’s traditional defence architecture was designed to protect states from armies. Russia’s emerging sabotage model is exploiting everything that sits between the state and the battlefield: factories, subcontractors, logistics networks and vulnerable individuals recruited through ordinary digital platforms.