Margo Palloson, director-general of the Estonian Internal Security Service, told Foreign Policy in an interview published Wednesday that the pattern of Russian-directed sabotage across Europe has shifted. "Initially, these attacks were more against symbolic objects," he said, listing vandalised cars of Estonian opinion-makers, burned Ukrainian flags, and an arson attack on a Ukrainian restaurant. An August attack on the Estonian robotics firm Milrem, which supplies Ukraine's military, marked a departure. "Now the game has changed a little bit — we assess the purpose clearly was to disrupt, restrict, or cancel all the supplies" to Ukraine, Palloson said. Reuters reported this week that Russia has also targeted defence firms in Denmark, another strong supporter of Ukraine. In early August, Russian intelligence operatives attempted an explosive attack on a plane in Germany. The campaign is emerging as a new Kremlin strategy as Ukraine continues to stymie or push back Russian forces on the battlefield. Danish officials have warned that Moscow is likely to escalate hybrid warfare in the coming months.
Estonia warns Russian sabotage in Europe shifting to military supply chains
Counterintelligence chief says attacks move from symbolic targets to disrupting Ukraine aid
Analysis
Why This Matters
- Russia's shift from symbolic to operational targets directly threatens NATO members' ability to sustain military aid to Ukraine, potentially changing the course of the war.
- The attacks on defence firms raise the risk of escalation between Russia and NATO, testing alliance red lines on attacks against critical infrastructure.
- For European citizens, the sabotage campaign erodes daily security as hybrid attacks move from propaganda stunts to physical threats against industrial and transport assets.
Background
Russia has conducted a campaign of low-intensity hybrid warfare across Europe since its full-scale invasion of Ukraine in 2022, including cyber attacks, disinformation, and acts of sabotage. Early operations targeted symbols of support for Ukraine – flags, restaurants, monuments – but Western intelligence agencies have warned for months that Moscow would escalate as its conventional forces struggled on the battlefield. The attack on Milrem in August and reported incidents in Denmark and Germany represent a qualitative change that officials say requires a coordinated Western response.
Key Perspectives
Estonian Internal Security Service: The attacks have moved from symbolic to functional, with the clear aim of cutting Ukraine's supply lines. Palloson framed this as a deliberate escalation by Moscow linked to Russia's battlefield setbacks. Defence industry stakeholders: Companies like Milrem, which produce equipment for Ukrainian forces, now face direct physical threats within NATO territory, forcing them to invest in security measures that raise costs and slow production. Critics/Skeptics: Some European governments have been cautious about attributing attacks publicly, fearing escalation. There is also debate inside NATO about whether existing intelligence-sharing and counter-sabotage mechanisms are sufficient to deter further Russian operations.
What to Watch
- Whether NATO invokes Article 5 or issues a collective warning after a successful attack on a member state's defence industry.
- Additional intelligence assessments, especially from Denmark and Germany, detailing attempted sabotage against military or logistics infrastructure.
- The European Union's ability to tighten sanctions on Russian entities linked to the sabotage campaign and to fund enhanced domestic counter-intelligence capabilities.
Sources
- Russian Sabotage in Europe Is No Longer ‘Symbolic’ — Foreign Policy