Russian sabotage campaign escalates across Europe in early August

The first half of August 2026 delivered a sequence of events that European security officials had long warned about but hoped would not arrive so quickly. A bomb-laden drone targeted a Ukrainian cargo aircraft at Leipzig airport but failed to detonate. German prosecutors disclosed they had foiled a plan to kill the chief executive of a leading domestic drone manufacturer. An explosion levelled an ammunition plant outside Rome that supplies Ukrainian forces, days after a similar blast hit a Bulgarian factory whose owner had previously been linked to Russian security service targeting. A Spanish Eurofighter on NATO air-policing duties shot down a drone over Romanian airspace; alliance officials assessed it as likely Russian in origin.

From gray zone to open threat

For more than two years, European capitals have absorbed a steady drumbeat of hostile activity: severed undersea cables, GPS jamming across the Baltics, arson at logistics hubs, recruitment of local criminals through encrypted channels. The label "gray-zone warfare" once fitted these operations. It fits less well now. On 12 August, President Vladimir Putin warned of unspecified retaliation against any state that interfered with Russia's so-called shadow fleet of sanctions-busting oil tankers, a direct response to an EU decision allowing the confiscation of Russian oil from designated vessels. Two days later, Foreign Minister Sergey Lavrov widened the threat. "We will adopt much harsher methods to destroy everything that enables the West to fuel Kyiv's war machine," he said in a televised interview. "We are already doing this, and [the Europeans] are already moaning."

The shift in rhetoric is deliberate. Moscow no longer bothers with plausible deniability for every operation. The Leipzig drone carried an explosive charge; the assassination plot in Germany was planned with enough precision to reach a specific individual. Both suggest a decision to accept higher risk of attribution in exchange for greater disruptive effect. German officials have said they are awaiting conclusive forensic proof before assigning blame for the Leipzig incident, a caution Moscow has learned to exploit. Every day spent verifying evidence is a day without a coordinated response.

A playbook written in the Cold War

The current campaign bears the hallmarks of the institution where Putin spent sixteen years. The KGB's First Chief Directorate specialised in what it called "active measures": sabotage, subversion, targeted killings and the cultivation of proxy groups. During the 1970s and 1980s, Soviet handlers supplied weapons and training to the Popular Front for the Liberation of Palestine, the group behind the 1975 OPEC siege in Vienna led by Carlos the Jackal. The East German Stasi, with which Putin liaised during his Dresden posting, channelled support to the Red Army Faction in West Germany. Those operations killed dozens and destabilised democratic governments across the continent.

Ideological constraints have loosened. The Kremlin today works with Iran, recognises the Taliban, and maintains diplomatic channels with Hamas. In 2020, U.S. intelligence concluded that Russian military intelligence offered bounties to Taliban fighters for killing Western troops in Afghanistan. Such networks provide a pool of actors who can be equipped with false documents and directed at European targets without crossing EU borders themselves. An attack on European tourists at a Mediterranean resort would achieve similar political effect to one in a European city, with lower operational risk.

Migration as a lever

Russia has already tested migration pressure as a weapon. In 2015 and 2016, Russian border guards pushed migrants northward into Norway and Finland. Five years later, Belarus, acting with Moscow's backing, engineered a crisis on the Polish and Lithuanian frontiers. The EU responded by fortifying those borders, but the recent discovery of tunnels beneath the Belarus-EU frontier shows the adaptation continues. Libya presents another vector. Russia has built a substantial military presence there supporting Khalifa Haftar, and the country remains a primary departure point for Mediterranean crossings. A coordinated surge in departures, amplified by Russian disinformation channels highlighting government incompetence, would strain European asylum systems and boost anti-establishment parties.

Cyber and physical infrastructure exposed

Critical infrastructure remains vulnerable. In 2022, coordinated cyberattacks hit oil refineries in Belgium, the Netherlands and Germany, disrupting energy supplies for weeks. The EU is rolling out a broad cybersecurity upgrade under the NIS2 directive, but implementation is uneven and the threat is evolving. Days ago, hackers breached Ceva Logistics, one of Europe's largest freight operators, delaying deliveries across the continent. The intrusion coincided with Ukrainian long-range strikes on Russian logistics hubs operated by Wildberries, though no link has been established. What is clear is that offensive cyber capabilities, increasingly assisted by artificial intelligence, are outpacing defensive procurement cycles in Brussels.

Physical targets are equally abundant. Undersea data cables, gas pipelines, liquefied natural gas terminals and rail junctions crisscross the continent with limited monitoring. Poland and the Baltic states have announced enhanced protection for power plants and dams, explicitly citing the risk of false-flag operations designed to implicate Ukraine. Germany's highest-ranking military officer, General Carsten Breuer, told the Wall Street Journal that Russian drone incursions are probing NATO air defences for weaknesses. U.S. intelligence agencies reportedly assess that the Kremlin may be preparing a deliberate provocation, possibly a limited incursion into a difficult-to-defend NATO territory such as the Svalbard archipelago, where Russia maintains a century-old mining presence, to test Article 5 resolve.

Political dividends for the far right

The domestic political calculus is equally consequential. The attack on the Berlin Pride parade in late July, which killed one person and injured twenty-nine, coincided with a measurable rise in polling for the Alternative for Germany (AfD) ahead of critical state elections in September. The AfD and Marine Le Pen's National Rally in France have both received Russian financial and informational support in the past; both oppose military aid to Ukraine. Every incident that fuels insecurity, whether a sabotage attack, a migration surge or a terrorist atrocity, tends to shift voters toward parties promising border closure and an end to foreign entanglements. Moscow understands this dynamic. It does not need to claim responsibility; it only needs to ensure the chaos reaches the evening news.

NATO's credibility gap

The alliance's deterrence rests on Article 5, but its credibility depends on political will. The United States is distracted by a widening conflict in Iran that has consumed presidential attention and military planning bandwidth. European members remain divided over the pace and scale of support for Ukraine, with some governments openly questioning whether a Russian defeat is achievable or desirable. That division is exactly what Moscow seeks to widen. A limited incursion into Svalbard or a cyberattack on a Baltic power grid would force a choice: invoke Article 5 and risk a wider war, or absorb the blow and confirm that the guarantee is conditional. Putin calculates that the latter is more likely.