Escalation watch › Hybrid & sabotage › H04

Inland sabotage in NATO Europe: rail, energy, telecoms and logistics

H04 · Both · checked 2026-11-09 · reviewed Every run · priority

Munich's general prosecutor has charged two BELARUSIAN nationals, aged 39 and 50 and in custody since 7 October, with planning to set fire to a building or critical-infrastructure facility in the Nuremberg area using accelerants, FOR PAYMENT and on the…

Escalation signal

Casualties; destruction rather than disruption (a site actually knocked offline); formal state attribution followed by Article 4 consultations or expulsions; simultaneous multi-country incidents; sabotage of nuclear, water or hospital infrastructure. Coastal and undersea incidents stay in H01-H03; drone incursions in airspace stay in U02.

Baseline (21 Sep 2026)

Sabotage, arson and attacks on infrastructure inside NATO Europe: railways, energy, telecoms and logistics, including the ground infrastructure of satellite systems. The campaign is real and multi-country, and several states have attributed specific incidents to Russian services. ATTRIBUTION IN THIS DOMAIN REQUIRES UNUSUAL CARE, FOR TWO REASONS THAT PULL IN OPPOSITE DIRECTIONS. First, nationality indicates recruitment, not sponsorship: Russian services have repeatedly used disposable agents recruited through Telegram, and suspects held across these cases carry Turkish, German, Colombian, Cuban and Ukrainian passports. Second, and less often acknowledged, Russia is not the only party with a motive for sabotage in Europe, and an operation that implicates Moscow serves the interests of those who want NATO drawn further in. The Nord Stream case is the documented instance: the largest act of infrastructure sabotage in Europe since 1945 was widely attributed to Russia for years, and the only person ever brought to trial is a former Ukrainian special forces officer, charged in Hamburg in October 2026 on evidence including explosive traces, surveillance and telephone data, with German authorities alleging a possible Ukrainian state connection and Kyiv denying it. The lesson for every incident logged here is that an arrest is not an attribution, a nationality is not a sponsor, and the party that benefits from blame is not necessarily the party that acted.

Where to check

Notes from PolandDefence24Portal ObronnyThe InsiderAugen geradeaus!Seznam Zprávy

Check log

• 2026-10-293CHARGES FILED IN GERMANY; THE THREAT UPGRADE'S BASIS IS NOW VISIBLE AND WORTH EXAMINING. Munich's general prosecutor has charged two BELARUSIAN nationals, aged 39 and 50 and in custody since 7 October, with planning to set fire to a building or critical-infrastructure facility in the Nuremberg area using accelerants, FOR PAYMENT and on the instructions of a foreign government or association. The intended target was reportedly not yet selected. Charges: conspiracy to commit arson, and agent activity for sabotage purposes. NO STATE IS NAMED IN THE CHARGE SHEET. WHAT DROVE THE BUNDESWEHR'S UPGRADE to 'erheblich', the second-highest level, per WDR and Sueddeutsche Zeitung reporting a classified analysis: the discovery of an apparently crashed drone near WUNSTORF AIR BASE in September, which the paper distinguishes from Leipzig - Leipzig targeted Ukrainian aircraft, whereas at Wunstorf the Bundeswehr itself was likely the intended target. In its own confidence language the analysis says Russia has 'almost certainly' had the capability for some time and 'very likely' now has increased intent, and that using drones as kinetic weapons crosses a previously anticipated red line. THE INFERENCE ABOUT INTENT RESTS ON TWO INCIDENTS, AND SEVERAL READINGS FIT THE SAME FACTS. A crashed drone near an airfield is consistent with reconnaissance, with a navigation failure, with commercial or hobbyist flying, or with an attack that failed - the object's presence does not establish its purpose. Paid intermediaries are recruited by criminal networks as well as by states, and a principal who pays strangers in advance of choosing a target is buying deniability, which cuts against reading any single case as a clean state operation. The Nord Stream precedent in this tracker's baseline shows that the party an incident appears to serve is not reliably the party responsible. And the assessing institution has its own interests: Germany is simultaneously legislating shoot-down powers, standing up a national drone-defence centre, expanding intelligence authorities and arguing for a larger budget, all of which a raised threat level supports. Russia denies involvement and accuses Germany of staging incidents. None of this makes the assessment wrong - it may well be right - but it is an assessment of motive built on thin evidence by a party with reasons to raise the number, and it is recorded here as such. Score holds at 3, which rests on the observable events, not on the attribution. WATCH: whether the Nuremberg case names a principal at trial. Sources: Munich general prosecutor via t-online, WDR and Sueddeutsche Zeitung via Defense News and suv.report, Russian denials via TASS.
• 2026-10-283GERMANY PUTS A NUMBER ON IT: 165 SUSPECTED SABOTAGE CASES IN EIGHT MONTHS. Federal Criminal Police Office figures record 165 suspected sabotage cases registered by police between January and the end of August 2026. The Bundeswehr now formally rates the danger of Russian sabotage against its own installations as 'ERHEBLICH' - substantial, the term that triggers heightened protective measures - and the president of the military counterintelligence service, Martina Rosenberg, reported to parliament this month on the security situation. German authorities also arrested a Ukrainian national accused of spying for Russia (attribution untested, see this indicator's baseline on why nationality is not sponsorship). THE INSTITUTIONAL RESPONSE IS NOW CONCRETE RATHER THAN DECLARATORY: a national drone defence centre has been inaugurated and becomes operational in January, focused on airports, Bundeswehr sites and energy suppliers; an amendment to the Aviation Security Act allows the Bundeswehr to shoot down drones in support of the federal and state police where only that can avert a particularly serious incident; and the Bundestag approved four EUR 25m procurements in October covering small-drone defence, Patriot repurchase and repair, and encrypted radios for the NH90. A second law strengthening military security against sabotage and espionage is in draft. WHAT THE NUMBER DOES AND DOES NOT SHOW: 165 cases are SUSPECTED, covering everything from cable cuts to unexplained drone overflights, and a rising count partly reflects rising reporting and classification rather than only rising activity. It is nonetheless the first official national figure in this indicator rather than an aggregate of press reports. Score holds at 3. Sources: Bundeskriminalamt figures via suv.report, Bundeswehr threat assessment via suv.report, Bundestag records on the Luftsicherheitsgesetz amendment, Yahoo/dpa on the drone defence centre.
• 2026-10-233GERMANY RAISES ITS MILITARY THREAT LEVEL AND ARRESTS A SUSPECTED AGENT. German authorities arrested a Ukrainian man accused of spying for Russia, and the armed forces raised the threat level for Russian sabotage against German troops and facilities. The formal posture change is the substantive part: a member state's armed forces altering their own protective state in response to an assessed threat, rather than investigating a single incident. ON THE ARREST ITSELF, note the caution in this indicator's baseline: a Ukrainian national accused of working for Russia may have been recruited by Russian services, may be acting for another principal, or may be neither - and the Nord Stream trial running concurrently in Hamburg is the reason that distinction cannot be waved away. Nothing is established until charges are tested. Score holds at 3. Sources: Al Jazeera, German federal prosecutor statements.
• 2026-10-183A THIRD STARLINK TARGET IN A THIRD NATO STATE IN 26 DAYS - AND THIS ONE WAS STOPPED. Lithuanian Prime Minister Mindaugas Sinkevicius announced that shortly after midnight an attempt was made to set fire to a Lithuanian company storing Starlink communications equipment. It failed, and the reason matters: 'the security services had warned this company of prospective attacks, security had been reinforced, and the attempt was unsuccessful.' Sinkevicius is convening an emergency session of the National Security Commission on Monday 19 October, which will also address an unidentified drone that breached Lithuanian airspace early the same morning. PATTERN NOW ESTABLISHED ACROSS THREE COUNTRIES: Poland 23 September, Bulgaria 9 October, Lithuania 18 October, all against the ground infrastructure of one satellite system, with foreign nationals detained in the first two. Lithuania has prior form for this model - in January 2026 it accused the GRU of coordinating arson against a plant supplying equipment to Ukraine's army, carried out by Colombian and Cuban citizens living in Russia who had attempted similar attacks in Poland, Romania and Czechia. SIGNIFICANCE FOR THE SCORE: it stays at 3, but this is the first in the series that was anticipated and prevented, which is evidence that warning and hardening work - the opposite of the usual direction of travel in this indicator. Sources: Sinkevicius via Bytes Europe and Lithuanian government statement, Reuters for the January GRU attribution.
• 2026-10-093RAISED 2->3. A SECOND STARLINK GROUND SITE ATTACKED IN A SECOND NATO COUNTRY, AND THIS ONE WAS DESTROYED. At about 22:00 on 9 October two masked men broke into a restricted communications facility roughly 20 km from Sofia and set fire to 11 OF ITS 17 ANTENNAS - the dishes that link to SpaceX's satellites. The site is privately owned; a Bulgarian MP says it served Ukraine. TWO YOUNG MEN HOLDING GERMAN PASSPORTS have been detained, mirroring the two Turkish nationals reported for the Polish arson sixteen days earlier - the disposable-agent pattern, where nationality indicates recruitment rather than sponsorship. Plamen Tonchev, head of the State Agency for National Security, told parliament he believes it was sabotage and that further such acts cannot be ruled out; Radev confirmed an 'extremely intensive' investigation with partner services; the interior ministry has increased protection at comparable sites. WHY THIS MEETS THE THRESHOLD FOR 3: the test set for this indicator was destruction rather than disruption, or simultaneous multi-country incidents. Both are now satisfied - two thirds of a ground station's antennas burned is destruction, and two NATO states' Starlink infrastructure was attacked within sixteen days with suspects detained in each. Attribution remains unestablished and no state has formally blamed Russia, which is why this is 3 rather than anything graver. CONTEXT WORTH HOLDING: the Bulgarian fire preceded by five days the US throttling of Ukraine's Starshield terminals (U01), so Ukraine's satellite link was degraded from two directions in one week, one covert and one by its principal ally. Sources: Sofia Globe, Meduza citing Bulgarian National Television and The Insider's satellite imagery, dpa citing investigators on the German passports, Militarnyi, MP Ivaylo Mirchev.
• 2026-10-082RAF MOLESWORTH, THE 'LATVIA CONNECTION' - A SEPARATE INCIDENT. Two LATVIAN nationals aged 36 and 32 were arrested early on 8 Oct INSIDE THE PERIMETER of RAF Molesworth in Cambridgeshire, on suspicion of entering a prohibited place for a purpose prejudicial to the UK. The base matters: it is run by the US Air Force and hosts the NATO INTELLIGENCE FUSION CENTRE, which feeds the Supreme Allied Commander Europe, plus US Africa Command intelligence personnel. Counterterrorism police stated there is NOTHING AT THIS STAGE TO SUGGEST A LINK TO FAIRFORD. THREE CAUTIONS AGAINST THE OBVIOUS READING: no charges have been brought in either case; nationality is not attribution, and Russian services have repeatedly recruited disposable agents of Baltic, Ukrainian and third-country nationality through Telegram for exactly this kind of low-level reconnaissance and sabotage, which is itself an argument for not inferring sponsorship from a passport; and an intelligence-fusion site is a plausible target for reconnaissance by several actors. WHAT IS NONETHELESS TRUE: two penetrations or attempted approaches of UK bases hosting US and NATO functions within eleven days, after which a strategic bomber force left the country. Score holds at 2 - no damage, no casualties, no attribution. Watch for charges, which would convert speculation into evidence. Sources: Washington Post, Al Jazeera, Reuters, UK counterterrorism policing statement.
• 2026-10-052CHECKED, NO CHANGE (2), with the attribution now stated at service level: the BND president told the Bundestag that on Leipzig 'the traces lead very clearly to Russia'. The BfV adds that Russian services are recruiting agents online inside Germany and that such covert operatives are increasingly active there. Counterweight retained: AP's database shows sabotage plots peaking at 26 in 2024 and falling to six documented in 2025, so the campaign is episodic rather than steadily rising. Source: Bundestag PKGr hearing (primary).
• 2026-10-022CHECKED, NO CHANGE (2). Still the most current hybrid indicator: formal German state attribution for Leipzig, arrests in Munich, and a Polish incident nine days ago. Counterweight retained: AP's database shows plots peaking at 26 in 2024 and falling to six documented in 2025, so the campaign is episodic rather than steadily rising.
• 2026-09-302CHECKED, NO CHANGE (2) - and this is the most CURRENT of the hybrid indicators, its latest event being a week old. Context worth holding against alarm: AP's tracking database recorded a spike from one arson or explosives plot in 2023 to 26 in 2024, then six documented in 2025, with intelligence officials describing the campaign as noticeably calmer in late 2024 and early 2025. So the pattern is episodic, not a steady ramp; single incidents should not be read as a trend without a second data point.
• 2026-09-272RAF FAIRFORD: five men in their 20s arrested near the base in possession of three vans, on suspicion of explosives and terrorism offences; a sixth, a British-Iranian dual national, arrested on 30 Sep on suspicion of preparing terrorist acts. ALL WERE RELEASED ON BAIL WITHOUT CHARGE and remain under investigation. PM Burnham cited strong indications of an Iranian role; a minister acknowledged the initial tip-off gave only a partial picture, and officials have cautioned publicly that investigators may be 'barking up the wrong tree'. No explosives were recovered. Consequence: all 12 US B-1 bombers left Fairford on 4 October (T01). Sources: ABC News, CNN, Al Jazeera.
• 2026-09-232Fire at the Exatel-run Starlink ground station in Wola Krobowska, ~40 km south of Warsaw, which links Starlink satellites to ground networks for the region including Ukraine. Power supply, distribution board and generator damaged; a bottle of flammable liquid resembling a Molotov cocktail reportedly found near the panel. ATTRIBUTION NOT ESTABLISHED: the digital affairs minister called the modus operandi 'clearly Russian', Tusk declined to label it without certainty, the services' spokesman said it is too early to state causes while confirming that everything points to arson, and a short-circuit line reportedly remains open. Station stayed operational; Ukraine has not reported an outage. Sources: Meduza citing RMF24, Notes from Poland, Reuters via Global Banking, planet-today (sceptical read).
• 2026-09-152Germany formally blames the Russian government for the Leipzig attack and orders the closure of the last Russian consulate general and a cultural centre in Berlin - attribution followed by a concrete diplomatic penalty, which is rarer than attribution alone. Source: Handelsblatt.
• 2026-09-032German police arrested two people suspected of attacking a weapons manufacturer in Munich. German authorities state they assume Germany is the target of further hybrid attacks by Russia. The European pattern recited by officials spans attempted arson outside the British prime minister's home, firebombing of warehouses in Latvia storing aid for Ukraine, and an assassination plot against a German arms manufacturer. Source: PBS NewsHour.
• 2026-08-042Drones with military-grade explosives are found by a bomb squad at Leipzig airport, the suspected target a Ukrainian cargo plane; another drone exploded next to an aircraft as it landed. GERMANY OFFICIALLY BLAMED THE RUSSIAN GOVERNMENT - a formal state attribution, not just an investigative lead. Sources: PBS NewsHour, Al Jazeera.
• 2025-11-162Explosive device destroys track on the Warsaw-Lublin line near Mika, a main supply route to Ukraine, with a second damaged section the same day. Polish authorities attribute it to the FSB and name two Ukrainian citizens with long-standing links to Russian intelligence who entered from Belarus. Tusk calls it unprecedented sabotage and warns of escalation by Russian services. Sources: Polish government statements via Reuters, TWZ, Polskie Radio.