Anatomy of Russian sabotage: Why attribution lag distorts the statistics of attacks in the West

Of more than three hundred cases in which a Russian link has been investigated in the West since February 2022, the evidence points strongly to Moscow in only about forty specific incidents. As many as 29 of them fall in 2024. That does not necessarily mean the Kremlin has backed off: from a fire to establishing who ordered it usually takes anywhere from six months to more than two years. A September wave is already being layered onto these statistics: from 30 August to 21 September, more than twenty incidents, from drones and factory fires to arrests and indictments, and their verification is only just beginning.

In brief

• Of more than three hundred suspected cases of Russian sabotage and subversion in 2022–2026, about forty incidents are backed by strong evidence against the Russian state, and in 16 cases the Russian lead collapsed.
• Of those forty incidents, 29 took place in 2024, six in 2025 and one in 2026. This may largely reflect the pace of investigations rather than Russian ineffectiveness.
• The most fully proven case is the arson attack on a warehouse in Leyton, London, ordered by the Wagner Group. Apart from the organiser, none of the perpetrators knew at the time that the target had been chosen because of aid to Ukraine.
• In 2026, so far only the August attempted attack on Leipzig/Halle airport with a drone carrying a charge is backed by strong grounds to blame Russia.
• Perpetrators often film their operations for those who commission them, and in one foiled case Romanian counter-intelligence found that the recordings were to be used in fake news campaigns.
• From 30 August to 21 September, while I was finishing this text, more than twenty security incidents were added, from the arson attack on WB Electronics warehouses in Skarżysko-Kamienna to drones over Lithuania and Luxembourg’s airport, and from 14 September not a day passed without a new entry. This is material for verification, not for a final tally: none of the four factory fires has an identified perpetrator to date.

On the night of 4–5 August 2026, an employee at Leipzig/Halle airport spotted a drone carrying an explosive charge in the freight handling area. Federal police bomb disposal experts removed the detonator. The same night, according to the Saxony State Criminal Police Office, a probable second, unidentified object collided with a cargo aircraft, which landed in Hanover with minor damage.

This is not the first time Leipzig’s cargo zone has ended up in files on Russian sabotage. One example is the incident of 20 July 2024, when a parcel sent from Vilnius and addressed to London caught fire here. As Eurojust, the EU agency that coordinates the work of prosecutors, later established, this happened “shortly before it was loaded onto an aircraft”.

What sets the two cases apart is how quickly a culprit was named. Lithuanian prosecutors linked the organisers to Russia’s military intelligence, the GRU, in September 2025, Poland’s National Public Prosecutor’s Office filed an indictment in January 2026, and Eurojust described the entire operation in March 2026, 20 months after the fire. There is still no verdict. After the drone attack, Berlin needed four weeks. On 1 September, German Foreign Minister Johann Wadephul stated that with the attempted attack in Leipzig, “Russia’s leadership has instead made a conscious decision to inflict further significant damage on our bilateral relations”.

Little has been officially confirmed: the drone, the charge and the detonator. The media fill in the rest. Welt am Sonntag, quoted by t-online, reported that a DNA trace from the drone control antenna is identical to a trace secured after the 2024 parcel fire. The suspected organiser, a Russian named Oleg L., is said to be counted by German services among GRU circles and to have flown out of Berlin towards Serbia. Germany’s interior ministry declined to comment; Moscow denies involvement.

If the DNA lead is confirmed, the two Leipzig cases will share more than an address. For now it is a leak, not a finding by prosecutors. What Leipzig does show for certain is this: politicians now name culprits faster than they did two years ago; the courts do not.

To separate what we know from what we suspect, I compiled more than three hundred cases from 2022–2026 from the European Union, the United Kingdom, Norway, Iceland, the United States and Canada in which a Russian link was investigated. They include arson attacks, incendiary parcels, intrusions into water utilities, GPS jamming over the Baltic, severed cables and assassination plots, but also cases in which the Russian lead collapsed. This is a list of suspicions, not of “Russian attacks”.

Sorted by strength of evidence, the picture becomes more sober. In about sixty cases the link to the Russian state is well documented, although a public link between the intermediary and a specific institution in Moscow is usually missing. In more than ninety the suspicion is serious but unproven. In more than a hundred and thirty there are no grounds to blame Russia, which does not mean it has been ruled out. In sixteen the Russian lead collapsed. Even a strong identification of who commissioned an operation is not, moreover, a verdict against a specific person.

If only single, well-dated incidents with the strongest evidence are kept, forty remain. In five of them, stemming from just two British verdicts, a court reconstructed the entire chain of command; in the rest the evidence is strong but has a gap. As many as 27 are physical operations and 13 cyberattacks. Most concern the US (11), Poland (8), the UK (6), Lithuania (5) and Estonia (4).

This map, however, says more about where investigations have matured into indictments than about where Russia strikes hardest. Ten of the eleven US incidents are intrusions into control systems of water utilities and industrial plants, all from a single case announced in December 2025 by the US Department of Justice. According to prosecutors, the pro-Russian hacker group CyberArmyofRussia_Reborn was founded, funded and directed by the GRU. Take America out of the tally, and 29 of the forty remain.

Of the forty strongest incidents, 29 began in 2024, six in 2025 and one in 2026. It is tempting to conclude that Russian sabotage has peaked and is fading. That conclusion is premature.

The reason is prosaic: evidence matures more slowly than fires. First one has to establish who started the fire, then who paid them, and finally who paid the one who was paying. Analysts speak of attribution lag, the time needed to credibly identify who commissioned an operation. On top of that comes legal lag, the road from arrest to verdict.

From the Leyton fire to the verdict took 19 months, from the IKEA fire in Vilnius to the first-instance verdict 18, and from the incendiary parcels to the Eurojust announcement 20, with still no verdict. In the case of the shopping hall at Marywilska 44 in Warsaw, prosecutors announced a Russian link after a year and an indictment after just under two years.

The tally for 2024 is therefore still growing, and 2025 is only just being written. The indictment unsealed in New York on 15 September 2026 added, in one stroke, two assassination plots from 2025 and a new thread in the Prague case from more than two years ago. On top of that, states differ in how they detect threats and in how willing they are to disclose the results of investigations.

Russian sabotage of Europe’s defence sector? Where the Russian link can actually be seen

This is what material gathered “in the heat of the moment” looks like. Of more than twenty suspicious incidents between March and September 2026, only Leipzig offers strong grounds to blame Russia; eight raise serious suspicion and fourteen provide no grounds. The 31 August fire at the Skarżysko-Kamienna warehouses of WB Electronics, a drone manufacturer, is being investigated by Poland’s National Public Prosecutor’s Office as an act of foreign intelligence of a terrorist nature, but no one has been charged. Deputy Interior Minister Czesław Mroczek said on RMF FM of the Russian lead: “It obviously suggests itself.” What suggests itself is not yet evidence. I analysed incidents in the European defence industry separately in a piece on where the Russian link can actually be seen.

There are three possible explanations for the decline, and none rules out the others. A wave of arrests broke up the best-known networks, which may have curbed physical operations. Russia may have shifted some of its activity towards methods that are harder to attribute, such as drones, intrusions into industrial systems or GPS jamming. Finally, some high-profile suspicions simply are not borne out. Today it is impossible to say which weighs most.

On the night of 20 March 2024, someone doused a warehouse on the Cromwell Industrial Estate in east London with petrol. It housed Ukrainian businesses shipping Starlink equipment and humanitarian aid, among other things, to Ukraine. No one was hurt; the court put the damage at around £1.3 million.

Mrs Justice Cheema-Grubb’s sentencing remarks read like an operating manual for Russian sabotage. In June 2023, Briton Dylan Earl joined a Telegram channel of the Wagner Group, the Russian mercenary formation, and began talking to the profiles “Privet Bot” and “Lucky Strike”. He recruited Jake Reeves, who recruited Nii Kojo Mensah, and Mensah recruited Jakeem Rose and Ugnius Asmena. Rose poured the petrol; Mensah filmed the fire and streamed the footage to Earl. The court accepted that, apart from Earl, none of them knew at the time of the arson that the warehouse had been chosen because of its support for Ukraine. Reeves learned of it later and carried on planning regardless.

Using the messages, the court reconstructed who commissioned whom, and found that after its 2023 mutiny the Wagner Group had come under the direct control of the Russian state apparatus. It is a rare case in which the chain from the petrol can to the state has been publicly closed. Further tasks targeted Putin critic Evgeny Chichvarkin: reconnaissance of his Hedonism shop and his Hide restaurant in Mayfair, and a plan to abduct him. The arrests put a stop to them.

Earl was sentenced on 24 October 2025 to a total of 23 years, including 17 years in prison; Reeves to 13, Mensah to 10, Rose to 9 and Asmena to 8, as summarised by UK Counter Terrorism Policing. Only one other British verdict has described a similarly closed chain, in the case of the network of the Bulgarian Orlin Roussev, which worked for the Russian services through an intermediary.

This is what sabotage-as-a-service looks like. The client does not send an officer with a suitcase of explosives, but buys the act from people recruited online, and each successive link knows less than the one before. Cheap, fast and with deniability built in.

According to the indictment filed by Poland’s National Public Prosecutor’s Office, on 19 July 2024 four consignments containing concealed incendiary devices were sent from Vilnius, two by DHL to London and Birmingham and two by DPD to Warsaw. The first caught fire on 20 July in Leipzig, the second on 21 July in a lorry in Jabłonowo near Warsaw, and the third on 22 July in a DHL warehouse in Minworth near Birmingham. The fourth did not ignite and was intercepted. In addition, on 1 August two parcels containing clothing were sent from Warsaw to the US and Canada to test the route and delivery time.

The case readily attracts catastrophic scenarios, yet the documents speak of four fires (none in the air) and two test parcels without charges. The Polish indictment accuses one of the defendants of attempting to cause an air traffic disaster, but that is the prosecution’s assessment, not a finding of a court.

Recruitment and instructions went through Telegram, and payments, as Wirtualna Polska reported from the trial, included sums of 500 and 2,000 dollars. Vladyslav D., one of the five defendants, admitted repacking goods into four boxes in Kaunas, but denied acting on behalf of Russia. Eurojust names Russian military intelligence as the suspected client. The trial in Warsaw is ongoing.

In the early hours of 9 May 2024, an incendiary device planted the day before went off in an IKEA store in Vilnius. The perpetrator, then an underage foreign national, filmed the fire for those who had commissioned it. According to Lithuanian prosecutors, he was promised 10,000 euros for setting fire to and blowing up shopping centres, and after Vilnius he received a BMW 530. He was arrested on his way to Riga, where he was to set fire to another IKEA. The sentence of 3 years and 4 months handed down in November 2025 was not final at the time. In Poland, the same Daniil B. has been charged, among other things, in connection with the fire at the hall at Marywilska 44 and, according to the National Public Prosecutor’s Office, was instructed to film the fire and the firefighting operation. Who set the fire there is still unknown. The coordinators, Serhii Chalyi and Oleksandr Varyvoda, are in hiding, and the charges prepared against them have not been announced to them.

In Prague, on 6 June 2024, a Colombian set fire to three buses at the Klíčov depot for a promised 3,000 dollars, and photographed the fire as proof for a client using the pseudonym Adrian. He was sentenced to 8 years, and when the verdict was handed down in June 2025 the Czech prosecutor said, as quoted by Blesk, that the evidence “is, of course, not such that we could say it was commissioned or that the organiser was from the Russian Federation”. A few weeks later, Poland’s National Public Prosecutor’s Office charged the same man with setting fire to builders’ merchants in Warsaw and Radom on the orders of a person linked to the Russian services. Journalists from LRT, DW and ČT linked the “Adrian” account to a Cuban, Oemis Romagoza Durruthy, a salsa instructor from Petrozavodsk in Russia. One perpetrator, three fires, two countries and two different assessments by prosecutors.

In Estonia in January 2025, a Moldovan perpetrator first set fire to a shop in Osula, which investigators described as a trial task, and then, on 31 January, to the Slava Ukraina restaurant in Tallinn. The Estonian Prosecutor’s Office said the task had been given to him by a person acting in the interests and on behalf of the GRU. His accomplice and cousin did not know about the GRU.

Why these videos? First and foremost as a receipt for the client. Romania’s counter-intelligence service, the SRI, however, explicitly described their propaganda function in a foiled plan to set fire to a recycling plant in Bragadiru near Bucharest. The photo and video documentation “was necessary for using the data in fake news campaigns” on social media. When, on 1 August 2024, a facility in another town of the same name burned down after an electrical short circuit, Russian Telegram channels announced a successful operation, illustrating it with photos of other fires. A fire that no one started could be sold, too. This does not prove, however, that every video ended up in propaganda.

Russia uses the same network of intermediaries to hunt down opponents abroad. That, at least, is what federal prosecutors in New York claim. According to their press release and the indictment of 15 September 2026, a network of the Russian services first commissioned surveillance and then the killing of two dissidents. For photographs and videos of one of them, who lives in the US, 1,000–1,500 dollars was offered, and 40,000 to “eliminate” him. The other lives in exile near Vilnius. The man recruited to follow him accepted 200 dollars for photographs and was offered about 25,000 for the killing. Both recruits refused to kill.

The five defendants include Yuri Khrameev, according to the indictment a former colonel in the Russian services, his son Kirill, described as an FSB officer, and the Cuban Oemis Romagoza Durruthy. All of them are at large and are presumed innocent. The indictment also accuses Durruthy of paying for the Prague operation and coordinating an attack on a Lithuanian manufacturer of radios for the Ukrainian military. His role is supported by a journalistic investigation, and in January 2026 Eurojust attributed operations in Czechia, Poland, Lithuania and Romania to a single group. The Khrameevs’ service status and the state commission, however, rest solely on the prosecution’s claims.

Not every fire has an address in Moscow. In October 2025, a Swedish prosecutor discontinued the investigation into the Sweden–Latvia cable severed in January 2025 by the vessel Vezhen. The cable “has not been damaged through a deliberate act”, but by a combination of a storm, anchor faults and probable crew errors. In the Nord Stream case, Germany’s Federal Prosecutor General charged a Ukrainian, Serhii K., with acting on the orders of Ukrainian state bodies. It is a charge, not a verdict, but the hypothesis of Russian perpetrators has lost its footing.

After the letter bombs sent in Spain in late 2022, US officials spoke anonymously to CNN of Russian intelligence directing the far-right Russian Imperial Movement. The appeal court, in convicting a retired Spaniard with pro-Russian sympathies, found that he had no connection with any group or organisation. After the blackout on the Iberian Peninsula on 28 April 2025, the Spanish government found no evidence of a cyberattack, and grid operators at ENTSO-E pointed to technical causes in voltage control. After the arson attack on a defence plant in Pardubice, the head of Czech counter-intelligence, BIS, pointed to left-wing, pro-Palestinian radicals.

There are also cases suspended between politics and the courts. After an explosion under a freight train in Mika and damage to the overhead line in Gołąb in November 2025, the prime minister named the Russian services within three days, and the National Public Prosecutor’s Office charged two Ukrainians with acting on behalf of Russian intelligence. Both fled to Belarus. Both incidents were recorded by cameras left at the scene, but the link connecting the perpetrators to Moscow has not been shown publicly. There will be no trial as long as the suspects are out of reach. Here the legal lag may never end.

So what do we know for certain? The Russian state, or entities under its control, commissioned operations in the West below the threshold of war: arson attacks, strikes on the logistics of aid to Ukraine, preparations to abduct a Kremlin critic. British courts reconstructed these chains in full; Lithuanian, Romanian, Czech and Estonian courts convicted perpetrators. The pattern repeats itself: recruitment via Telegram, intermediaries, hired perpetrators with no knowledge of the client, small fees, trial tasks, test parcels and a recording as proof of execution.

What do we not know? How many operations went undetected, who is behind most of the cases suspended in suspicion, and why there are fewer proven cases after 2024.

The number of disclosed cases is not a thermometer of Russian activity, because it grows retroactively. One US case yielded ten incidents, one British verdict four of the five most fully proven, and the Prague depot waited more than two years to enter the tally. The quality of attribution of Russian attacks matters more than the media count of fires, because every premature suspicion that later collapses, as with the Vezhen or the Spanish letters, undermines credibility where the evidence is strong. Earl’s network was broken up and Durruthy was tracked down not by counting fires, but by working through one link after another: from the petrol can to the chat, from the chat to the intermediary, from the intermediary to whoever pays.

How quickly material gathered “in the heat of the moment” accumulates was shown by the three weeks in which I was finishing this text. A chronology kept in parallel from 30 August to 21 September, that is over 23 days, counts more than twenty separate incidents, from Luxembourg to the Moldovan–Ukrainian border and from the Baltic to the Black Sea. For two days in a row, plants burned in Lublin and Skarżysko-Kamienna. On 11 September there was a fire and explosion at a facility of the Bulgarian ammunition manufacturer EMCO, and on 16 September a fire at a defence plant in Snina, Slovakia. Half of the entries, however, are drones and their debris: an unmanned aircraft with explosives in a field in Romania’s Vaslui county, a Gerbera-type drone fished out of the Baltic near Rusinowo, and unidentified drones that led to the closure of the airspace over Luxembourg’s Findel airport on 18 September. In addition, on 14 September and during the night of 14–15 September, four incidents were recorded: a drone near Rusinowo, flares fired by a Russian frigate towards a Danish helicopter, an unmanned aircraft near Wunstorf air base, and a drone carrying explosives that flew into Lithuania from Belarus and was shot down by Italian Eurofighters. From 14 to 21 September there was not a day without a new entry, including after 16 September, when I closed the sample.

Apart from the overt incident involving the Russian frigate, during this period Russia was named directly almost exclusively by intelligence services, prosecutors and diplomats. On 8 September, Hungary expelled ten Russian diplomats. The same day, Moldovan police arrested a man who, according to investigators, had been recruited by the Russian services, and Romania’s SRI announced it had foiled a Russian-coordinated operation in which a Russian citizen photographed, among other things, bases used by NATO and Ukrainian Antonov aircraft. A day later, in the UK, Joshua Cammidge was charged with assisting Russian intelligence and preparing sabotage, and on 15 September prosecutors in New York unsealed the indictment described above. The fires and drones do not yet carry such a signature. In Skarżysko, as I wrote above, there are still no charges. In Lublin, prosecutors are investigating both arson and a malfunction. Sabotage at EMCO is alleged mainly by the company itself, and in Snina the Slovak defence minister pointed to renovation work as the probable cause. The operators of most of the drones have not been identified, and the origin of the one shot down over Lithuania is under investigation. Some of the debris off the Romanian coast and the explosions near the Moldovan border may be a side effect of the war over Ukraine and in the Black Sea rather than sabotage in the West. This is a working hypothesis, not a finding.

The September wave therefore does not, for now, shift the tally for 2026, in which only Leipzig offers strong grounds to blame Russia. What it does show well is why that tally is cautious. From the second week of the month, incidents were added almost daily, and new links emerged only where counter-intelligence and prosecutors were at work, not where firefighters were putting out fires. With attribution lag measured in months and years, most of this material can be reliably assessed in six months at the earliest. Some of it will then join the most thoroughly documented cases, some, like the cable severed by the Vezhen, will turn out to be an accident, and about some we will learn nothing certain. Anyone who today counts these incidents wholesale as “Russian attacks” will be writing statistics that will have to be corrected in both directions two years from now.

Russian sabotage in the West: a fire lasts a night, evidence takes years to gather, so count the links, not the fires.

Author: Artur Żak