The morning of 7 October 2026 began with another escalation and a statement from the Russian Ministry of Defence reporting a “massive strike” using long-range precision weapons and unmanned aerial vehicles against key facilities of Ukraine’s military-industrial complex. The main targets this time were the production capacities and warehouses of the company Fire Point, which specialises in manufacturing Flamingo FP-5 cruise missiles and strike drones. Strikes were also carried out against enterprises and logistics hubs in the Chernihiv, Kirovohrad, Dnipropetrovsk, Poltava and Kharkiv regions, as well as port infrastructure in the Odesa region.
This is merely one episode in the ongoing campaign against Ukraine’s defence industry, yet behind this now “standard” combat report lies a dangerous trend that extends beyond Ukraine’s borders. Exactly one week before this massive missile strike, on 30 September 2026, Russian Foreign Ministry spokesperson Maria Zakharova issued a stern warning to European states. Commenting on international discussions about the possible launch of production of missiles for Patriot air-defence systems on Polish territory, she stressed that any factories outside Ukraine manufacturing weapons for Kyiv are regarded by Moscow as potential legitimate military targets. Zakharova specifically noted that those who believe defence enterprises on the territory of NATO member states are completely safe are mistaken.
This statement was not some “sudden turn”; it marked the logical conclusion of a transformation in Russian military strategy. From 2022 to 2024, Moscow’s main efforts were focused on destroying Ukraine’s energy network and basic defence-industry facilities directly in the conflict zone. By 2025–2026 this policy had evolved into the targeted dismantling of production chains inside Ukraine and, increasingly, supply chains from Europe. It then crossed the borders of the European Union, but lacking the ability to carry out direct missile strikes on EU and NATO countries without risking the triggering of Article 5 on collective defence, the Kremlin shifted to a full-scale hybrid war and sabotage on the territory of supplier countries.
According to the Kyiv-based Sahaidachnyi Security Center, an independent Ukrainian analytical centre in the security and defence sector, at least 522 incidents were recorded in Europe between 24 February 2022 and autumn 2026 that were either officially attributed to Russia or matched a characteristic pattern. Two spikes occurred in spring 2024 and autumn 2025; in 2026 Russian activity in Europe has remained high.
August 2026 was particularly intense. On 4 August, drones carrying military-grade explosives were discovered at Leipzig/Halle Airport in Germany; one of them was located near a Ukrainian transport aircraft. Had the devices detonated, the consequences could have been severe. Following an investigation, German authorities officially attributed responsibility to Russia.
On 10 August a powerful fire and explosion occurred at a warehouse of the Bulgarian company EMCO in Tryavna, one of the largest private manufacturers of 155 mm artillery ammunition. The company stated that human error had been ruled out.
On 13 August in Italy a major fire destroyed part of the infrastructure of the KNDS Ammo Italy plant in Colleferro near Rome, which produced a similar range of shells. Prosecutors opened the case into possible external interference.
On 15 August a building belonging to the Estonian company Milrem Robotics, known for its advanced developments and supplies of ground robotic systems and drones for the Ukrainian army, caught fire in Tallinn. Estonia’s internal security service and the Lithuanian Foreign Ministry linked the arson to Russian special services; three individuals were detained in Latvia on suspicion of involvement.
At the end of August several incidents occurred in Poland. An arson attack was recorded at the WB Group enterprise, which manufactures components for drones; according to the prosecutor’s office the damage amounted to at least €3.5 million. Prime Minister Donald Tusk described these events as planned escalatory actions by Russia.
Earlier, in 2025–2026, an attempted arson at the Slovak drone manufacturer Skyeton was recorded, along with incidents at Czech enterprises producing optics and unmanned aerial vehicles, plots against executives of the German concern Rheinmetall that demonstrated Russia’s readiness for personal terror against the top management of Europe’s defence industry, and the recruitment of citizens to gather information and prepare sabotage at defence facilities in Denmark. Danish intelligence warned that Russia was preparing acts of sabotage against the country’s defence industry. The special services of the Czech Republic and Slovakia also recorded large-scale attempts to recruit local residents via anonymous messenger channels to carry out diversions and sabotage at local factories and warehouses.
In parallel, violations of NATO airspace increased, as did the use of reconnaissance drones, cyberattacks on energy and transport infrastructure, and attempts to damage railways.
Thus, Russia is consistently pursuing the line that any supply of weapons to Ukraine makes the supplying country a participant in the conflict. Even earlier, Deputy Chairman of Russia’s Security Council Dmitry Medvedev published “registries” of European enterprises linked to the production of drones for Ukraine, labelling them potential targets. The rhetoric has now become even more open.
The unfolding Russian hybrid campaign is producing tangible socio-political and economic consequences for the entire European continent, and tensions between Moscow and European capitals have reached a peak. European capitals are responding with growing concern. French President Emmanuel Macron stated that “no one is safe”. Polish Prime Minister Donald Tusk spoke of possible plans for attacks on European territory. German, Danish, Estonian and Polish special services are recording an intensification of hybrid activity and warning that the threshold may be crossed. EU Commissioner for Defence Andrius Kubilius noted that a strike on a factory on the territory of a NATO country would mean the application of Article 5. European Commission President Ursula von der Leyen called for a rethinking of conceptual approaches to the security of the defence-industrial sector. For European business, the sabotage activity has resulted in a sharp rise in the costs of physical security, cybersecurity and insurance of defence-industry facilities. Insurance companies have either significantly raised premiums for enterprises working on Ukrainian orders or are refusing altogether to cover risks associated with hybrid attacks and sabotage.
At the same time, there have so far been no direct missile or air strikes by Russia against European enterprises. Moscow is operating through hybrid instruments such as arson, drones, the recruitment of local perpetrators and cyberattacks, thereby preserving space for denial and not crossing the formal threshold of open armed conflict with NATO.
European society and NATO leadership now face a fundamental question: where exactly is the line beyond which hybrid sabotage will no longer be perceived as actions “below the threshold” of open military conflict. There is as yet no answer, but the number of incidents, the specificity of the threats and the geography of the attacks show that the “front” has moved beyond Ukraine’s borders, and the Kremlin’s strategy is calculated on the assumption that constant fear of escalation and physical threat on EU territory will reduce Europeans’ willingness to invest in joint defence projects with Ukraine.
