European intelligence warns Russia is intensifying covert sabotage on European soil, involving bombings, arson, and infrastructure attacks targeting military and logistical sites in multiple countries.

Military & Paramilitary OperationsUnconventional / ParamilitaryProxy forces, militias, mercenaries (e.g. Wagner-type groups)

AggressorDefense

Summary

European intelligence agencies from multiple countries have reported an increased Russian campaign of state-controlled sabotage across Europe. This includes covert bombings, arson attacks, and infrastructure damage, often with disregard for civilian casualties. Notable incidents include arrests of two German-Russian nationals plotting attacks on military and logistics sites in Bavaria, a fire at a UK warehouse storing aid for Ukraine with alleged Russian operatives involved, investigations into railway derailments in Sweden suspected to be sabotage, and an attack on Estonia's interior minister's car attributed to Russian intelligence. France also warned of possible sabotage on military sites. Russia is believed to be employing proxies and organized crime groups, coordinating efforts through "Committees of Special Influence". The campaign aligns with Russia's broader hybrid warfare including disinformation and hacking. The German domestic intelligence chief Thomas Haldenwang confirmed a heightened risk of sabotage on European soil with significant potential damage. NATO has expressed deep concern about Russia's increasing malign activities on allied territory. Recent suspicious incidents include a major fire at Diehl Metal Applications in Berlin, a factory supplying Ukraine, and a prior unexplained explosion at a munitions factory in Wales also related to Ukraine supplies. Analysts deem these attacks part of a ramped-up effort to disrupt and destabilize Europe, serving as both direct damage and rehearsal for larger immobilization attempts.

Classification

Confidence: High

The article provides multiple verified examples of Russian covert sabotage attacks and arrests of operatives on European soil marking clear aggressor activity. It also details vigilance and warnings from European intelligence and NATO, indicating defensive preparations and heightened alertness.

Source URL

https://archive.is/VwGy2

Open source

Provenance

Publisher: extension
Submitted: Feb 14, 2026, 12:22 UTC
Last updated: Nov 4, 2026, 08:36 UTC
Event time: May 1, 2023, 00:00 UTC

Published as a Defense Preparations signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "07b41da7-d40f-45dc-8305-7703dde423e3",
  "url": "https://archive.is/VwGy2",
  "source": "extension",
  "status": "approved",
  "category": "Military & Paramilitary Operations",
  "subcategory": "Unconventional / Paramilitary",
  "incident_type": "Proxy forces, militias, mercenaries (e.g. Wagner-type groups)",
  "country": "Germany",
  "source_reliability": "B",
  "info_credibility": "3",
  "tags": [
    "Russian sabotage",
    "proxy actors",
    "European infrastructure attacks",
    "covert action",
    "russian intelligence operations",
    "NATO concern",
    "Germany",
    "United Kingdom",
    "Sweden",
    "Estonia",
    "France",
    "hybrid warfare"
  ],
  "nodes": [
    "Node 1: Borders",
    "Node 2: 5th Column"
  ],
  "countries": [
    "Germany"
  ],
  "where_text": "Land",
  "headline": null,
  "description": "European intelligence agencies from multiple countries have reported an increased Russian campaign of state-controlled sabotage across Europe. This includes covert bombings, arson attacks, and infrastructure damage, often with disregard for civilian casualties. Notable incidents include arrests of two German-Russian nationals plotting attacks on military and logistics sites in Bavaria, a fire at a UK warehouse storing aid for Ukraine with alleged Russian operatives involved, investigations into railway derailments in Sweden suspected to be sabotage, and an attack on Estonia's interior minister's car attributed to Russian intelligence. France also warned of possible sabotage on military sites. Russia is believed to be employing proxies and organized crime groups, coordinating efforts through \"Committees of Special Influence\". The campaign aligns with Russia's broader hybrid warfare including disinformation and hacking. The German domestic intelligence chief Thomas Haldenwang confirmed a heightened risk of sabotage on European soil with significant potential damage. NATO has expressed deep concern about Russia's increasing malign activities on allied territory. Recent suspicious incidents include a major fire at Diehl Metal Applications in Berlin, a factory supplying Ukraine, and a prior unexplained explosion at a munitions factory in Wales also related to Ukraine supplies. Analysts deem these attacks part of a ramped-up effort to disrupt and destabilize Europe, serving as both direct damage and rehearsal for larger immobilization attempts.",
  "summary_short": "European intelligence warns Russia is intensifying covert sabotage on European soil, involving bombings, arson, and infrastructure attacks targeting military and logistical sites in multiple countries.",
  "summary_extended": null,
  "actor_primary": "Russian intelligence operatives",
  "target_primary": null,
  "location_text": "Berlin",
  "location_region": "Berlin",
  "location_coordinates_lat": null,
  "location_coordinates_lon": null,
  "location_precision": "Approximate",
  "is_aggressor_signal": true,
  "signal_type": "DEFENSE_PREP_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The article provides multiple verified examples of Russian covert sabotage attacks and arrests of operatives on European soil marking clear aggressor activity. It also details vigilance and warnings from European intelligence and NATO, indicating defensive preparations and heightened alertness.",
  "event_time_utc": "2023-05-01T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "pm24h",
  "created_at": "2026-02-14T12:22:48.635Z",
  "updated_at": "2026-11-04T08:36:03.522Z",
  "reliability_band": "strong",
  "location_precision_band": "approximate",
  "time_precision_band": "within_24h",
  "severity_band": "significant",
  "attribution_confidence_band": "high",
  "attribution_basis": "single_source"
}

Public assessmentReliability: StrongSeverity: SignificantAttribution: HighSingle sourceTime: Same dayLocation: Approximate

Source reliability

Info credibility

Event time

May 1, 2023, 00:00 UTC

Event time confidence

pm24h

Location

Berlin

Region

Berlin

Primary actor

Russian intelligence operatives

Country

Germany

Countries

Germany

Tags

Russian sabotage, proxy actors, European infrastructure attacks, covert action, russian intelligence operations, NATO concern, Germany, United Kingdom, Sweden, Estonia, France, hybrid warfare

Nodes

Node 1: Borders, Node 2: 5th Column

Loading signal...

{ "id": "07b41da7-d40f-45dc-8305-7703dde423e3", "url": "https://archive.is/VwGy2", "source": "extension", "status": "approved", "category": "Military & Paramilitary Operations", "subcategory": "Unconventional / Paramilitary", "incident_type": "Proxy forces, militias, mercenaries (e.g. Wagner-type groups)", "country": "Germany", "source_reliability": "B", "info_credibility": "3", "tags": [ "Russian sabotage", "proxy actors", "European infrastructure attacks", "covert action", "russian intelligence operations", "NATO concern", "Germany", "United Kingdom", "Sweden", "Estonia", "France", "hybrid warfare" ], "nodes": [ "Node 1: Borders", "Node 2: 5th Column" ], "countries": [ "Germany" ], "where_text": "Land", "headline": null, "description": "European intelligence agencies from multiple countries have reported an increased Russian campaign of state-controlled sabotage across Europe. This includes covert bombings, arson attacks, and infrastructure damage, often with disregard for civilian casualties. Notable incidents include arrests of two German-Russian nationals plotting attacks on military and logistics sites in Bavaria, a fire at a UK warehouse storing aid for Ukraine with alleged Russian operatives involved, investigations into railway derailments in Sweden suspected to be sabotage, and an attack on Estonia's interior minister's car attributed to Russian intelligence. France also warned of possible sabotage on military sites. Russia is believed to be employing proxies and organized crime groups, coordinating efforts through \"Committees of Special Influence\". The campaign aligns with Russia's broader hybrid warfare including disinformation and hacking. The German domestic intelligence chief Thomas Haldenwang confirmed a heightened risk of sabotage on European soil with significant potential damage. NATO has expressed deep concern about Russia's increasing malign activities on allied territory. Recent suspicious incidents include a major fire at Diehl Metal Applications in Berlin, a factory supplying Ukraine, and a prior unexplained explosion at a munitions factory in Wales also related to Ukraine supplies. Analysts deem these attacks part of a ramped-up effort to disrupt and destabilize Europe, serving as both direct damage and rehearsal for larger immobilization attempts.", "summary_short": "European intelligence warns Russia is intensifying covert sabotage on European soil, involving bombings, arson, and infrastructure attacks targeting military and logistical sites in multiple countries.", "summary_extended": null, "actor_primary": "Russian intelligence operatives", "target_primary": null, "location_text": "Berlin", "location_region": "Berlin", "location_coordinates_lat": null, "location_coordinates_lon": null, "location_precision": "Approximate", "is_aggressor_signal": true, "signal_type": "DEFENSE_PREP_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "The article provides multiple verified examples of Russian covert sabotage attacks and arrests of operatives on European soil marking clear aggressor activity. It also details vigilance and warnings from European intelligence and NATO, indicating defensive preparations and heightened alertness.", "event_time_utc": "2023-05-01T00:00:00.000Z", "end_time_utc": null, "event_time_confidence": "pm24h", "created_at": "2026-02-14T12:22:48.635Z", "updated_at": "2026-11-04T08:36:03.522Z", "reliability_band": "strong", "location_precision_band": "approximate", "time_precision_band": "within_24h", "severity_band": "significant", "attribution_confidence_band": "high", "attribution_basis": "single_source" }