Russia Targets European Defence Executives for Assassination, Intelligence Agencies Warn

For Moscow, the objective is to make European support for Kyiv more expensive and more difficult to sustain without having to confront NATO countries through conventional military action.

The people behind Europe’s defence industry are becoming targets

The targeting of civilian executives marks a significant departure from the boundaries that European governments once expected Russian intelligence services to observe. Those boundaries were never absolute. Russia has a history of covert operations on European soil, including assassinations, cyberattacks and the 2014 explosions at Czech arms depots linked to GRU Unit 29155. What appears to be changing is the prominence of direct physical intimidation against people whose commercial decisions help sustain Ukraine’s war effort.

The threatened executives occupy a strategically important position. Europe’s military support for Kyiv depends not only on government budgets and procurement contracts, but also on manufacturers capable of delivering equipment at speed. Drone producers and component suppliers are particularly important in an environment where technology must be adapted quickly to battlefield requirements.

The campaign therefore targets a vulnerability that conventional military planning does not necessarily capture. A government can announce additional funding or place an order for equipment, but neither guarantees that a manufacturer will be able to fulfil it if its facilities are repeatedly attacked, its supply chains disrupted or its leadership forced to operate under extraordinary security constraints.

Two incidents in August 2026 illustrate the changing threat. In Sweden, a plot targeting Saab chief executive Micael Johansson was foiled. In Germany, an explosive-laden drone was discovered near a Ukrainian military transport aircraft at Leipzig/Halle Airport, an incident German authorities formally attributed to Russia.

The cases differ in their immediate circumstances, but both illustrate the exposure of the wider defence ecosystem. The threat extends beyond weapons themselves to the executives, transport infrastructure and industrial facilities that make military assistance possible.

An industrial base built for speed, not counterintelligence

Europe’s defence expansion since 2022 has brought a proliferation of smaller technology companies and drone manufacturers into the military supply chain. Their advantage is agility. They can develop products, respond to battlefield feedback and scale production without the institutional weight of major defence contractors.

That same structure creates weaknesses.

Large manufacturers can draw on established security departments, specialist legal teams and extensive resources for protecting senior executives and sensitive facilities. Smaller firms are less likely to have comparable arrangements. Their management teams may be closely involved in daily operations, while their production depends on a relatively narrow network of suppliers and technical specialists.

The costs of defending against state-sponsored threats could therefore fall unevenly across the sector. Close protection, stronger access controls, cybersecurity upgrades and counterintelligence training all require money and staff time. For a smaller manufacturer, these are not necessarily marginal expenses. They compete with investment in production capacity, recruitment and research.

The consequences may extend beyond individual companies. If smaller suppliers become harder or more expensive to operate, larger contractors and governments could find it more difficult to expand output at the pace required. Security measures may be essential, but their cumulative effect could be to slow the very industrial mobilisation Europe is trying to accelerate.

This is the central economic logic of the intimidation campaign. Moscow does not need to destroy every factory or successfully attack every executive. If the threat itself changes corporate behaviour, the operation can impose costs even when counterintelligence prevents an actual attack.

Criminal networks offer deniability and reach

European authorities are confronting a further complication: the use of transnational agent networks and organised crime structures for surveillance, logistics and attacks.

Such arrangements give intelligence services access to people and capabilities operating outside traditional diplomatic channels. They can also make it harder for security agencies to distinguish state-directed activity from ordinary criminal behaviour until an operation has advanced. Networks distributed across borders create additional demands for intelligence-sharing and coordination, particularly when surveillance, preparation and execution take place in different jurisdictions.

Germany’s domestic intelligence service, the BfV, has warned lawmakers about deliberate violent acts by state-controlled actors using organised crime. The broader pattern is consistent with a campaign that seeks to exploit the openness of European societies rather than challenge their security forces directly.

The challenge is not simply to identify Russian intelligence officers. European agencies must also detect intermediaries, establish links between apparently disconnected incidents and determine when criminal activity forms part of a wider state-directed operation.

Research by the International Centre for Counter-Terrorism and Globsec documented more than 151 Russian-linked hybrid operations, sabotage incidents and arson attacks across Europe between February 2022 and February 2026. The figure suggests that the current warnings belong to a sustained pattern rather than a series of unrelated security failures.

Yet scale creates its own problem. A decentralised network can force intelligence services to spread resources across numerous targets and jurisdictions, while the companies at risk have little ability to assess the threat independently.

Warnings can prevent attacks, but they cannot provide deterrence

European counterintelligence has already disrupted some planned operations. The foiled plot against Johansson demonstrates that intelligence and protective measures can make a difference before a threat becomes an attack. Corporate responses have also become more substantial, with executives increasing close protection, companies strengthening physical security and cybersecurity, and staff receiving counterintelligence training.

These interventions reduce immediate exposure. They do not necessarily change the calculations of the actors organising the campaign.

The European response has combined intelligence warnings with targeted sanctions and national measures. In July 2026, the EU and the UK imposed joint sanctions on nine individuals and four structures under a package targeting cyber and hybrid threats, including GRU personnel and proxy networks. Germany subsequently announced diplomatic expulsions and national sanctions following the Leipzig airport incident.

The formal attribution of the Leipzig plot matters because it narrows the space for treating such an incident as an unexplained security breach. It gives Berlin a basis for responding to the episode as a Russian state-linked operation rather than an isolated criminal act. But attribution and punishment are different from prevention. Sanctions can impose costs on identified actors without automatically dismantling the networks through which further operations might be organised.

The same distinction applies to public warnings. Alerting companies can prevent an attack, but it also transfers part of the responsibility for managing a national security threat to private organisations. Firms are expected to identify suspicious activity, protect personnel and secure supply chains against an adversary that may possess intelligence resources far beyond their own.

A response built primarily around warnings, local security improvements and sanctions may therefore contain individual incidents without eliminating the incentives behind them. More severe deterrence is difficult when operations are conducted through intermediaries, attribution takes time, and European governments must coordinate their responses across different legal systems.

The cost of protection is becoming part of the cost of defence

The immediate concern is the safety of individuals. The wider issue is whether Europe’s defence-industrial expansion can withstand sustained pressure on the people and businesses that make it possible.

Governments have encouraged manufacturers to increase production and bring new technologies into service. That policy depends on a functioning commercial ecosystem, including small suppliers whose security arrangements were not designed for confrontation with a foreign intelligence service. Treating protection as an individual corporate responsibility risks leaving the most exposed parts of the supply chain with the fewest resources to respond.

A more durable approach would require governments and industry to establish clearer arrangements for sharing threat intelligence, reporting suspected state-directed activity, and coordinating protective measures across borders. Legal frameworks would also need to address the position of civilian executives and technical personnel who become targets because of their companies’ contribution to military assistance. The precise form of those changes remains an institutional question, but the underlying problem is already apparent: conventional corporate security is no longer sufficient for every company operating in Europe’s defence sector.

There is also a question of how the burden should be distributed. If security costs are left largely to individual manufacturers, the companies least able to absorb them may become the least reliable parts of the supply chain. If governments assume a greater role, they must decide how to protect commercially sensitive information while giving firms access to intelligence that they cannot obtain on their own.

Russia’s campaign exploits the gap between these responsibilities. Defence companies remain private businesses, subject to ordinary commercial pressures and legal obligations, even as their operations become part of a wider strategic confrontation. Intelligence agencies can warn them of danger, but cannot guarantee that every threat will be detected. Governments can impose sanctions, but cannot assume that punitive measures will deter every proxy network.