ع
German authorities have declared Russia responsible for a series of drones loaded with explosives found at Leipzig airport, a facility used to transport military supplies to Ukraine, according to the country’s interior minister. The discoveries in early August marked a shift toward targeting defence and military sites across the continent. A federal police assessment listed more than 165 suspected sabotage cases in Germany this year alone, though not every incident has been attributed to a specific actor.
An Associated Press database has documented 145 incidents that Western officials link to a Russian campaign of disruption that began after the 2022 invasion of Ukraine. A CSIS analysis found that the number of such attacks nearly tripled between 2023 and 2024 after already quadrupling in the prior year. The International Institute for Strategic Studies reported a 246 percent rise in confirmed sabotage against European critical infrastructure from 2023 to 2024, with 25 additional cases noted in the first five months of 2025.
Undersea cables linking Finland to Germany and Sweden to Lithuania were severed in November 2024, an event that Finnish and German officials described as possible intentional damage. A month later the Estlink 2 power cable between Finland and Estonia was cut along with nearby telecom lines, prompting Finland to seize a Russian-owned vessel. In November 2025 explosives detonated under a freight train on a Polish rail line, an event that formed part of the broader pattern catalogued by the Associated Press.
NATO has characterised the current level of sabotage threats as record high and called for the alliance to adopt a war footing against Russian subversion. ACLED data recorded 190 suspicious events across Europe between early 2022 and April 2025, more than half of them occurring in 2024. The incidents have concentrated in countries bordering Russia or providing strong backing to Ukraine, including Poland, Estonia, Germany, the United Kingdom and the Baltic states.
Most attacks have been executed by locally recruited proxies or online hires rather than Russian intelligence officers operating directly in the field, according to multiple European security services. The Guardian described these individuals as disposable participants in a gig-economy style recruitment drive that offers cash for acts of arson or vandalism. A New York Times investigation identified a former Russian taxi driver with criminal ties as a central coordinator for several plots involving incendiary devices shipped across the continent.
Russian authorities have rejected all accusations of involvement. Kremlin spokesman Dmitry Peskov told the Associated Press that Moscow has no connection to the campaign. Despite the denials, European governments have stepped up information sharing and protective measures around critical infrastructure while maintaining that the operations are calibrated to remain below the threshold of open conflict.
