BuildNot yet confirmed elsewhere1 publisher2 min readPublished
Europe's arms plants are burning, and the arsonists are being hired locally
Western intelligence ties a new wave of fires at plants supplying Ukraine to Russia, tasked through criminal middlemen and paid in crypto. The arrests so far reach only the hired hands.
The Engineer · Build desk
What happened
- Western intelligence links a new wave of sabotage at European arms plants to Russia, arranged so the people caught cannot easily be tied back to Moscow.
- A fire broke out in the Tallinn building of Milrem Robotics, which supplies weapons to Ukraine, on the night of 15 August 2026.
- On 10 August 2026 an explosion hit EMCO in Bulgaria, a maker of 155mm shells for Ukraine, after a truck parked by a warehouse caught fire.
- On 13 August a blast followed a fire in the gunpowder workshop at KNDS Ammo Italy in Colleferro, near Rome.
Why it matters
- constraint Damage kept small and deniable stays under the level at which the Alliance would even open an Article 5 discussion, which leaves each government holding a criminal case rather than a collective...
- exposure Ukraine's foreign supply of unmanned ground vehicles rests on two producers, so one building being reachable by a person with a lighter is a force-level exposure rather than a factory mishap.
- cost If the reachable surface is a visitor car park and a powder shop, the spending this forces is fences, cameras and contractor vetting at every private plant in the supply chain, and it lands on the...
- contradiction Poland and the Baltics name Russia while Rome and Berlin hold back for fear of escalation, so the same set of fires yields two official readings inside one alliance, which is the outcome the...
The intrusion path in these incidents is unglamorous. At EMCO in Bulgaria a truck parked beside a warehouse burned first, the fire spread, and the explosion followed [8]. At Colleferro outside Rome the blast came after a fire of unknown origin in the shop where powder was processed [9]. Neither needs a trained officer or a software exploit. Both need physical access and someone willing to be the face on the camera.
That someone is being sourced on the spot. The head of Latvia's VDD, Normunds Mezviets, said in March that GRU officers do not travel to the country where an operation is prepared: they stay in Russia, where it is safe, and do not risk their own operational and physical security [16]. The chain described by Western intelligence runs from an officer to a criminal intermediary over messengers including Telegram, then to a local hire paid in cryptocurrency who may not know who ultimately commissioned the job, with each layer making attribution harder [25].
Count what that chain has yielded in custody. Three Latvian citizens over the arson at the drone plant in Estonia [6], four suspects after the fire that almost destroyed a Czech factory making drones and thermal imaging optics for Ukraine earlier in 2026 [12], and six people charged in Lithuania over an attempted arson at a supplier of radio-wave scanners to Kyiv [13]. That is thirteen people [22], and on Mezviets's account the men who task the work are not among those who can be arrested locally [16].
The attribution gap is doing deliberate work. Latvia detained its three suspects under provisions covering assistance to a foreign state in actions directed against another state, and the service has not placed responsibility on Moscow [7]. Bulgarian and Italian officials have been reserved about a Russian trail, and as of publication no direct evidence tied Moscow to the incidents in Estonia, Italy or Bulgaria [14]. Estonia's prime minister Kristen Michal said investigators are testing sabotage, including possible Russian involvement [11]. The legal instrument exists; the political naming does not.
Hold the sourcing at arm's length: both accounts of this assessment come from the same outlet relaying The Telegraph [20], so this is one report read twice.
The target list is the part with no ambiguity in it. EMCO makes 155mm artillery ammunition for Ukraine [8], the Czech plant made drones and optics [12], the Lithuanian target supplied signal scanners [13], and European officials read the pattern as hybrid pressure meant to widen splits between allies and slow aid to Kyiv [18]. Three of these events fell inside six days in August 2026 [23].
What to watch
- Whether the Bulgarian or Italian investigations produce evidence that names a foreign state, which would remove the deniability the method depends on.
- Whether Latvia's three suspects are charged in documents that identify who tasked them, or only under the generic foreign-assistance provision.
- Whether the next incident hits a logistics node rather than a production site, since transport routes are already inside the assessed pattern.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence38
- Adoption61
- Hype gap+31
- Incentives66
- Confidence44
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Western intelligence services suspect Russia of organising a new wave of sabotage against arms plants and other defence industry enterprises in Europe, with operations run so as to make a direct link between the perpetrators and Moscow hard to establish.
ReportedSupportedSource: Western intelligence services, via The Telegraph as reported by mezha.net2 sources— create a free account to open themView cited source - [2]
Intelligence assesses that the Kremlin increasingly involves members of local criminal groups in damaging defence production facilities.
- [3]
The tactic may allow Russia to test NATO's resolve without crossing the line beyond which the Alliance could consider invoking Article 5 on collective defence.
- [4]
Intelligence considers that the limited scale of these operations may be part of a deliberate tactic aimed at testing NATO's readiness to respond without creating obvious grounds for Article 5.
- [5]
A fire broke out on the night of 15 August 2026 in the building of the Tallinn company Milrem Robotics, which supplies weapons to Ukraine.
- [6]
Latvia detained three Latvian citizens suspected of involvement in the arson of a drone-manufacturing plant in neighbouring Estonia.
- [7]
The VDD did not place direct responsibility on Moscow for the fire in Estonia, and confirmed that three suspects were detained under provisions applied to persons providing assistance to a foreign state in actions directed against another state.
- [8]
On 10 August 2026 a powerful explosion occurred at EMCO, one of the largest private arms producers in Bulgaria, which makes 155mm artillery ammunition for Ukraine; a truck parked near a warehouse caught fire first, the fire spread and caused the explosion.
- [9]
On 13 August an explosion occurred at the KNDS Ammo Italy plant in Colleferro near Rome, preceded by a fire of unclear origin in the workshop where gunpowder was processed.
- [10]
Milrem Robotics is one of two foreign producers of unmanned ground vehicles for the Ukrainian military.
- [11]
Estonian prime minister Kristen Michal said after the incident that the investigation is checking the sabotage version, including possible Russian involvement.
ReportedSupportedSource: Kristen Michal, prime minister of Estonia2 sources— create a free account to open themView cited source - [12]
In early 2026 a fire almost completely destroyed a Czech plant that produced drones and thermal imaging optics for Ukraine; four suspects were detained during checks on possible Russian involvement.
- [13]
In Lithuania six people were charged over an attempt to set fire to a company that supplied radio-wave scanners to Kyiv.
- [14]
Representatives of Italy and Bulgaria were reserved about suggestions of a possible Russian trail, and at the time of publication no direct evidence had been found linking Moscow to the incidents in Estonia, Italy and Bulgaria.
- [15]
Western intelligence points to a change in Russian GRU methods: instead of sending specially trained agents abroad, the service may use people from local criminal circles.
- [16]
Normunds Mezviets, head of Latvia's State Security Service (VDD), said in March that GRU officers avoid travelling in person to countries where operations are prepared: 'From our experience we do not see GRU officers physically coming here, to our country. No, they stay in Russia, where it is safe. They do not risk their own operational and physical security.'
ReportedSupportedSource: Normunds Mezviets, head of the Latvian VDD2 sources— create a free account to open themView cited source - [17]
Poland and the Baltic states speak more openly about Russian aggression in Europe, while Italy and Germany more often refrain from direct accusations for fear of further escalation; the covert format of the operations may also be aimed at deepening divisions within NATO.
- [18]
European officials characterise such operations as an element of 'hybrid war' aimed at deepening disputes between NATO allies and restraining military aid to Ukraine.
- [19]
A NATO representative said that in recent years Russia has intensified campaigns to destabilise allied countries using cyberattacks, assassination attempts and sabotage.
ReportedSupportedSource: unnamed NATO representative2 sources— create a free account to open themView cited source - [20]
Both published accounts of this intelligence assessment cite The Telegraph as their source and were carried by the same publisher, mezha.net.
- [21]
The Tallinn incident is considered alongside other confirmed or probable attacks on enterprises and on logistics chains involved in supplying military production to Ukraine from the territory of NATO states.
- [22]
Across the three cases described, thirteen people have been detained or charged: three in Latvia over the Estonian arson, four over the Czech factory fire, and six charged in Lithuania.
- [23]
Three of the incidents at facilities supplying Ukraine fell within six calendar days in August 2026: EMCO on 10 August, KNDS Ammo Italy on 13 August, and Milrem Robotics on the night of 15 August.
- [24]
Because Milrem Robotics is one of only two foreign suppliers of unmanned ground vehicles to Ukraine's military, the burned Tallinn building represents half of that foreign supplier set.
- [25]
Under the described scheme, GRU representatives make contact with criminal intermediaries through messengers including Telegram; the intermediaries find executors locally and pass on tasks; payment may be made in cryptocurrency; recruited people sometimes do not know that the ultimate client is Russia; and the use of several layers of intermediaries complicates investigation and the establishment of responsibility.
Sources
1 independent publisher whose own reporting we read for this story.
- mezha.netРФ почала нову хвилю атак та диверсій на заводах у Європі, які виготовляють зброю для України
2 articles · August 23, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.