Russia launches wave of cyber attacks on European weapons factories

The strategy allows the Kremlin to maintain plausible deniability whilst probing Nato's willingness to respond.

Intelligence officials believe the attacks have been deliberately calibrated to remain just below the threshold that might invoke Article 5, the alliance's collective defence commitment.

A Nato official said: "In recent years, Russia has accelerated its destabilisation campaigns against Allies through cyber attacks, assassination attempts and acts of sabotage."

The most recent incident saw a building at Milrem Robotics, a Tallinn-based drone manufacturer and one of only two foreign suppliers of unmanned ground vehicles to Ukraine's military, torched on August 15.

Latvian authorities subsequently arrested three of their own citizens in connection with the arson.

Estonia's prime minister, Kristen Michal, confirmed that investigators were examining whether the blaze was linked to Russia and constituted sabotage.

Days earlier, on August 10, a lorry fire near a storage facility triggered a devastating explosion at EMCO, a major Bulgarian private arms producer manufacturing 155mm artillery shells for Kyiv.

On August 13, an unexplained blaze erupted in a gunpowder processing unit at KNDS Ammo Italy's munitions plant in Colleferro, outside Rome.

In the Czech Republic, four people were detained after a fire nearly destroyed a factory belonging to arms maker LPP Holding, which produced drones and thermal optics for Ukraine.

Lithuania, meanwhile, brought charges against six individuals accused of plotting to set fire to a facility making radio-wave scanners destined for Ukrainian forces.

The GRU's modus operandi relies on its officers remaining safely within Russian borders, according to Normunds Mežviets, head of Latvia's state security service.

Instead, GRU handlers use encrypted messaging platforms such as Telegram to cultivate contacts within criminal organisations in target countries.

These contacts serve as intermediaries, distributing tasks to local recruits who receive payment in cryptocurrency and frequently have no idea they are ultimately working on behalf of the Russian state.

Eastern members such as Poland and the Baltic states have been outspoken in attributing aggression to Moscow, whilst western nations including Italy and Germany have been reluctant to point the finger for fear of escalation.

Both Italian and Bulgarian officials played down the possibility of Russian involvement in the recent blasts.

Nato Secretary-General Mark Rutte has repeatedly described Russia's suspected sabotage as "reckless and dangerous," calling for a response that is "clear, swift and decisive."

Yet with each unpunished attack, Moscow gains valuable insight into how far it can push the alliance's boundaries.

The diplomatic backchannels that once helped manage tensions between Europe and Russia have largely collapsed since the 2022 invasion, leaving fewer mechanisms to contain escalation.

According to Mr Rutte, Vladimir Putin is preparing Russia to use force against Nato "within five years," leading Western officials to view this hybrid campaign as a possible precursor to broader confrontation.