Jens Asbjørn Bøgen
Covert attacks on Russian rail lines, power grids, and enlistment centers have spiked 88% in 2026, with open-source investigators logging 242 strikes through October alone.
When shadow wars spill across borders, nobody stays safe. Across Europe, quiet industrial towns and corporate hubs have suddenly found themselves navigating an eerie, undeclared battleground.
It is an uncomfortable reality that shakes security planning to its core. But the hybrid battleground is not exclusive to European soil, as an investigation shows that sabotage inside Russia has nearly doubled this year compared to 2025—even though the year is not over yet.
Factories under fire
The OSINT group InformNapalm has investigated sabotage missions in both European countries and inside Russia, and it probably comes as no surprise that suspected Russian sabotage acts in Europe are on the rise.
Back in August, an unexpected blaze ripped through an Estonian facility operated by Milrem Robotics, a firm that manufactures robotic vehicles for Ukrainian troops. Tallinn later announced that Russian intelligence had commissioned the attack, prompting diplomats to lodge formal protests.
Romania faced a similar scare just weeks later when flames broke out near the Carfil defense plant in Brasov. The Romanian Intelligence Service subsequently revealed that it had uncovered a Russian-directed ring planning broader hits against industrial infrastructure across the continent. Such episodes illustrate how arms makers have become prime targets for disruption.
These operations are not isolated incidents. Researchers at the International Centre for Counter-Terrorism and GLOBSEC recently logged more than 180 suspected Russian sabotage efforts since the full-scale war began.
An October report from the Stockholm Centre for Eastern European Studies confirmed that Moscow is deliberately targeting suppliers to strangle military aid heading to Kyiv.
Flames inside Russia
Yet the quiet war is no longer moving in one direction. According to InformNapalm, at least 242 sabotage strikes hit Russian territory during the first ten months of this year alone. That single figure surpasses the combined total recorded across 2024 and 2025, representing a sharp 88 percent spike.
InformNapalm has tracked 569 such strikes since February 2022. Underground operatives have set fire to railway relay boxes, blown up communication masts, and torched military draft offices in dozens of regions. Crucially, the figures exclude conventional military strikes, tracking only covert underground actions.
Those disruptions continue to escalate. On November 4, partisans from the Ukrainian group ATESH claimed they wrecked an electrical substation powering a major aircraft factory in Voronezh. Not all of it comes from Kyiv, however. InformNapalm pointed out that many attacks appear to be autonomous actions carried out independently by local resistance groups.
Cameras and chaos
Sabotage is cheap, but panic travels fast. Russian covert operations often rely on low-cost tactics designed to trigger outsized psychological shock. In Poland, state prosecutors indicted five individuals after discovering that operatives were instructed to record commercial fires on their phones.
Another suspect was dispatched directly to the Marywilska shopping complex in Warsaw to record a massive inferno as emergency crews arrived. Investigators concluded that filming the destruction was never an afterthought, but rather a core requirement of the mission. Footage captured at stores in Warsaw and Vilnius was promptly turned over to Russian handlers for online propaganda.
The chaos does not stop at physical fires. Following railway damage in late 2025, Polish digital authorities uncovered coordinated online campaigns aimed at deflecting blame toward Ukrainian refugees. Ukraine’s foreign intelligence agency later warned that hostile networks regularly exploit vulnerable individuals to execute dangerous assignments on European soil.
Shifting the burden
Russia’s burning home front is reshaping European strategy. In a March policy paper titled “From Shield to Sword,” the European Council on Foreign Relations argued that purely passive defense is no longer enough to protect the continent. Simply guarding individual factories will never stop an adversary from organizing fresh attacks.
Financial networks offer another angle. Analysts at the Royal United Services Institute pointed out that payment channels used to hire low-level saboteurs can be proactively identified and frozen.
As Stockholm Centre for Eastern European Studies researcher Minna Alander warned, classical deterrence fails against covert operations, requiring sustained pressure that steadily raises costs for Moscow.
Ukraine’s experience offers a practical path forward. Supporting targeted disruptions against lawful military facilities inside Russia forces the Kremlin to pull vital resources away from offensive campaigns to guard its own backyard. When rear installations burn, the true price of war becomes impossible for Moscow to ignore.
