Russia Targets European Defence Factories with Sabotage: PET Warns of New Hybrid Frontline

The significance lies not only in what Russia may target next, but in how it is doing it. Europe’s industrial rear is increasingly being treated as part of the war over Ukraine, while the methods used are designed to keep the conflict below the point at which governments would face pressure to respond as though an armed attack had occurred.

A battlefield without a front line

The pattern is no longer confined to intelligence warnings.

In Munich on September 3, a fire was started at a construction site next to the headquarters of Rohde & Schwarz, a defence technology company producing counter-drone radar systems. Two Bulgarian nationals were detained on suspicion of politically motivated sabotage.

The incident followed a series of attacks and suspected plots elsewhere in Europe. A fire at Estonia’s Milrem Robotics, which develops unmanned ground vehicles used by the Ukrainian armed forces, led to the arrest of three Latvian citizens. In Bulgaria, an explosion struck an EMCO manufacturing facility producing 155mm artillery ammunition supplied to Ukraine. In Italy, an explosion and fire damaged a gunpowder-processing section at a KNDS Ammo Italy factory.

Czech and Lithuanian cases added another dimension: a drone and thermal-optics factory in the Czech Republic was badly damaged by arson, while Lithuanian authorities indicted six people over an attempted arson attack on a facility producing radio scanners for Kyiv.

Logistics have also been drawn into the picture, with arson and parcel-bomb incidents involving DHL facilities in Leipzig and Birmingham.

The individual incidents differ. The strategic logic is more consistent. European companies that manufacture, process or transport equipment destined for Ukraine are no longer simply commercial actors operating in peacetime. Their facilities can become points of pressure in a conflict in which Russia is trying to weaken the Western military effort without engaging NATO directly.

That changes the security equation for governments and companies alike.

The advantage of disposable agents

The most revealing part of PET’s warning may be the recruitment method.

A traditional intelligence operation requires trained officers, communications infrastructure, and personnel whose exposure can create a direct link to the state behind an operation. Recruiting local people through digital platforms changes the economics completely.

A person contacted through social media or an online gaming community can be asked to photograph a building, identify an entrance, or observe activity around a facility without necessarily understanding the purpose of the task. More committed recruits can potentially progress from reconnaissance to physical acts such as arson.

For an intelligence service, this creates distance.

The people carrying out the work may be criminals, ideological extremists, or otherwise vulnerable individuals rather than professional operatives. Their involvement also creates a layer of plausible deniability between the attack and the state suspected of directing it.

That is particularly valuable when the objective is disruption rather than destruction on a military scale.

A fire at a production site does not need to destroy an entire factory to impose costs. Security procedures can be tightened, operations interrupted, insurance costs can rise, and employees can become targets of intimidation. The same applies to logistics infrastructure. A relatively small intervention can create disproportionate friction in a supply chain.

For European intelligence services, this is a difficult target because the recruitment process takes place partly outside the traditional security environment. The first contact may occur not in a diplomatic setting or through a known intelligence network, but on a platform used by millions of ordinary people.

Defence production has become domestic security

Europe’s response to Russia’s full-scale invasion of Ukraine has included a substantial expansion of defence manufacturing. Artillery ammunition, counter-drone technology and unmanned and armoured systems have become strategically important industrial products.

That expansion creates an obvious vulnerability.

Factories built or expanded to increase production are physically located inside open European economies. They rely on employees, contractors, transport networks, energy supplies and commercial logistics. Many are privately owned. Their protection therefore cannot be organised simply as though they were military bases.

PET’s decision to brief individual Danish defence companies directly illustrates this changing relationship between the state and private industry. The intelligence service is not merely investigating an attack after it happens; it is warning companies that their ordinary security arrangements may no longer be sufficient.

This creates a new burden for European defence contractors. They must increasingly invest in perimeter security, surveillance, access controls and internal intelligence while maintaining facilities designed for manufacturing rather than military defence.

The costs are likely to spread beyond the companies themselves. Commercial logistics operators, suppliers and other businesses connected to defence production can become exposed because distinguishing between military and civilian infrastructure is increasingly difficult.

A logistics hub may be commercially operated but strategically important. A factory may produce components for several customers, only some of which are connected to Ukraine. The distinction that once separated economic security from national security becomes less useful.

Europe’s Article 5 dilemma

For NATO governments, the attraction of this form of sabotage is precisely its ambiguity.

The use of criminal proxies and low-level kinetic attacks allows Russia to impose costs without necessarily presenting a straightforward case for collective military action under Article 5 of the North Atlantic Treaty. An arson attack carried out by a locally recruited individual does not resemble a conventional military strike by a state.

That does not make it harmless. It makes attribution and response harder.

European governments are consequently caught between two risks. Underreaction can leave defence industries exposed and encourage further attacks. Overreaction can escalate a confrontation that Russia has deliberately designed to remain below the threshold of open military conflict.

This is the central advantage of the grey-zone approach: the attacker can seek strategic effects without accepting the strategic risks associated with conventional warfare.

The result is a security problem that cannot be solved solely through military deterrence. The relevant battlefield extends into corporate security departments, intelligence services, police forces and digital platforms.

Sanctions are becoming part of the response

European governments are already moving towards a broader economic response.

EU foreign ministers are advancing the bloc’s 22nd sanctions package, expected to be formally adopted in autumn. The proposed measures would target about 1,600 individuals and entities linked to Russia’s military-industrial complex through asset freezes, transaction bans and travel restrictions. The package would also expand sanctions on Russia’s shadow fleet, which already includes 673 vessels.

The political significance of such measures extends beyond the immediate economic restrictions. Repeated attacks on European defence and logistics infrastructure provide additional momentum for governments arguing that Russia’s confrontation with Europe is not limited to the battlefield in Ukraine.

Germany has already responded to hybrid activities with diplomatic measures, including the closure of the Russian consulate in Bonn and the Russian House in Berlin following attacks involving the Leipzig/Halle airport hub. Russia retaliated by closing Goethe-Institut locations.

Such tit-for-tat measures carry a less visible cost. Diplomatic facilities can provide environments in which states maintain contacts and gather information. Closing them may reduce the channels through which counterintelligence services can observe or manage Russian activity.

Yet leaving those structures untouched carries its own risks when governments believe they are being used as part of hostile activity.

That is the institutional dilemma now spreading across Europe: security services need greater access to information about private companies and digital recruitment networks, while democratic economies cannot simply be placed under permanent surveillance.

The price of an open industrial base

The Danish warning therefore matters beyond Denmark.

Europe is trying to rebuild a defence-industrial capacity capable of sustaining Ukraine while strengthening its own military position. The more successful that effort becomes, the more strategically valuable the factories, suppliers and logistics networks behind it become.

Private companies now inherit part of the security burden that governments traditionally carried. They must protect employees and facilities against threats that may originate with a foreign intelligence service but arrive through ordinary digital platforms and local criminal networks.

The people recruited to carry out these operations face another reality. They may be treated as disposable assets by the intelligence services using them, while bearing the criminal and legal consequences themselves.

For European governments, the harder question is how far domestic security must expand to protect an industrial base that has effectively become part of the continent’s strategic defence.

The factories are not military bases. The people recruited online are not soldiers. The fires may not constitute an armed attack.

That ambiguity is not a weakness in Russia’s strategy. It is the mechanism that makes the strategy work.