Europe's arms plants are burning, and the arsonists are being hired locally

The intrusion path in these incidents is unglamorous. At EMCO in Bulgaria a truck parked beside a warehouse burned first, the fire spread, and the explosion followed ^[7]. At Colleferro outside Rome the blast came after a fire of unknown origin in the shop where powder was processed ^[8]. Neither needs a trained officer or a software exploit. Both need physical access and someone willing to be the face on the camera.

That someone is being sourced on the spot. The head of Latvia's VDD, Normunds Mezviets, said in March that GRU officers do not travel to the country where an operation is prepared: they stay in Russia, where it is safe, and do not risk their own operational and physical security ^[15]. The chain described by Western intelligence runs from an officer to a criminal intermediary over messengers including Telegram, then to a local hire paid in cryptocurrency who may not know who ultimately commissioned the job, with each layer making attribution harder ^[16].

Count what that chain has yielded in custody. Three Latvian citizens over the arson at the drone plant in Estonia ^[5], four suspects after the fire that almost destroyed a Czech factory making drones and thermal imaging optics for Ukraine earlier in 2026 ^[11], and six people charged in Lithuania over an attempted arson at a supplier of radio-wave scanners to Kyiv ^[12]. That is thirteen people ^[20], and on Mezviets's account the men who task the work are not among those who can be arrested locally ^[15].

The attribution gap is doing deliberate work. Latvia detained its three suspects under provisions covering assistance to a foreign state in actions directed against another state, and the service has not placed responsibility on Moscow ^[6]. Bulgarian and Italian officials have been reserved about a Russian trail, and as of publication no direct evidence tied Moscow to the incidents in Estonia, Italy or Bulgaria ^[13]. Estonia's prime minister Kristen Michal said investigators are testing sabotage, including possible Russian involvement ^[10]. The legal instrument exists; the political naming does not.

Hold the sourcing at arm's length: both accounts of this assessment come from the same outlet relaying The Telegraph ^[23], so this is one report read twice.

The target list is the part with no ambiguity in it. EMCO makes 155mm artillery ammunition for Ukraine ^[7], the Czech plant made drones and optics ^[11], the Lithuanian target supplied signal scanners ^[12], and European officials read the pattern as hybrid pressure meant to widen splits between allies and slow aid to Kyiv ^[18]. Three of these events fell inside six days in August 2026 ^[21].