Moscow is trying to intimidate the heads of European defense companies that supply weapons to Ukraine. One of the many examples of this was a provocation involving the appearance of funeral wreaths and photographs of company executives with black ribbons outside the offices of defense companies in Lithuania and the Czech Republic. It is telling that the mourning symbols appeared almost simultaneously at both locations, suggesting the action was coordinated. In Lithuania, law enforcement officials are already investigating the possibility of involvement by Russian intelligence agencies.
The European defense industry, which after 2022 began ramping up production and creating long-term arms programs for Ukraine, has become a strategic problem for the Kremlin. Europe is building an industrial system capable of supplying Ukraine for years to come. It is precisely this system that Russia is now trying to disrupt using hybrid methods.
And as the new wave of incidents shows, Russia is shifting from sporadic provocations to a systematic hybrid campaign against the EU’s military-industrial complex. In addition to sabotage and subversion, another element has emerged—direct pressure on the heads of defense companies. Read more about the intensification of such hybrid attacks against arms manufacturers for Ukraine in this UA.News article.
Moscow’s
“List of Potential Targets” and Direct Threats
On August 28, Russian Foreign Ministry spokesperson Maria Zakharova stated that the Russian military could strike British military facilities in response to Ukraine’s use of British Storm Shadow missiles.
“We have repeatedly warned that any British military facilities in Ukraine and beyond its borders could be targeted in response to Ukrainian strikes using British weapons on Russian territory,”Zakharova said, commenting on the decision by the British and French governments to transfer technology and licenses to Ukrainian manufacturers for the production of SCALP/Storm Shadow long-range missiles.
Earlier, on April 15, 2026, the Russian Ministry of Defense published two lists of European companies that, according to the Kremlin, are involved in the production of attack drones for Ukraine. One list included the “addresses” of 11 companies allegedly located in the following cities: London (United Kingdom); Vilnius (Lithuania); Prague (Czech Republic); Munich (Germany); and Riga (Latvia).
The second list names companies that allegedly manufacture components for drones. It includes 10 companies with production facilities located, among other places, in Spain, Italy, and even Israel. However, journalists later discovered that some of the “intelligence data” provided by the Russians regarding these companies was fabricated, and that the listed “addresses” were actually residential buildings.
Commenting on the published “list of addresses,” Dmitry Medvedev, deputy chairman of the Russian Security Council, stated that the published addresses constitute a “list of potential targets for the Russian armed forces.”
“Whether the strikes become a reality depends on what happens next. Sleep soundly, European partners!” Medvedev wrote on social media.
Direct threats against Western arms manufacturers have been voiced not so much by Vladimir Putin himself as by Medvedev, Zakharova, Peskov, and other representatives of the Russian regime.
Putin himself continues to publicly describe Western arms supplies as a factor that directly draws NATO into the war. In other words, if a Western country helps Ukraine produce long-range weapons, it itself becomes part of a potential Russian response.
Obviously, the Kremlin’s aggressive rhetoric does not imply direct missile strikes on NATO factories. Instead, Moscow is ramping up hybrid pressure in an attempt to resolve a problem it cannot overcome by military means.
Putin Is Escalating the Hybrid War
Over the next two years, Russian dictator Vladimir Putin is likely to escalate his hybrid war campaign against NATO members into a full-scale operation, according to Western analysts. This approach would be in line with the Russian military doctrine known as “New Generation Warfare.” Its authorship is attributed to Valery Gerasimov, Chief of the General Staff of the Russian Armed Forces. According to this doctrine, the role of non-military means in achieving political and strategic goals is growing and even surpasses the effectiveness of military force.
In the event of a full-scale “New Generation War” against the West, individual hybrid attacks—information operations, cyberattacks, acts of sabotage, and subversion—will be carried out on a larger scale as a coordinated pan-European campaign. And pressure on European arms manufacturers will become systematic.
In 2026, the European defense industry had already faced a growing number of fires, explosions, and arson attacks. Most of these incidents were recorded at facilities producing weapons, ammunition, and drones for Ukraine. Western intelligence sources are increasingly viewing these incidents as part of a Russian campaign aimed at disrupting military equipment supply chains, intimidating manufacturers, and testing how far Moscow can go in its actions on NATO territory without provoking a collective response.
In August 2026, as the Kremlin escalated the war in Ukraine, there was a surge in acts of sabotage and disruption targeting Ukrainian partners among European defense companies.
Milrem Robotics (Estonia). In mid-August, a fire broke out in Tallinn at a building used by the Estonian defense manufacturer Milrem Robotics. The company produces robotic ground systems for the Ukrainian Armed Forces. Estonian law enforcement began investigating the possibility of arson, and Prime Minister Kristen Michal stated that a possible Russian involvement was among the main lines of inquiry. Suspects were identified.
However, the outcome turned out to be the opposite of what the saboteurs might have expected. Milrem Robotics CEO Kuldar Värsi stated that the incident did not affect production, supply chains, or the delivery schedule to Ukraine. The company plans to continue operations.
Skyeton (Slovakia). On August 27, law enforcement uncovered plans to set fire to a facility belonging to the Ukrainian drone manufacturer Skyeton. According to reports on the investigation, three foreigners were detained—two in Slovakia and one in Germany. Investigators are considering the possibility that the attack was commissioned by Russian intelligence services. During the arrests, materials and items that could have been used to prepare the arson were seized.
KNDS (Italy). On August 13, an explosion occurred at the KNDS Ammo Italy facility in Colleferro, near Rome. The plant manufactures ammunition for land and naval systems, as well as solid rocket propellant. The explosion was very powerful, but since a significant portion of the employees were on vacation, there were no casualties. Italian law enforcement agencies have begun investigating the causes of the explosion.
KNDS Ammo Italy is part of the KNDS Group, a European defense company formed following the merger of Germany’s Krauss-Maffei Wegmann and France’s Nexter Systems. In October 2024, KNDS announced that it was opening a branch in Ukraine.
EMCO (Bulgaria). On August 10, a fire broke out at the Bulgarian EMCO facility. The fire reached an ammunition storage area, triggering a chain reaction of explosions. Explosions had already occurred at facilities belonging to EMCO, a company that supplies weapons to Ukraine, in 2022 and 2023.
Drone with explosives at Leipzig Airport. On August 4, a drone carrying explosives was discovered near a Ukrainian transport plane at Leipzig Airport in Germany. The airport is a key logistics hub, particularly for military transport. Investigators later found another drone and approximately 50 grams of a substance identified as explosives. Investigators considered several theories, including a possible Russian connection. However, as of the end of August, the German government had not yet announced a final official conclusion. Chancellor Friedrich Merz stated that Berlin is preparing a response once those responsible have been identified. Interior Minister Alexander Dobrindt described the situation as a hybrid attack scenario.
Following this incident, Celine Burton, head of the French counterintelligence service DGSI, warned that France must prepare for possible direct and violent hybrid attacks on its territory.
“All of this is part of the beginning of a war that is not a physical war, not a military war, one that is not necessarily publicly acknowledged, but which already includes attacks on our country,” Burton said in her remarks at a meeting with business leaders.
The
Next Stage: Personal Threats
In July 2024, U.S. media outlets, citing U.S. intelligence, reported that Russian authorities had ordered the assassination of Armin Papperger, CEO of Rheinmetall, a German manufacturer of ammunition and military equipment for Ukraine. German intelligence agencies were alerted in time and foiled the assassination attempt.
Western intelligence agencies viewed this incident as part of a broader Russian campaign. It was noted that the Russians planned to kill several defense industry executives across Europe whose companies were assisting Ukraine. As early as two years ago, intelligence data indicated that the Russians were prepared to kill individual EU citizens to achieve their goals in the “shadow war” that the Kremlin is waging in the West.
The provocation involving the appearance of funeral wreaths and photographs of company executives wearing black ribbons outside the offices of defense companies in Lithuania and the Czech Republic likely served as a
reminder of this Russian special operation.
Footage taken in Vilnius has been circulating on social media, showing several mourning wreaths near the building of RSI Europe, a company that manufactures unmanned aerial systems. A photograph of the company’s CEO, Tomas Milasauskas, wearing a black mourning ribbon was placed nearby. Milasauskas himself is alive and well. He described the incident as an attempt at intimidation. According to the head of RSI Europe, this is the first time the company has faced such a threat. However, the company has previously been the target of cyberattacks.
In Lithuania, law enforcement officials are investigating the possibility that Russian intelligence services were involved in the incident.
The story of Emilian Gebrev, the owner of the Bulgarian company EMCO, is also
telling. He previously stated that in April 2015, agents of Russia’s GRU attempted to poison him in the city of Burgas, where he lived. Forensic analysis determined that a “Novichok”-class substance was used in the attempt on the businessman’s life. Gebrev linked the attempt to his company’s involvement in supplying weapons to Ukraine, as well as to possible Russian interest in his business.
The
Kremlin Is Raising the Stakes on Aid to Ukraine
The destruction of a single factory in a European country is unlikely, on its own, to change the situation on the Ukrainian front. The Russian strategy follows a different logic. Numerous acts of sabotage and intimidation can sow fear, increase security costs for critical facilities, and weaken and slow down supply chains. In other words, the main goal is to raise the cost of supporting Ukraine.
Western counterintelligence agencies have already warned defense companies about the heightened threat of Russian espionage and sabotage. In June 2026, Warsaw presented a special White Paper on Russian Acts of Sabotage and Subversion to its partners in the Baltic region.
This analytical report discusses attacks on critical infrastructure, GNSS jamming, cognitive operations, and other forms of Russian subversive activity.
Importantly, every act of sabotage by the Russian Federation simultaneously serves as an argument in favor of increasing European defense budgets. Meanwhile, European defense companies are not leaving the Ukrainian market but are expanding their production. Rheinmetall continues to invest in expanding its armored vehicle production. In late August, the company announced an investment of approximately €270 million in Kassel, including the expansion of tank production and the creation of a new logistics center. BAE Systems is raising its production forecast, Milrem continues to supply equipment, and the United Kingdom and France are transferring technology to Ukraine for the production of long-range missiles.
