Russian Proxy Sabotage in NATO: How the Foiled Attack on a Ukrainian Drone Plant in Slovakia Exposes Europe’s New Front

Two suspects - a Latvian and a Ukrainian national - were detained in Slovakia, while a third 26-year-old Latvian suspect was arrested in Hamburg under a European Arrest Warrant, awaiting extradition. During searches, investigators recovered a substantial quantity of homemade napalm, an action camera, tools, and a hand-drawn map of the site.

What matters is less the immediate criminal case than what the choice of target reveals.

The factory was moved to safety. The threat followed

Skyeton had already learned the limits of geography.

In May, a Russian strike destroyed the company's headquarters and office in Kyiv. The response was not to concentrate production elsewhere in Ukraine, but to disperse it across several locations at home and abroad. The Slovak operation was established through Tropozond in the Prešov area, taking advantage of investments initiated under Slovakia's previous government and providing an environment less exposed to Russian missile attacks.

That calculation still makes sense. A production line in Slovakia is plainly less vulnerable to a direct Russian strike than one in Kyiv.

But the attempted attack points to the other side of decentralisation. Moving defence production into EU and NATO territory can reduce exposure to missiles while increasing exposure to a different form of warfare: covert penetration, sabotage and arson.

The distinction between a Ukrainian facility and a European one is therefore becoming less meaningful from a security perspective.

Skyeton's Raybird is not a conventional commercial drone. It is a fixed-wing tactical unmanned system designed for intelligence, surveillance, reconnaissance and target acquisition, with more than 350,000 flight hours recorded in Ukraine. Its stated capabilities include more than 28 hours of endurance and a range of up to 2,500km, while its systems can integrate with Western artillery platforms including HIMARS, Caesar and Krab.

That integration matters. A manufacturer supplying systems that connect Ukrainian battlefield intelligence with Western weapons platforms occupies a strategically different position from an ordinary technology company.

Europe is becoming part of the production battlefield

The Prešov case sits within a wider pattern of attempted attacks against defence-related infrastructure.

A sabotage attempt was reported at Archer-LPP in the Czech Republic in March. In early August, Milrem Robotics in Estonia was hit by an arson or sabotage incident. Suspicious fires and other acts of sabotage have also been reported at defence-adjacent sites in Italy and Bulgaria.

The incidents do not establish that every fire or act of sabotage has the same perpetrator. Nor does the Slovak investigation establish that the suspects acted on direct instructions from a Russian intelligence service.

What the cases do show is the emergence of a useful operational model for hostile actors: relatively inexpensive physical attacks can be outsourced to people who are not Russian nationals, recruited through criminal or digital networks and tasked with causing disruption rather than fighting a conventional battle.

The use of an action camera in the Prešov plot is particularly revealing in this context. The suspects were not merely equipped to start a fire. Investigators also recovered equipment capable of documenting what happened. Combined with the map of the facility and the incendiary materials, that points to a planned operation rather than spontaneous criminality.

For intelligence services, such cells offer another advantage. They create distance between the state seeking an effect and the people carrying out the physical act.

That distance is precisely what makes attribution and deterrence harder.

The European security perimeter is moving inward

For Slovakia, the incident is among the first known physical sabotage attempts aimed at defence technology production on its territory. That changes the problem faced by the host country.

A factory in an ordinary industrial zone can traditionally be protected through conventional security: access controls, surveillance, fire prevention and private guards. A facility producing military technology for a country at war presents a different risk profile.

The Prešov operation was disrupted during preparation, but the briefing does not establish which specific security measure exposed the plot or how the suspects were first identified. What is clear is that Slovak anti-crime authorities and intelligence services were able to intervene before the planned attack, while the arrest in Germany demonstrated the value of cross-border European mechanisms once suspects move between jurisdictions.

That cooperation may become increasingly important.

The suspects in this case were not drawn from a single national group. Two were Latvians and one was Ukrainian; arrests took place in Slovakia and Germany. The geography of the cell mirrors the geography of the defence industry itself: production, personnel, logistics and potential operatives can all cross borders more easily than the security structures designed to protect them.

European law enforcement has mechanisms for following those movements, including the European Arrest Warrant. The Hamburg arrest shows that the system can be activated quickly enough to prevent a suspect from simply disappearing across a border. But a functioning arrest mechanism is not the same thing as a comprehensive strategy for protecting an increasingly international defence industry.

Decentralisation has solved one problem - and created another

For Ukrainian defence manufacturers, dispersing production remains an obvious response to Russian missile warfare.

Skyeton's international footprint illustrates how far that model has developed. The company operates through structures in the United States and has expanded partnerships and production projects involving Britain, Denmark and the US. Its flagship American facility is in Fayetteville, North Carolina, while a planned joint venture with Britain's Prevail Partners was designed to employ 160 people. Other partnerships involve modular radio-frequency sensors and electronic-warfare integration.

The logic is straightforward: multiple production sites mean that the destruction of one plant does not necessarily stop the supply chain.

The attempted attack in Slovakia provides evidence that this redundancy can work. The Kyiv headquarters could be destroyed, yet the company continued to operate through a dispersed network.

But redundancy now carries a security bill.

Each new European production site becomes another location requiring intelligence assessment, physical protection, employee vetting, surveillance and contingency planning. Insurance and security costs can rise alongside the strategic value of the facilities. What was originally an industrial decision - where to manufacture efficiently and safely - increasingly becomes a question of national security.

That leaves European governments with a difficult choice. If Ukrainian defence companies are becoming embedded in Europe's own security and supply architecture, treating their facilities as purely private industrial premises may no longer be sufficient. Yet extending state-level protection to foreign-owned defence plants raises questions about resources, responsibility and the boundary between private security and national counter-intelligence.

The political problem is compounded by the ambiguous space in which sabotage operates. Slovak pro-Russian propagandist Andrej Palko had indirectly encouraged the destruction of Skyeton in his videos, although investigators indicate the planned attack was probably not directly connected to his content. That distinction matters: inflammatory propaganda can create an environment hostile to a target without providing evidence of operational command.

The more consequential development is therefore not whether one propagandist can be tied to one cell. It is whether European security agencies can identify and disrupt networks before low-cost acts of sabotage begin producing high-cost strategic effects.

Prešov shows what that contest increasingly looks like. The factory is in Slovakia. The company is Ukrainian. The suspects crossed national borders. The technology is integrated with Western weapons. The alleged hostile model relies on deniable intermediaries.

The battlefield has not literally moved to Slovakia. The security logic of the battlefield has.