Drooid Logo
Back to story perspectives

Full Breakdown

Russia’s Escalating Hybrid Campaign Targets European Defense Assets

8/26/2026, 9:18:18 PM

Recent Wave of Sabotage and Drone Incidents

In the past few weeks coordinated attacks have struck European sites that supply weapons to Ukraine. An explosive-laden drone was discovered at Leipzig Airport in Germany; a Spanish NATO fighter shot down a second drone over Romanian airspace, which officials said was “probably of Russian origin.” Outside Rome, a blast destroyed an ammunition factory that produces shells for Kyiv, and German authorities disclosed a thwarted plot to assassinate the chief executive of a German drone-manufacturing firm.

Other incidents include a fire at Estonia’s Milrem Robotics facility on August 15, an explosion at Bulgaria’s EMCO weapons plant on August 10, and a blast at Italy’s KNDS Ammo plant on August 13. Western intelligence links these events to a Russian-led “hybrid” campaign aimed at undermining European support for Ukraine.

Background: Gray-Zone Warfare Against Ukraine’s Western Backers

European governments have warned that Russia is employing “gray-zone” tactics—actions short of open warfare that seek to destabilize NATO and the EU. The strategy combines sabotage, cyber-attacks, disinformation and the use of encrypted messaging apps to coordinate local networks.

Timeline of Recent Incidents

Timeline of Recent Incidents
Date (occurred)Event
August 10Explosion at EMCO weapons factory in Bulgaria.
August 13Blast at KNDS Ammo plant in Colleferro, Italy.
August 15Fire at Milrem Robotics facility in Tallinn, Estonia.
August 25Finnish Prime Minister Petteri Orpo warned of intensifying hybrid attacks.
Late AugustDrone discovered at Leipzig Airport; Spanish NATO jet downed a second drone over Romania; assassination plot against German drone-company CEO uncovered.

Data & Statistics

  • Three major weapons factories (Bulgaria, Italy, Estonia) suffered explosions or fires within five days.
  • One armed drone was found at a German airport; a second was intercepted over Romanian airspace.
  • Security services in Latvia, Lithuania and Germany have detained multiple suspects linked to the arson and sabotage cases.

Official Statements & Responses

German Chancellor Friedrich Merz said the perpetrators “will pay the price” after the Leipzig drone was uncovered. Finland’s prime minister, Petteri Orpo, told *Iltalehti* that Russia is “acting aggressively” toward states that support Kyiv. A NATO spokesperson identified the downed Romanian-airspace drone as “probably of Russian origin.” The German defense ministry warned that Moscow is using drone incursions to probe NATO air defenses.

Conflicting Reports & Gaps

German authorities have not officially attributed the Leipzig drone to Russia, though media investigations suggest Moscow’s involvement. Lithuanian prosecutors have linked the German drone case to a 2024 DHL parcel-detonation plot, but direct evidence of state involvement remains absent. The fire at Milrem Robotics is under investigation; Latvian officials have detained nationals, but a definitive Russian command link has not been proven.

Verbatim Quotes

  • “NATO, European and national responses have largely been reactive and defensive,” — Agnia Grigas, Atlantic Council, Vilnius
  • “Russia’s ongoing hybrid warfare in Europe is a highly coordinated, sub-threshold campaign aimed at destabilizing Western political systems, fracturing NATO and EU unity, and eroding support for Ukraine,” — Alex Kokcharov, Bloomberg Economics, London
  • “Russia is willing to use kinetic means because until now they have been unsuccessful in discouraging support for Ukraine,” — Marek Kohv, International Centre for Defense and Security

What’s Next

European officials say the EU is drafting a sanctions package targeting “hundreds of individuals and entities” linked to the sabotage campaign, with adoption expected in the fall. NATO members have pledged to maintain “at least equivalent” military aid to Ukraine in 2026 and 2027, and intelligence sharing and tighter border security are being discussed to prevent further sub-threshold attacks.