Europe hesitates to name Russia in defense plant attacks

Europe’s defense industry has faced a growing series of fires, explosions and deliberate attacks in 2026, many of them affecting companies that manufacture weapons, ammunition, drones or other equipment for Ukraine. Western intelligence sources increasingly view the incidents as part of a Russian campaign intended to disrupt military supply chains, intimidate manufacturers and test how far Moscow can act inside NATO territory without provoking a collective response.

The suspected operations are designed to preserve plausible deniability. Russian intelligence services can recruit local criminals through intermediaries, while individual attacks may resemble industrial accidents or be claimed in the name of antimilitary, environmental or pro-Palestinian activism. This method complicates attribution and allows each incident to be treated as an isolated criminal case, technical failure or act of domestic extremism rather than part of a coordinated foreign campaign.

That ambiguity has also shaped Europe’s public response. Authorities must meet a high evidentiary threshold before accusing another state, but the resulting caution can fragment or minimize the wider pattern. Western intelligence sources cited by The Telegraph said some governments in Western Europe were reluctant to connect attacks to Moscow because of concerns about escalation. Italian and Bulgarian officials have rejected or played down a possible Russian role in incidents that remain under investigation, while authorities in Czechia and Estonia have publicly acknowledged that Russian involvement is one of the theories being examined.

Moscow has also issued a public warning against European defense production supporting Ukraine. In April, the Russian Defense Ministry published the names and addresses of European companies it accused of manufacturing drones or components for Kyiv. Dmitry Medvedev, deputy chairman of Russia’s Security Council, called the facilities potential targets for the Russian armed forces and wrote: “When strikes become a reality depends on what comes next. Sleep well, European partners!” Kremlin spokesman Dmitry Peskov later declined to say whether Russia was considering attacks on the listed facilities. Reuters documented the warning and publication of factory addresses.

The events form part of a much larger security problem. The Munich Security Report 2026, using ACLED data, plotted roughly 150 suspected Russian hybrid incidents in EU and NATO countries between January 2022 and December 2025. Its categories included arson, sabotage, spying, vandalism, drone overflights and incendiary parcels. The report said many operations were constructed to remain deniable or ambiguous, allowing Russia to exert pressure while making direct attribution difficult.

The first 2026 attack examined here occurred before dawn on March 20 at LPP Holding’s facility in Pardubice, Czechia. The company develops optics, autonomous systems and drones, including equipment supplied to Ukraine. The fire damaged production buildings and stored products but caused no injuries. LPP said the damage did not interrupt a planned delivery of 40 attack drones to Ukraine.

Czech police treated the fire as a deliberate attack and investigated it as possible terrorism. A previously unknown pro-Palestinian group claimed responsibility, alleging that LPP was producing weapons for Israel. LPP said it had no cooperation with Elbit Systems and did not manufacture equipment for Israel after a proposed partnership announced in 2023 failed to proceed.

The company said the anti-Israel claim could have been intended to conceal a Russian-directed operation against its work for Ukraine. Police publicly said they were considering several motives but did not confirm Russian direction. Reuters reported that a Russian connection remained one of the lines under examination. Authorities in Czechia and Slovakia later detained four suspects on terrorism-related allegations. The arrests identified suspected participants but did not establish who may have directed them.

The next episode targeted electrical infrastructure serving defense manufacturers rather than the factories themselves. During the night of April 6 to 7, fires damaged installations at La Chapelle-Saint-Ursin, Bourges and Saint-Florent-sur-Cher in central France. The sites included transformers, a high-voltage substation and a power pylon connected to networks serving KNDS and MBDA facilities.

The Cher prefecture described the incidents as coordinated and particularly serious. About 3,000 homes lost power, while repairs were expected to take months and cost several million euros. Investigators found graffiti at one site reading “Actions against the war.” The Bourges prosecutor opened an investigation, but French authorities had not publicly attributed the operation to Russia by Aug. 24.

The attack illustrates how an operation against the defense industry can be presented as domestic activism. The available evidence supports a coordinated antimilitary sabotage case, but it does not establish whether the slogan reflected the perpetrators’ actual motive or was intended to divert attention from another sponsor. The Cher prefecture published the initial official account, while TF1 reported the defense-industry connections, outages and damage.

A fire and explosions destroyed an ammunition storage building at EMCO’s plant near Belitsa, Bulgaria, on Aug. 10. Workers were evacuated and no casualties were reported. Investigators considered accidental ignition, a deliberately introduced fire source, altered components and safety violations among the possible causes.

EMCO manager Slavcho Dimiev said the fire appeared to have begun inside the building and that there were no grounds at that stage to claim outside interference. He identified spontaneous ignition of a propellant charge as one possible explanation. Prosecutors kept deliberate action among the lines of inquiry, but had not identified a leading cause while the site was still being secured. The Bulgarian News Agency reported that the investigation remained open to all possible causes.

Suspicion surrounding EMCO is rooted in the company’s earlier history. Its owner, Emilian Gebrev, survived a poisoning in 2015. Bulgarian prosecutors later investigated six Russian citizens in connection with the poisoning and four explosions at Bulgarian arms depots between 2011 and 2020. Prosecutors said the evidence indicated an effort to stop ammunition supplies to Georgia and Ukraine. That history provides grounds for close examination of the 2026 fire, but it is not evidence that Russian intelligence caused it. Reuters reported the findings of the earlier Bulgarian inquiry.

Three days after the EMCO fire, a blaze in the powder-pressing area of the KNDS Ammo Italy plant at Colleferro was followed by a powerful explosion. All 24 workers at the site were accounted for and no injuries were reported. The facility produces medium- and large-caliber ammunition for land and naval systems, along with solid propellants for aerospace applications.

The timing prompted comparisons with the Bulgarian incident, but Italian Defense Minister Guido Crosetto said the government had seen nothing suggesting Russian involvement. He said the available information pointed to an internal problem. Prosecutors and KNDS continued separate investigations into the cause. As of Aug. 24, the Colleferro case remained an unexplained fire and explosion at an ammunition plant, not a confirmed act of sabotage. Reuters reported the government’s assessment and continuing inquiry.

In Tallinn, a building used by Milrem Robotics caught fire overnight into Aug. 15 after a resident reported suspicious activity nearby. Estonian prosecutors said the fire was deliberate and premeditated. Three suspects were detained in Latvia, and Estonian authorities began efforts to bring them to Estonia.

Milrem produces THeMIS unmanned ground vehicles and other robotic systems used in Ukraine. Chief Executive Kuldar Väärsi said the fire did not disrupt production, supply chains or deliveries to Ukraine. Prime Minister Kristen Michal said investigators were examining whether Russia was behind the arson, but neither prosecutors nor the government had announced a final attribution. ERR reported the arrests and the prosecutor’s finding that the fire was premeditated. Reuters reported that deliveries continued and that Russian involvement remained under investigation.

These unresolved cases sit beside operations for which European investigations have produced firmer findings. In March 2026, European police agencies said they had identified 22 people connected to incendiary parcels that ignited at logistics facilities in Germany, Poland and Britain in 2024. Five suspects were charged, and investigators said Russia’s GRU military intelligence service was believed to be behind a plan to place incendiary devices aboard US-bound cargo aircraft.

Lithuanian authorities separately accused the GRU in January 2026 of organizing attempted arson at a plant that supplied radio-frequency scanners to Ukraine’s military. Six people were arrested, while investigators said the network had also prepared attacks in Poland, Romania and Czechia. The suspects came from several countries and were allegedly offered between 5,000 and 10,000 euros.

A German court added another documented case on Aug. 18. It convicted a Ukrainian man of assisting an operation ordered through an intermediary linked to Russian intelligence. The group sent GPS-equipped parcels to examine transport routes that could later be used for incendiary attacks. Two co-defendants were acquitted because the court found insufficient evidence that they understood the operation’s purpose.

The European Union has formally described sabotage, attacks on critical infrastructure, cyber operations and physical violence as elements of Russia’s continuing hybrid campaign against member states and partners. National authorities are therefore examining new fires and explosions against the background of an already documented Russian program that relies on recruited proxies and deniable assignments.

Not every incident at a European arms plant can be attributed to Russia without evidence from the individual investigation. At the same time, treating each case exclusively as an unrelated accident or act of local activism risks overlooking the defining feature of the campaign described by European investigators: operations structured so that Russian direction remains difficult to prove even when the target, recruitment method and political purpose fit an established pattern.