The last week of August 2026 kept Polish firefighters in Skarżysko-Kamienna and Lublin occupied. Two separate sites, one belonging to a drone manufacturer, the other to a defence contractor, were set ablaze within days of each other. A few years ago, such incidents would have dominated headlines for weeks. Now they barely register as outliers. They are instead the latest entries in a lengthening ledger of sabotage, arson and aerial intrusion stretching from the Baltic states through Poland and Slovakia to the heart of Germany.
Germany breaks silence on Leipzig airport drones
The most consequential development came on Tuesday, when the German government formally blamed Russia for drones carrying explosive payloads that disrupted operations at Leipzig/Halle airport. The incident, which occurred earlier in the month, had been treated initially as a safety investigation. Berlin's decision to attribute responsibility publicly marks a departure from the cautious language European capitals have preferred since the war in Ukraine began. German officials declined to specify which agency or unit they believe was responsible, but the accusation aligns with patterns identified by Western intelligence linking similar operations to the GRU's Unit 29155, the same formation implicated in the 2018 Salisbury poisoning and the 2014 Vrbětice ammunition depot explosions in the Czech Republic.
Leipzig/Halle is no ordinary regional airport. It serves as a primary logistics hub for NATO's eastern reinforcement routes, handling heavy transport aircraft moving equipment and personnel toward the alliance's forward-deployed battlegroups in Poland and the Baltic states. A successful attack there would have disrupted not just civilian aviation but the military supply chain that underpins NATO's deterrence posture. The fact that the drones carried explosives, and were intercepted before they could detonate, suggests an operation calibrated to signal capability without triggering Article 5.
Poland's railway bombing remains the benchmark
Poland has borne the brunt of this campaign. The most serious incident to date occurred in November 2025, when explosives detonated on the railway line between Lublin and Warsaw. That corridor is the single most important rail artery linking central Poland with Ukraine, carrying both military aid and civilian traffic. The device exploded between trains. Had it gone off under a moving convoy, the casualties, military and civilian, could have been substantial. Polish prosecutors opened a terrorism investigation but have not publicly identified a state sponsor. The modus operandi, target selection and timing, however, match the GRU's known playbook: deniable, disruptive, aimed at the logistics sustaining Ukraine's defence.
The late-August fires in Skarżysko-Kamienna and Lublin fit the same pattern. Both facilities are involved in unmanned aerial systems production, technology that has become decisive on the Ukrainian battlefield. Russian intelligence has repeatedly targeted Western drone supply chains, from cyber intrusions against manufacturers to physical attacks on storage depots in Romania and Bulgaria in 2024. The Polish internal security agency (ABW) has not released its findings, but the coincidence of two defence-sector fires in a single week stretches probability well beyond accident.
Estonia's Milrem Robotics and the Baltic dimension
Estonia has not been spared. Milrem Robotics, the Tallinn-based developer of the THeMIS unmanned ground vehicle used by Ukrainian forces, suffered a fire at its production facility earlier in the summer. The company supplies NATO armies as well as Ukraine. Estonian authorities have been notably reticent about the cause, but the government's own threat assessments, updated in March 2026, explicitly warned of increased Russian sabotage activity against defence industry targets. The International Centre for Defence and Security in Tallinn, where Meelis Oidsalu works, has tracked a steady rise in hybrid incidents since 2023: GPS jamming across the Baltic Sea, undersea cable damage, recruitment of local criminals for arson and vandalism. Oidsalu's assessment, that the campaign represents a horizontal escalation broadening both methods and frequency, reflects a consensus among Baltic security services that Moscow has shifted from probing to sustained pressure.
Slovakia and Moldova expand the geography
The geography of the campaign extends beyond NATO's immediate eastern border. In Slovakia, police foiled an attempt to set fire to a facility linked to a Ukrainian-founded drone manufacturer. Slovak authorities have not attributed the plot, but the target, a company producing systems for Ukraine's armed forces, mirrors the Polish and Estonian cases. Moldova, meanwhile, reported a drone crash near Chișinău airport in August. The device, identified as a Russian-made Orlan-10 reconnaissance UAV, had likely strayed from operations over Ukraine but its presence in Moldovan airspace underscores the permeability of the region's borders and the difficulty of distinguishing spillover from deliberate provocation.
US intelligence warnings and the Ratcliffe visit
Anxiety in Western capitals spiked after CIA Director John Ratcliffe's visit to Moscow in late August, the first such trip by a sitting CIA chief since 2021. The meeting's agenda was not disclosed, but US intelligence subsequently briefed allies that Russia may be preparing a more serious hybrid provocation, possibly including a limited incursion onto NATO territory. The briefing, described by one European official as "sobering but not predictive," suggested the Kremlin is testing the alliance's red lines. Ratcliffe's Moscow trip has been interpreted variously as a channel for crisis management, a warning delivery, or an intelligence-gathering opportunity. What is clear is that the US assessment has shifted from monitoring to anticipation.
Counter-intelligence gaps and the attribution problem
The wave of incidents exposes a structural weakness in NATO's hybrid defence. Attribution remains slow, fragmentary and often political. Germany's Leipzig statement took weeks. Poland's railway bombing investigation has yielded no public conclusion after ten months. Estonia's Milrem fire remains officially unexplained. The alliance's Centre of Excellence for Hybrid Threats in Helsinki compiles data but has no operational authority. National services, ABW in Poland, VSD in Lithuania, KAPO in Estonia, operate with varying resources and legal frameworks. Russia exploits these seams, using cutouts, criminal gangs and proxy actors to maintain deniability. The result is a campaign that inflicts cumulative damage without crossing the threshold that would compel a collective NATO response.
People mentioned
-
Meelis Oidsalu
Organisations
NATO · Central Intelligence Agency · German Federal Government · Polish Fire Service · Slovak Police Force · Milrem Robotics
