Putin ordered sabotage campaign against NATO countries, intelligence assessment concluded

U.S. agencies traced an escalated campaign of sabotage and covert action against NATO states to a direct order from Vladimir Putin, European officials briefed on the findings told the Wall Street Journal. Prosecutors in Germany, Romania, Poland and Serbia now hold the hired hands, and Western intelligence names a GRU colonel behind the August bomb drone at Leipzig/Halle airport. Russia denies all of it.

U.S. intelligence agencies concluded that Vladimir Putin personally ordered an escalated sabotage campaign against NATO countries that opened with an August bomb-drone attack at Leipzig/Halle airport, European officials told the Wall Street Journal.

The officials tied the order to frustration in the Russian leadership over the summer, when neither the fighting nor talks with the Trump administration moved Ukraine toward Putin's terms. After the Leipzig drone failed, an official in the Russian presidential administration who serves as a back channel to the German government told his counterpart that it would not be the last attack, according to the Journal. The U.S. assessment has reached the public only through officials speaking to the paper, and Russia denies running any sabotage in Europe.

Romania's intelligence service said on 26 October that a network coordinated from Russia caused the 14 September fire beside the Carfil arms factory in Brașov, and prosecutors found two of its three suspects already in German custody. Germany's government has formally blamed Russia for Leipzig, where a drone carrying about 1.8 kg of Semtex reached a Ukrainian Antonov An-124 on 4 August. The governments of Estonia, Poland and Romania have blamed Russian intelligence for fires at defence and communications sites.

Estonian, German, Polish and Romanian findings describe a hostile state service attacking the supply lines of Ukraine's defence on EU and NATO territory through hired proxies. Court records and investigation files reported in Germany add a Serbian courier paid €500 to move a combat drone, a Belarusian identified by DNA on a drone control antenna and a sanctioned colonel of the GRU, Russia's military intelligence service.

The reported order

Aides to Chancellor Friedrich Merz told the Journal that heavy casualties at Leipzig would have led them to consider invoking NATO's Article 5. CIA Director John Ratcliffe travelled to Moscow in late August and afterward warned European intelligence chiefs that sabotage was intensifying, people who received the warnings told the paper.

Ukraine's military intelligence agency, the HUR, said on 2 October that Russia had tasked its services with hybrid operations in EU and NATO states against military sites, infrastructure, communications and Starlink ground stations. On 23 October it said Russia was preparing provocations in Central and Eastern Europe that it would blame on Ukraine. One published version of that statement, carried by Dengi.ua, adds that the HUR intercepted a direct order from Russia's top leadership in early October.

The GRU is the Main Directorate of the General Staff of the Russian armed forces, whose supreme commander under the Russian constitution is the president. The UK government, announcing its 4 December 2025 sanctions on GRU officers, said the Dawn Sturgess Inquiry had found that Putin himself authorised the GRU's 2018 Novichok operation in Salisbury.

The Brașov fire

The fire broke out on the Carfil industrial platform in Brașov, next to CARFIL SA, a subsidiary of the state arms group Romarm, and burned the offices of several companies on the site. The Romanian Intelligence Service (SRI) said investigators had confirmed that citizens of former Soviet states living in EU countries took part, and that their coordinators in Russia had given the network a regional target list of state and private arms plants and other military and industrial sites. It said investigators had found other attempts this year against Romanian targets, including sites used to train Ukrainian forces.

The Directorate for Investigating Organised Crime and Terrorism (DIICOT) identified the three suspects as two Belarusians and a Ukrainian and obtained European arrest warrants from the Bucharest Court of Appeal for attempted acts of sabotage, the directorate said. The Belarusians, aged 39 and 50, have been held in Germany since early October on suspicion of attempted arson against a railway line and a power line in Bavaria, Welt and Der Spiegel reported. Polish police detained the Ukrainian, Artem S., 25, in Warsaw's Ursus district, and a Warsaw court ordered him held for seven days while he contests surrender, the Warsaw regional prosecutor's office said.

Carfil's director, Mircea Petru Tanțău, told Antena 3 the factory had received warnings in March that it would be targeted in August. Recruiters approach people on social networks, the SRI said in its 26 October statement, pay them first to watch or photograph a site, then push them toward arson, destruction or murder, and blackmail those who refuse. Members travel, sleep and pay under other people's names and use SIM cards from third countries and encrypted messaging apps.

Romania's foreign ministry summoned the Russian ambassador on 27 October and said the evidence gathered by investigators had proven Russian responsibility. Foreign Minister Dan Neculaescu said the fire was part of a campaign across Europe against military production. The Russian embassy in Bucharest wrote on Facebook the same day that no evidence had been presented and called the accusations "calomnioase", or slanderous.

Leipzig

Germany's Federal Prosecutor took over the Leipzig case on 6 August. Its statement says that on the evening of 4 August a drone fitted with professional explosive and a detonator was meant to set off a blast on the airport grounds, and that a cargo aircraft aborted its landing and collided in the air with an object believed to be a second drone. Prosecutors opened the case for attempting to cause an explosion and dangerous interference with air traffic, and called it a serious attack on Germany's transport and logistics infrastructure.

The investigation files reported by Welt am Sonntag put about 1.8 kg of Semtex in a resealed food can on the drone that reached the An-124, an aircraft carrying about 25,000 litres of fuel. The detonator failed. About 10 days later investigators found another drone and a burn site at Kabelsketal, south of the airport, with about 50 g of Semtex, and identified possible caches near Schkeuditz.

At least three drones had been hidden in bushes and under trees outside the perimeter, fitted with German 5G SIM cards for remote flight over the internet, investigators told the Wall Street Journal for a 20 October story. German cyber-intelligence officials traced the control traffic to servers the GRU had used before, and steel plates added to the charges would have turned them into fragmentation bombs, the newspaper wrote.

Alexander Dobrindt, the interior minister, said on 1 September that police investigations, the pattern of the attack and intelligence findings established Russian responsibility. He described the men on the ground as low-level agents working for Russian state authorities. Germany closed the Russian consulate general in Bonn from 18 September, ended the lease of the Russian House in Berlin and summoned the ambassador. Russia retaliated by closing Germany's consulate general in St Petersburg and announcing the closure of the Goethe-Institut branches. Vladimir Putin, at a press conference in Bishkek in early September, asked: "Where is the evidence?"

The Leipzig suspects

Federal investigators identified two men by early September, Süddeutsche Zeitung, NDR and WDR reported. One, born in Russia and travelling on a Latvian passport, entered Germany through Berlin Brandenburg airport in late July, drove a rental car toward Leipzig and flew out of the same airport two days before the attack. The other, a Belarusian with a Russian passport, entered the Schengen area on an Italian tourist visa issued in Minsk.

Welt am Sonntag, which saw the investigation files, named them as Oleg L. and Andrei K. The paper reported that German authorities knew when Oleg L. arrived that he was connected to the GRU and did not keep him under surveillance. He came in through Turkey, left for Serbia and is back in Russia. Andrei K. was identified from DNA on a glove fragment left on an antenna rig in a tree near the airport, which investigators believe relayed control signals. The profile matched entries in Finnish and Lithuanian criminal databases, and Polish authorities had linked him to a 2024 fire at a hardware store in Łódź that they treat as sabotage.

The Telegraph and Welt am Sonntag gave the full names on 2 October as Oleg Levushkin and Andrei Karshakou, and reported that Levushkin had surveyed the airport on 31 July and kept up a years-long contact with Col. Denis Smolyaninov of the GRU. The Journal described Levushkin as a former Russian officer recruited by the GRU after a criminal conviction, and wrote that he directed several Belarusian operatives who moved the explosives across borders, assembled the drones and positioned them. The Russian embassy in Berlin called the allegations baseless.

The Serbian route

Explosives for Leipzig moved through Bulgaria and Serbia, according to the Welt and Telegraph accounts. In Serbia, the Higher Public Prosecutor in Subotica is investigating seven people as an organised group that obtained and stored explosives, explosive devices and drones in Serbia and moved them toward EU countries. The case began with explosives found in Kanjiža, on the Hungarian border, on 5 April. Danilo B., a dual Russian and Serbian citizen, and Slobodan Đ. have been in custody since June, when police stopped two cars, one carrying drone parts and the other cans of explosives.

One member of the group, a pensioner identified as D.A., signed a plea agreement on 8 September. The Subotica Higher Court sentenced him on 11 September to a year of house arrest for carrying a long-range FPV combat drone fitted with explosives, for which he was paid €500, and handing it over on 29 May at 17:20. Serbian prosecutors have kept their case to weapons and explosives offences, and the connection to Leipzig rests on German reporting and the Journal's sources.

Munich and Prešov

Two people threw incendiary devices from a car onto a construction site beside the Munich headquarters of Rohde & Schwarz, which makes counter-drone and military communications systems, and the drone maker Helsing, which supplies Ukraine, on the night of 2 to 3 September. A witness saw them. Munich's general prosecutor and the Bavarian criminal police put a Bulgarian woman, 28, and a Bulgarian man, 38, in custody for property damage and attempted arson.

Slovak police announced on 25 August that they had stopped a plan to burn the Skyeton drone factory near Prešov, where about 70 employees could have been inside. A Latvian and a Ukrainian were detained in Slovakia and a 26-year-old Latvian was arrested in Hamburg, prosecutors said. Police seized a petrol and polystyrene mixture they called napalm. Custody rulings cited by a Slovak website showed the Latvian had received the plant's coordinates a day before and the Ukrainian was to drive him to Poland afterward, Reuters reported.

The Frankfurter Allgemeine Zeitung reported on 25 September, citing security sources, that the two Bulgarians belonged to a GRU group operating from Slovakia that had also prepared the Prešov attack. German services believe a GRU special-tasks department directs these operations across Europe, and that Smolyaninov led the Leipzig group, the paper's sources said. Tomáš Valášek, deputy leader of Progressive Slovakia, demanded an explanation from Prime Minister Robert Fico about the Slovak base.

Recruits

Estonia's Internal Security Service concluded that the fire at a Tallinn building used by Milrem Robotics, which supplies unmanned ground vehicles to Ukraine, on the night of 14 to 15 August was sabotage commissioned by Russian security services. Three suspects were detained in Latvia on 17 and 18 August and handed to Estonia. Estonia summoned the Russian ambassador, Foreign Minister Margus Tsahkna said on 29 September. Dmitry Peskov, the Russian presidential spokesman, called the finding "baseless, ill-considered".

Poland's minister for the special services, Tomasz Siemoniak, said Russian intelligence was behind the 23 September fire at the Starlink ground station at Wola Krobowska, south of Warsaw, and that Russia increasingly hired people from the criminal underworld. Polish prosecutors charged two Turkish citizens on 7 October, and German police arrested them in Nürtingen on 12 October. A Ukrainian scout held since 30 September sent his findings to the client on Telegram, according to Poland's internal security agency.

Two Ukrainians charged in absentia with blowing up a section of the Warsaw to Lublin railway at Mika on 15 and 16 November 2025, on a line that carries aid to Ukraine, had cooperated with Russian intelligence for a long time and crossed into Belarus after the blast, Prime Minister Donald Tusk told parliament. Poland asked Belarus to hand them over. In the 2024 OBI and Marywilska 44 fires in Warsaw, prosecutors say a Belarusian lit one store with a remote device and a Ukrainian filmed the second blaze for a Russian handler.

Belarusians, Ukrainians, Latvians, Bulgarians, Turks and Serbs fill the suspect lists in these cases, several with criminal records. German investigators call them disposable agents, hired for single jobs while the clients stay out of sight, according to the files Welt am Sonntag saw. GRU officers appear in the files at the far end of the chain, as a name attached to a contact, a server or a sanctions listing.

Incidents without attribution

Italy's defence minister, Guido Crosetto, said of the 13 August blast at the KNDS Ammo Italy plant in Colleferro that there was no indication of anything but an internal problem, and prosecutors in Velletri opened a file for negligent disaster. Bulgaria's interior minister, Ivan Demerdzhiev, said the cause of the 10 August fire at an EMCO depot near Belitsa appeared internal. After a second EMCO depot burned on 11 to 12 September, he listed sabotage among the versions under examination and ordered every ammunition depot in the country inspected.

Bulgarian prosecutors charged two suspects born in 2007 in absentia over the 9 October fire at a Starlink site near Sofia, and the state has named no sponsor. In Lithuania, where attackers tried to burn a Starlink station in Vilnius on 18 October, two ministers named Russia while the interior minister said the culprit was not yet clear.

The chain of command

The Journal reported that the attacks are run by the GRU's Special Tasks Service, formed in 2023 by merging clandestine units under Col. Gen. Andrey Averyanov, and that Western intelligence traced Leipzig to Smolyaninov, one of his department chiefs. German intelligence officials link the operation to the GRU's Unit 29155, the Telegraph wrote.

Smolyaninov is under sanctions in two jurisdictions. The EU listed him on 16 December 2024 over Russian destabilising activity in Europe. The UK designated him on 4 December 2025 for coordinating GRU sabotage operations in Ukraine. Lithuanian intelligence identified him in December 2025 as head of the GRU's Ukraine department, a specialist in psychological operations who organised sabotage through Telegram, the Telegraph reported.

A joint investigation by WDR, NDR and Süddeutsche Zeitung had already named Smolyaninov as an alleged organiser of the July 2024 plot to send incendiary parcels through DHL. Four parcels were posted from Vilnius on 19 July 2024 and one caught fire at the DHL hub in Leipzig. Test parcels went to the U.S. and Canada. Eurojust, which coordinated investigators who identified 22 suspects, said the acts were carried out on behalf of Russia's military intelligence service. Lithuania has put five men on trial on terrorism charges and Poland has indicted five more.

The expulsions

Austria declared four Russian diplomats personae non gratae on 23 October for activities incompatible with their diplomatic status, based on findings by Austrian security authorities. Three worked at the embassy and one at Russia's delegation to the OSCE for military security and arms control. The magazine profil reported that the review began after the exile outlet Proekt published leaked data on Russian diplomats tied to the GRU, SVR and FSB. The formula is usually applied to spying, Reuters wrote, and the ministry tied the four to no sabotage case. Austria has now expelled 18 Russian diplomats since 2020. Dmitry Lyubinsky, a Russian deputy foreign minister, told TASS a response would follow.

Moldova's foreign ministry said the same day that a member of the Russian embassy staff in Chișinău would be declared persona non grata in response to the violation of Moldovan airspace. A drone loaded with explosives had entered Moldova at 13:59 during a Russian attack on Ukraine and fallen about 100 m from a house in Chiștelnița, in Telenești district. Police identified it as a Geran attack drone and destroyed the warhead, and President Maia Sandu called it Russian. The ministry gave the airspace violation as its only ground. Maria Zakharova, the Russian foreign ministry spokeswoman, promised a harsh response and said the drone's Russian origin had not been proven.

Security measures

German police logged 165 suspected sabotage cases between January and the end of August 2026, against 320 in all of 2025, according to federal police figures seen by Tagesschau. The Bundeswehr raised its internal sabotage threat rating to "erheblich" in October. Markus Söder, Bavaria's premier, said after the Munich attack that the state would bring in a law to protect critical infrastructure without delay.

Estonia's security service has told defence companies to harden physical and cyber security. Lithuania raised its alert level at more than 15 critical infrastructure sites after the Vilnius attempt. Bulgaria's security agency chief, Plamen Tonchev, told parliament that part of the fence at the Sofia Starlink site had been taken down for expansion work before the fire. Romania's intelligence service has published its recruitment profile and a free hotline for reporting terrorist risks.

Oleg L. and the two Mika suspects left the EU before or just after their operations, for Russia and Belarus, beyond the reach of a European arrest warrant. Serbia, outside the EU, holds its own suspects on weapons charges. The hired hands who are caught, a Bulgarian couple in Munich, Latvians in Hamburg and Tallinn, Belarusians in Bavaria and a Ukrainian in Warsaw, face arson, explosives or sabotage proceedings in the country where they were found, and each case moves through a separate court.

Timeline

On 19 July 2024, incendiary parcels were posted from Vilnius; one caught fire at the DHL hub in Leipzig.

On 15 and 16 November 2025, a blast destroyed track on the Warsaw to Lublin railway at Mika.

On 4 August 2026, a bomb drone reached a Ukrainian An-124 at Leipzig/Halle.

On the night of 14 to 15 August, the Milrem Robotics building in Tallinn burned.

On 25 August, Slovak police announced they had stopped the plan to burn Skyeton near Prešov.

On 1 September, Germany attributed Leipzig to Russia and closed the Bonn consulate.

On the night of 2 to 3 September, incendiary devices were thrown near Rohde & Schwarz and Helsing in Munich.

On 14 September, fire broke out beside Carfil in Brașov.

On 23 September, the Starlink ground station at Wola Krobowska burned.

On 29 September, Estonia attributed the Milrem fire to Russian services.

On 20 October, the Wall Street Journal reported the U.S. assessment of a Putin order.

On 23 October, Austria expelled four Russian diplomats and Moldova moved to expel a Russian embassy staff member.

On 26 October, the SRI and DIICOT named a Russian-coordinated network behind the Brașov fire.

The files

The Federal Prosecutor's Leipzig file has produced no published arrest warrant for Oleg L. or Andrei K. A warrant would show whether German prosecutors are ready to put the GRU connection Welt am Sonntag and the Telegraph described before a judge, and whether Smolyaninov is named as a suspect.

Munich's prosecutors hold two cases that could connect the cells: the Bulgarians from the Rohde & Schwarz attack and the Belarusians wanted by Romania. Their charge sheets would show whether the Bavarian rail and power attempts and the Brașov fire were ordered by the same handlers. Romania wants both Belarusians surrendered on its warrants, and the Warsaw court that ordered Artem S. held for seven days must now rule on whether he is surrendered to Romania.