Executive Summary:
- Russian-linked hybrid attacks across Europe, particularly on military-industrial facilities, including an August 31 fire at Poland’s WB Electronics, have surged to roughly 15 incidents a month since April.
- These attacks are calibrated to stay below the threshold for invoking Article 5, exploiting the fact that current NATO mechanisms are not fully coordinating the registration, attribution, or collective characterization of sabotage against its defense-industrial base.
- Poland’s outsized exposure and defense investment could give Warsaw standing to push NATO toward a coordinated joint reporting mechanism for gray-zone sabotage, modeled on existing cyber-coordination frameworks, before Moscow tests collective defense more directly.
On the night of August 31, a fire tore through a production building at WB Electronics in Skarżysko-Kamienna, Poland’s largest privately owned defense manufacturer and a supplier of the FlyEye and Warmate drones that Ukrainian forces use daily on the front line. Security footage reportedly showed a masked figure scaling the perimeter fence shortly before the blaze started (The Insider, August 31). Polish prosecutors opened a terrorism investigation, and on September 2, Polish Prime Minister Donald Tusk said that there is no doubt that it was an act of deliberate arson (Nastoyashee Vremya, September 1). The fire is one of the latest entries in an accelerating, continent-wide pattern for which the North Atlantic Treaty Organization (NATO) lacks shared categorization or a fully coordinated response.
The International Centre for Counter-Terrorism and GLOBSEC have documented 151 suspected Russian-linked industrial sabotage incidents across Europe between February 2022 and February 2026 (Novaya Gazeta Evropa, March 3). The Munich Security Report 2026, drawing on Armed Conflict Location and Event Data Project figures, tallied roughly 150 suspected Russian hybrid incidents, including arson, sabotage, drone overflights, and incendiary parcels, in EU and NATO states from 2022 through 2025 (Defence Blog, August 24).
The pace of Russian-linked hybrid attacks on NATO countries is accelerating. Ukraine’s Sahaidachnyi Security Center puts the rate at around 15 incidents a month between April and August, up from a previous ceiling of roughly ten attacks in a month (24 Kanal, August 30). This year’s defense-industrial fires span Czechia, France, Bulgaria, Italy, and Estonia and now Poland twice over, after Slovak police say they disrupted a plot to burn down a Ukrainian-owned drone facility on August 25 (Euromaidan Press, June 19; UNN, August 30; Dagens News, August 31). Tusk warned days before the WB Electronics fire that the coming months could prove critical for the security of Ukraine and the wider region.
Other recent examples of Russian-linked hybrid attacks on NATO and EU military-industrial facilities are plentiful. U.K. authorities arrested a man on charges of working with a Russia-linked intelligence group to plan to sabotage drone factories in Swindon on September 4 (Nastoyashee Vremya, September 10). An EMCO weapons-storage facility in Bulgaria, which supplies ammunition to Ukraine, caught fire on September 12, the second EMCO warehouse fire in recent weeks that raised suspicions of Russian sabotage (Radio Svoboda, September 12).
NATO’s Article 5 collective-defense guarantee was initially built to answer a tank column or a missile strike, an event unambiguous enough that 32 capitals can agree, quickly, that an armed attack occurred. In 2024, MI5 Director General Ken McCallum said publicly that Russia’s military intelligence service was on a sustained mission to generate mayhem on U.K. and European streets, citing arson, sabotage, and other hybrid attacks (Meduza, October 8, 2024). Two years on, his warning reads as an accurate forecast of what is now happening to Europe’s defense-industrial base. A drone-factory fire lit by an unidentified man in a balaclava does not trigger Article 5, and Moscow knows this—the ambiguity is the point, not a loophole. A campaign calibrated to stay under that line can still degrade production, spook insurers, and drain investigator hours without ever handing NATO a clean casus foederis.
NATO’s response has so far been largely characterized by the fragmentation that the Russian strategy is built to exploit. Poland treats Skarżysko-Kamienna as a domestic terrorism case (Nabat, September 3). Slovakia handled its August case through its domestic police and criminal-justice system (Dagens News, August 31). Estonia, Czechia, France, Bulgaria, and Italy have each run their own investigations, on their own timelines, with their own agencies, and even attribution is inconsistent. Czech and Estonian authorities are actively probing a Russian link, while French, Bulgarian, and Italian officials have not formally connected their cases to Moscow at all (New Voice of Ukraine, September 4). There is no shared registry of these incidents, no joint threat briefing to all 32 capitals, and no agreed threshold at which a scatter of “isolated” fires becomes a recognized campaign. A strategy built to stay under the radar of collective defense is difficult to counter when attribution and response remain primarily national decisions, even when NATO institutions are monitoring the broader campaign.
Poland has both the exposure and the standing to press the issue. It has absorbed more of these incidents than any other ally, is spending close to 5 percent of gross domestic product (GDP) on defense, has committed roughly 2 billion euros ($2.2 billion) to its Eastern Shield defenses, including for drones and surveillance, along its eastern border, and deployed about 10,000 troops under “Operation Horizon” to guard critical sites (Geopolitical Monitor, August 12; Insurance Journal, August 31). A standing mechanism, even an informal one to start, for members to report and jointly characterize sabotage against the defense-industrial base, in the same way it already coordinates to combat cyberattacks against critical infrastructure, could help NATO prevent these attacks. This does not require rewriting Article 5. It would require NATO to recognize that collective defense first needs collective recognition of the threat.
WB Electronics says it does not expect the fire to delay deliveries to the Polish military, which is a credit to the company rather than a reason for complacency. U.S. intelligence assessments reportedly warn that Russia may test NATO’s collective-defense commitments directly within a few years, and a defense-industrial base that has spent this year quietly absorbing arson attacks, factory by factory and country by country, could be better prepared when that test arrives (RBC, August 7). The fire in Skarżysko-Kamienna will fade from headlines within weeks. The campaign it belongs to will not.
The post Russian Sabotage Campaign Against NATO Surges appeared first on Jamestown.