As a clandestine campaign of Russian-orchestrated sabotage sweeps across the European continent, intelligence agencies are sounding the alarm: the Kremlin’s tactics have shifted from mere symbolic provocation to direct, kinetic attacks against critical defense infrastructure.
Margo Palloson, the director-general of the Estonian Internal Security Service (ISS) since 2023, warned in a recent interview with Foreign Policy that Moscow’s shadow war is entering a more dangerous and consequential phase. As Ukraine continues to defy Russian expectations on the battlefield, the Kremlin appears to be broadening its scope, targeting the industrial backbone of European military support for Kyiv.
Main Facts: A Shift in Strategic Targeting
For much of the early period following the 2022 invasion of Ukraine, Russian sabotage in the Baltic states was characterized by low-level, high-visibility disruption. These operations were designed to create unease and project reach.
"Initially, these attacks were more against symbolic objects," Palloson noted. The ISS tracked numerous incidents that served as psychological warfare: the vandalism of vehicles belonging to prominent Estonian opinion-makers, the ritualistic burning of Ukrainian flags, and a targeted arson attack against a Ukrainian restaurant in Tallinn.
However, by late 2026, the nature of these operations underwent a qualitative change. The August attack on Milrem, an Estonian robotics firm that serves as a vital supplier for Ukraine’s military, signaled that Moscow is no longer interested merely in symbolism. "Now the game has changed a little bit," Palloson explained. "We assess the purpose clearly was to disrupt, restrict, or cancel all the supplies to Ukraine."
This shift is not confined to Estonia. From Denmark’s defense manufacturing hubs to failed explosive plots in Germany, the footprint of Russian intelligence operatives is becoming increasingly visible across NATO territory.
Chronology: From Vandalism to Kinetic Sabotage
To understand the trajectory of Russia’s hybrid warfare, one must look at the progression of incidents reported over the last several years:
- 2022–2023 (The Symbolic Phase): Early Russian efforts focused on internal destabilization within the Baltics. This included graffiti, flag burnings, and minor property damage aimed at intimidating those who supported Ukraine publicly.
- 2025 (The Intelligence Pipeline): Estonia’s security services began tracking a surge in recruitment. Since the start of 2025, Tallinn has arrested 20 individuals who traveled to Russia and were subsequently recruited by intelligence handlers. These were often civilians—not military personnel—groomed to infiltrate Estonian institutions.
- August 2026 (The Kinetic Escalation): The attack on the Milrem robotics facility marked the transition to industrial sabotage. Concurrently, a major explosive plot involving a plane in Germany was thwarted, suggesting that Russian operatives are now willing to risk mass-casualty events to achieve strategic disruption.
- September–October 2026 (The Continental Alert): Reports from Reuters and other outlets confirmed that Denmark is also facing a surge in sabotage against defense firms. European Union ambassadors have begun emergency deliberations regarding the heightened risk of "nightmare scenario" hybrid attacks that could result in significant civilian loss of life.
Supporting Data: The Architecture of Russian Subversion
The efficacy of these operations relies on a sophisticated, multi-layered "deniability" model. Palloson highlights that Russia often hides behind as many as seven layers of intermediaries.
The Amateurization of Espionage
The Kremlin has increasingly outsourced its dirty work to criminal networks and vulnerable individuals. In some instances, Russian intelligence recruiters have leveraged social media to identify and coerce Ukrainian refugees. In these cases, the recruits are often misled—sometimes believing they are performing tasks for Ukraine’s own internal security services—only to find themselves participating in sabotage against the very country that granted them asylum.
The Commercialization of Sabotage
Perhaps most alarming is the rise of a "mercenary" model. Criminal groups, seeing an opportunity to capitalize on geopolitical tensions, are now actively proposing sabotage operations to their Russian handlers as a method of generating illicit revenue. This commercialization complicates traditional counterintelligence efforts, as the motivation is no longer purely ideological, but financial.
The Border Strategy
Estonia’s proactive stance has been a model for other EU nations. By monitoring the border and tracking the movement of citizens to Russia, the ISS has successfully identified a pattern of "sleeper" recruitment. These individuals are rarely tasked with immediate violence; instead, they are encouraged to take jobs in sectors—logistics, IT, or public administration—that provide long-term intelligence value to Moscow.
Official Responses and Legal Challenges
The response to this shadow war has been a mixture of increased physical security and diplomatic urgency. Estonia, for instance, has moved beyond general intelligence gathering, providing direct, site-specific security consultations to the private defense sector.
The Legal Gap
However, a growing frustration is palpable among European security chiefs. Palloson noted that while he feels equipped to handle the threat within Estonia’s legal framework, many of his counterparts in other EU nations are struggling with antiquated laws that were not designed for a "gray-zone" conflict.
The recent arrest and subsequent release of suspects linked to an Iranian-backed plot at a U.K. airbase highlighted the difficulty in prosecuting hybrid threats. "I have heard from some European colleagues that they feel they don’t have the right legal tools to handle this," Palloson admitted. As the threat evolves, the debate over granting intelligence services broader surveillance and detention powers is likely to intensify across the continent.
Implications: Preparing for the Worst
The ultimate concern for the Baltic states remains the possibility of a conventional invasion. In the months leading up to the 2022 invasion of Ukraine, Russia relied heavily on "softening" the target: bribing officials, deploying assassination squads, and creating internal division.
While Estonia’s intelligence services currently see little indication of an imminent full-scale military invasion, the lessons of Ukraine have been internalized. Every act of sabotage is viewed as a potential precursor to larger efforts to destabilize the state.
Resilience in the Face of Fear
Despite the escalation, the public mood in Estonia remains remarkably resilient. Support for Ukraine is not merely stable; it is growing. The Russian objective of inducing "fear or panic" has largely failed in the Baltics. "In Estonian society, there is no fear or panic," Palloson stated.
The EU-Wide Reckoning
The current consensus among EU intelligence officials is that the "nightmare scenario"—a coordinated, multi-country attack resulting in mass casualties—is a distinct possibility if countermeasures are not synchronized. Consequently, intelligence sharing between NATO allies has reached unprecedented levels.
As Europe looks toward the future, the integration of private industry into the security apparatus has become a necessity rather than a preference. Defense contractors, shipping companies, and even public transport authorities are now part of the front line.
In conclusion, the sabotage campaign against Europe is a clear signal that the war in Ukraine has spilled over into the industrial and social fabric of the West. The challenge for European leaders is to build a defense that is as agile and decentralized as the networks of criminals and spies currently threatening them, without compromising the very democratic values that Russia seeks to undermine. As Palloson noted, all services in Europe are now effectively "studying how to protect their societies" in an era where the boundary between peace and war has all but vanished.
