Russian-linked sabotage operations in Europe could increasingly target airports, moving trains, and defence manufacturers over the next six months, with a new intelligence assessment warning that attacks putting civilian lives at risk are now likely.
The warning comes from security intelligence company Osavul, whose first Europe’s Hybrid Threat Outlook report suggests that Moscow’s suspected sabotage campaign is moving beyond warehouse fires and relatively small-scale disruption towards attacks on critical infrastructure.
The report comes after a string of suspected sabotage incidents across Europe. In August, explosive-laden drones were discovered at Germany’s Leipzig Airport, while defence manufacturers supplying Ukraine have also been targeted. German authorities have blamed Russia for the Leipzig incident, although Moscow denies involvement.
More recently, German prosecutors arrested two Belarusian nationals suspected of planning arson attacks against buildings or critical infrastructure. The men have also been linked to an investigation into a September fire at an industrial site in Romania, close to a defence manufacturer.
Osavul’s assessment, which covers the period to April 2027, identifies aviation, rail networks, defence production, and energy infrastructure as particularly vulnerable. It considers serious disruption at a European airport and an attack on aviation or rail transport that could endanger lives to be “likely.”
Aviation has become a more frequent target, according to Osavul. It accounted for none of the Russian-linked incidents the company recorded in 2022 and 2023, but that figure rose to 19% in 2024 and 50% across 2025 and 2026.
The threat is particularly concentrated along Europe’s eastern flank. Osavul found that eight EU countries bordering Russia, Belarus or Ukraine accounted for 60% of the incidents it recorded, despite making up just 18% of the EU’s population.
Another concern is the growing use of so-called ‘gig saboteurs’, civilians recruited online and paid to carry out attacks rather than professional intelligence operatives.
Osavul estimates that around 95% of identified perpetrators fall into this category. Their relative inexperience can make them easier to detect, with its database showing that approximately one-third of covert Russian-linked incidents were disrupted before causing damage.
A cross-border investigation published in September found that Russian intelligence was allegedly recruiting people, often in financial difficulty, to carry out surveillance and sabotage across Europe.
Energy infrastructure is another concern. Osavul points to a destructive cyberattack against Polish renewable energy facilities and a combined heat-and-power plant in December 2025 as evidence of the potential threat. It assesses a further destructive cyberattack against a European energy supplier as a realistic possibility.
Dmytro Plieshakov, co-founder and CEO of Osavul, said: “We’re seeing a concerning shift to fewer attacks but on bigger targets. Rather than arson at warehouses or shops, future attacks are looking increasingly likely to focus on disrupting aviation, trains, defence and energy, possibly with a risk to life.”
The report calls for stronger counter-drone defences at airports, tougher action against suspected subsea cable interference, and greater efforts to dismantle the networks recruiting paid saboteurs.
