The Kinetic Turn: When the Wire Goes Quiet and the Building Burns
In the spring of 1995, NATO observers cataloguing Serbian artillery positions around Sarajevo noted a pattern that would recur in every subsequent European security crisis: the most consequential moves arrived not as declarations but as facts on the ground, explained afterward as accidents, equipment failures, or the work of persons unknown. The building burned. The wire stayed quiet.
Russia's campaign against European defence industry follows the same grammar, and the scale is no longer deniable. Reported sabotage operations against European defence facilities tripled in 2024 compared to the year before. That number belongs on a ledger, not in a footnote.
The escalation has a visible shape. The early phase ran through cyberattacks and influence operations, instruments calibrated to remain below any threshold that might compel a formal response. Since 2022 the methods have turned physical, and the targets have moved inside NATO territory with a directness that would have been called an act of war in a less confused era.
The parcel bombs are the clearest illustration. In the summer of 2024, incendiary devices concealed inside DHL shipments were discovered at logistics hubs in Leipzig and Birmingham - cargo infrastructure that moves equipment across the continent without a second glance from a border guard. In Berlin that same May, a fire tore through the Diehl Metal plant, a manufacturer of components for the IRIS-T air defence system; intercepted NATO communications subsequently linked the fire to Russian sabotage.
The strategic logic is not complicated. You do not need to destroy a weapons factory to slow a war. You need only to make the supply chain afraid of itself.
The Coordinator: GRU Unit 29155 and the Architecture of Deniability
Western intelligence agencies have named GRU Unit 29155 as the primary coordinator of kinetic sabotage operations across European soil. The unit is not anonymous. Its operatives left traces in Salisbury in 2018, in the Vrbětice ammunition depot explosion in 2014, and in the Skripal poisoning - a record that NATO governments have documented, protested, and largely absorbed without structural consequence. That Unit 29155 continued to operate after each exposure is not a failure of intelligence. It is the whole point.
The architecture is designed around distance. Between the GRU handler and the burning factory stands a recruited local - a Latvian national, a Ukrainian national, a Romanian national - found through Telegram, paid in cryptocurrency, and expendable the moment the job is done. Three Latvian citizens detained after the Milrem Robotics arson in Tallinn; Serhii N. and Alla S. arrested in the Thumann Novichok plot. Each arrest closes a case and opens nothing above it. The financial trail dissolves into blockchain ledgers that do not point to Moscow, only to a wallet.
Plausible deniability is not a workaround — it is the product. The proxy layer exists precisely so that no intercepted payment, no detained operative, no forensic match reaches a level that compels a legal or military response. The architecture of the campaign is its alibi. Ask the small question first: who benefits from a structure that punishes attribution and rewards ambiguity, and who is left standing in the legal no-man's-land.
Plausible deniability is not a workaround — it is the product.
Recruited by Telegram, Paid in Coin: The Gig Economy of Destruction
The operational logic is straightforward, and it has nothing to do with tradecraft in the old sense. A handler in Moscow does not need a trained agent in Tallinn. He needs someone in debt, or desperate, or simply incurious about who is paying and why. The recruitment channel is Telegram. The payment is cryptocurrency. The task is specific and small enough that the operative can tell himself he has done nothing serious.
Three Latvian citizens were detained in connection with the August 2026 arson at a Milrem Robotics facility in Tallinn. Estonian authorities have not confirmed what, if anything, those three individuals understood about their client. That gap - between the act and the knowledge of its purpose - is not a flaw in the operation. It is the operation.
The same template appeared in Pardubice in March 2026, when a factory owned by LPP Holding, producing drones and thermal imaging equipment, was set on fire. A group calling itself the "Earthquake Faction" claimed the attack. Investigators assessed that claim as a Russian false-flag construction: a notional faction conjured to absorb attribution and dissolve it. Somewhere, someone was paid in coin they could not easily trace back to a state payroll.
The Robert Lansing Institute described the recruitment pool plainly: local residents, migrants, financially vulnerable individuals. The structural advantage for Moscow is clean. Handlers remain insulated behind multiple layers of digital distance and proxy identity. Operatives are expendable, and frequently unknowing of the chain above them. Ask the small question first: who bears the legal and physical risk in this arrangement, and who collects the strategic dividend. The answer has not changed across any of these cases.
From Assembly Lines to Corner Offices: The Target List Widens
On the morning of August 15, 2026, a Milrem Robotics facility in Tallinn caught fire. Milrem builds unmanned ground vehicles - the kind Ukraine needs, and Russia does not want it to have. Three Latvian citizens were detained in connection with the arson; the vehicles they intended to delay were destined for a war still being fought 800 kilometres to the south.
Five days earlier, on August 10, the EMCO artillery ammunition factory in Bulgaria was torn apart by an explosion. EMCO is one of the principal producers of 155mm shells flowing to the Ukrainian front. The factory floor, the calibre, the date: somewhere a spreadsheet was quietly updated.
These were attacks on buildings. Then the target list changed.
In 2024, US and German intelligence services thwarted an assassination plot against Rheinmetall CEO Armin Papperger. Rheinmetall is Europe's largest land-systems manufacturer; Papperger is the man whose name appears on the contracts. The plot was foiled, but the signal it sent was unambiguous - the campaign had moved from property to persons.
By 2026, that signal had been amplified. Germany's domestic intelligence agency, the BfV, uncovered a Novichok poisoning plot targeting Stefan Thumann, CEO of drone manufacturer Donaustahl. Two suspects were arrested: Serhii N., a Ukrainian national, and Alla S., a Romanian national. Novichok is not a weapon of subtlety. It is a weapon of demonstration - chosen so the target community reads the message even when the operation fails.
The pattern across these five incidents is not random escalation. It is a deliberate ratchet: first the production line, then the component supplier, then the man who signs the delivery orders. The logic is straightforward. A factory can be rebuilt. A CEO who has watched his counterpart nearly die of a nerve agent may choose, rationally, to sign something else instead.
Below the Threshold: The Legal No-Man's-Land Europe Is Standing In
The calibration is deliberate. Arson at a robotics facility, a parcel bomb in a logistics hub, a poisoning plot handed to a disposable proxy - each operation is designed to stay just below the level of armed attack that would trigger NATO's Article 5 collective defence. The threshold is not a line Russia failed to notice. It is the architecture.
Compare this to the Soviet playbook in the 1970s and 1980s, when active measures ran through front organisations and forged documents. The current campaign is structurally different: the physical destruction is real, the casualties could be real, and the legal category is still organised crime. That reclassification is the point. When three Latvian citizens are charged with arson rather than an act of war, the responding instrument is a court docket, not a defence alliance.
Criminal proxies blur attribution in both directions. A state cannot easily invoke collective defence against a network of financially desperate recruits found on Telegram. A prosecutor cannot easily charge a GRU directorate operating from Moscow.
The EU found its own instrument for the middle ground. In December 2024, it sanctioned 16 individuals and three entities for Russian destabilisation activity - the measure a bloc reaches for when the threshold for harder tools is not met. Estonian Prime Minister Kristen Michal publicly confirmed investigations into Russian industrial sabotage, a rare official acknowledgement of what the legal framework still struggles to name cleanly. Sanctions and press conferences are not nothing. They are also not enough.
One Marker to Watch: Naming Russian State Sabotage Under Law
The proxy architecture is the load-bearing wall. The specific fires, the parcel devices, the Novichok vials, those are moulding. Remove any single operation and the campaign continues; dismantle the recruitment infrastructure and it cannot. Western governments have largely read this correctly in their intelligence assessments, but reading correctly and acting on the read are different things.
Two facts remain stubbornly unresolved. The number of attacks classified as industrial accidents by local fire and police services is unknown, and therefore the tripling of recorded incidents in 2024 is almost certainly an undercount. More consequentially, it is not on the public record whether any of the detained proxies, the three Latvians from the Milrem case, the pair arrested over the Thumann plot, have led investigators to an identified GRU handler.
The marker to watch is formal designation. If European governments move in the next parliamentary cycle to classify Russian sabotage of defence industry targets as acts of state-sponsored terrorism under domestic law, the legal and NATO-procedural landscape shifts in ways that matter. If they do not, the silence is itself a finding. The next building burns either way; the question is whether anyone has yet decided to name the arsonist before it does.
