At first glance, the modest trading company with a registered address in one of Vienna’s business districts appeared indistinguishable from thousands of other European B2B intermediaries. The absence of significant advertising, a minimal staff and a concise website created the typical profile of a small intermediary structure. However, behind this neutral façade was one of the key nodes of a large international network established for the sole purpose of supplying the Russian defence-industrial complex with high-precision European machine tools and equipment in violation of the European Union’s existing embargo.
In August 2026, the Austrian Directorate of State Security and Intelligence (DSN), together with the Vienna Public Prosecutor’s Office and with the support of the WEGA special police unit, completed a multi-year operation to dismantle this logistics channel. According to the investigation, the Austrian “hub” and a chain of front companies in eight countries were used to supply CNC machine tools and specialised equipment for high-precision metalworking to entities linked to the Russian state-owned corporation Rostec. The equipment was used at Russian defence-industrial enterprises to manufacture engines for cruise missiles, combat aircraft and advanced air-defence systems. Commenting on the outcome of the operation, Austrian State Secretary for Intelligence Jörg Leichtfried stressed that the diversion of European technologies to the production of missiles and air-defence systems was unacceptable and that the authorities would continue to prevent attempts to circumvent export restrictions.
To circumvent EU export controls, the organisers of the scheme developed a sophisticated multi-layered system for concealing shipments, payments and accompanying documentation. The logistics chain was based on the use of Austria as a formally “clean” procurement point. European manufacturers of high-tech equipment sold their products to an Austrian legal entity in accordance with local legislation and may not have been aware that the ultimate recipients were enterprises belonging to the Russian defence sector. Following procurement in Austria, the scheme involved an extensive network of front and transit companies in eight countries, including Türkiye, the United Arab Emirates, Hong Kong, Belarus, Kyrgyzstan, South Korea, as well as EU member states Poland and Lithuania. One of the principal mechanisms used to circumvent sanctions was the systematic falsification of End-User Certificates. Customs declarations stated that the machine tools were destined for third countries, for example for civilian industrial use in Türkiye or South Korea, whereas the shipments were ultimately redirected to Russia.
After the EU tightened monitoring of direct exports, Hong Kong and Türkiye became key transit and document-reprocessing hubs, while companies in Poland and Lithuania enabled the equipment to be moved within the EU’s single customs territory before being exported onward. The ultimate recipients of the equipment were enterprises directly belonging to, or closely associated with, the Russian state-owned corporation Rostec.
The “Vienna hub” had been operational for several years, indicating that the infrastructure for exporting dual-use goods had been established well in advance. During this period, the scheme evolved from individual purchases into systematic industrial-scale supplies.
The organisers registered the legal entity in Vienna in 2019, while equipment procurement began even before Russia’s full-scale invasion of Ukraine. Between 2022 and 2026, the confirmed value of equipment and tools supplied to Russian defence-industrial entities through the network exceeded EUR 3.3 million, while the company’s turnover directly in Austria amounted to more than EUR 700,000.
The investigation entered an active phase on 20 August 2025, when the Vienna Public Prosecutor’s Office, the DSN and WEGA conducted searches at four sites in Austria, seizing approximately 40 digital storage devices and original documentation. A year later, on 13 May 2026, the key suspect — a 28-year-old Belarusian citizen who served as the company’s director and co-owner — was arrested. On the day of his arrest, law-enforcement authorities seized from warehouses a shipment of CNC equipment and specialised tools ready for dispatch, valued at approximately EUR 140,000.
On 12 August 2026, the Vienna Regional Court handed down a conviction against the 28-year-old principal organiser, sentencing him to 21 months’ imprisonment, of which 19 months were suspended. He pleaded guilty and stated that he had acted on the instructions of his father and uncle, who worked for a Russian company. His 24-year-old cousin, who was responsible for accounting and logistics, was sentenced to 15 months’ imprisonment, also suspended. Both defendants waived their right to appeal, making the convictions final.
The two young Belarusian nationals therefore served as nominal owners and operational managers of the structure. According to the assessment of the relevant authorities, the organisation conducted no independent economic activity in Austria other than transactions associated with the transit and processing of dual-use goods. According to the investigation, the principal role was played by the main suspect’s father and uncle, who were based in Russia, maintained direct contacts with Rostec enterprises, prepared technical specifications and provided financing. Their younger relatives, holding Belarusian passports and European residence permits, registered legal entities and opened bank accounts in Vienna. DSN Director Silvia Mayer noted that the case clearly demonstrated the capabilities of international networks and the readiness of the security services to identify and dismantle such structures.
The Vienna hub case exposed several vulnerabilities in the EU’s export-control system. High-precision CNC machine tools and carbide tooling are classified as dual-use goods and can formally be used in civilian manufacturing. Consequently, without effective verification of end users directly at enterprises in third countries, the End-User Certificate system remains vulnerable to manipulation. At the same time, the use of internal EU logistics, including companies based in Poland and Lithuania, demonstrates that organisers of such schemes actively exploit the free movement of goods within the single market before their onward export outside the bloc.
For a long time, Austria was regarded as a vulnerable link due to the significant level of its economic and political ties with Russia. However, the DSN investigation and the 12 August 2026 convictions signal that the Austrian authorities are stepping up efforts to prevent their territory from being used as a transit platform for supplying the Russian defence industry. More broadly, the dismantling of the Vienna network and the prosecution of its participants have established an important precedent while raising a wider question for Europe: how many similar small companies, formally registered to nationals of third countries, continue to operate within the EU and supply high-tech equipment to Russia’s defence industry under the guise of civilian orders? Addressing this challenge requires stronger end-user verification, tighter controls on the re-export of dual-use goods and enhanced financial monitoring of intermediary companies.