European defence executives and military-industrial sites linked to Ukraine are facing a widening security threat, as suspected sabotage, surveillance and assassination plots increasingly target the people and infrastructure behind Kyiv’s weapons supply. The pattern spans at least four countries and cases of sharply varying strength: an Estonian court has already convicted someone over one arson attack, while another case – a detained Swedish couple who turned out to be Russian anti-war emigrants – shows how easily suspicion can outrun evidence. NATO has publicly linked at least one case, the 2024 plot against Rheinmetall’s chief executive, to a broader campaign it says is aimed at undermining European support for Ukraine.
Estonia’s Confirmed And Suspected Cases
The most immediate case is Estonia, where authorities are investigating an arson attack on a building on Betooni Street in Tallinn used by Milrem Robotics, overnight from August 14 into August 15. Estonian Prime Minister Kristen Michal said suspects had been identified and that one line of inquiry was “a possible act of sabotage and the involvement of Russia,” while Milrem chief executive Kuldar Väärsi told Reuters the attack would not disrupt deliveries this year or next. The company, majority-owned by UAE-based EDGE Group, supplies unmanned ground vehicles to Ukraine.
Estonia has already secured a conviction in a related case: in August, the Harju County Court found that a 2025 arson attack on a Ukrainian restaurant and a supermarket in Tallinn had been ordered by Russia’s military intelligence service, the GRU, sentencing a Moldovan man to six and a half years in prison and an accomplice to two and a half. Estonia’s domestic intelligence chief, Margo Palloson, said the country’s threat level remained unchanged despite the Milrem fire, noting Russia “poses a long-term existential threat to Estonia.” The Milrem case remains under investigation and has not produced a comparable legal finding.
A Foiled Plot In Germany
Germany has its own unresolved case. German security services warned Stefan Thumann, head of drone manufacturer Donaustahl, shortly before Christmas 2025 that Russian military intelligence was allegedly preparing an operation against him, after a tip from a foreign intelligence agency. Prosecutors later arrested a Ukrainian man, identified only as Serhii N., in Spain, and a Romanian woman, identified as Alla S., in North Rhine-Westphalia, accusing the pair of monitoring and photographing Thumann’s home and Donaustahl’s headquarters between December 2025 and March 2026. Germany’s domestic intelligence service classifies the case as a suspected planned assassination, though the federal investigating judge’s arrest warrant cites only suspected intelligence-agent activity rather than an assassination charge.
Bundestag member Bastian Ernst said available information pointed to a Novichok-class nerve agent as the intended method, according to Bild, though no court has confirmed that detail and it remains based on one lawmaker’s account of security-service assessments rather than a public finding. Thumann has since gone largely into hiding, changing his residence regularly; he has described the situation as being “in a duel with Russian military intelligence” for his life. Moscow has not commented on the specific case.
Sweden’s Case Shows The Limits Of Suspicion
Sweden’s episode illustrates how easily suspicion can outrun evidence. Swedish police detained two Russian nationals, identified by local media as Semjon Rusanov and Tatjana Milenina, after they pitched a tent and were seen carrying handheld radios near a cottage where Saab chief executive Micael Johansson – who lives under state protection because of what the company builds – was staying; the property did not belong to Johansson himself. The pair, who hold residence permits in Spain, said they were Russian anti-war emigrants on a hiking and fishing trip who had not visited Russia since 2022 and feared deportation precisely because of their public opposition to the war.
A Swedish court later overturned an initial deportation order, finding insufficient grounds, and the pair’s lawyer said they had not been formally notified of any criminal suspicion. Saab manufactures the JAS 39 Gripen fighter jet, which Ukraine agreed in May to purchase in a deal for up to 20 aircraft. The case does not establish Russian intelligence involvement, but Swedish authorities said the presence of two foreign nationals with radios near a protected executive’s residence warranted investigation regardless.
A Pattern NATO Has Confirmed
The clearest confirmed case predates all three: in 2024, US and German intelligence uncovered a plot targeting Armin Papperger, CEO of Rheinmetall, Europe’s largest ammunition producer for Ukraine. NATO’s deputy assistant secretary-general, James Appathurai, described the Rheinmetall case in January 2025 as part of a broader sabotage campaign, telling the European Parliament that Russian operations in NATO countries had included “train derailments, arson attacks, attacks on politicians’ property, plots to assassinate industry leaders… but there were other plots as well.” The Kremlin’s spokesman, Dmitry Peskov, dismissed the original reporting as “yet another hoax” lacking serious evidence.
Russian officials have not concealed the intent behind this pressure. Foreign Minister Sergei Lavrov said in an August 14 interview with state broadcaster VGTRK that Moscow would “adopt much harsher methods to destroy everything that enables the West to fuel Kiev’s war machine,” adding that such measures were already under way. Former Russian President Dmitry Medvedev has made the point more bluntly, warning European leaders weighing a postwar peacekeeping force in Ukraine that supplying further military aid to Kyiv “means war with NATO.” A separate senior NATO official has cautioned against the word “hybrid” for these operations, telling CNN in 2024 that arson and assassination plots are lethal acts that may not fall below the threshold the term implies.
The pattern also has a documented Cold War precedent. Files examined after German reunification showed the KGB and East Germany’s Stasi trained, armed and sheltered the Red Army Faction, the West German far-left group responsible for a string of 1970s and 1980s bombings, assassinations and kidnappings, including the 1977 abduction and killing of industrialist Hanns Martin Schleyer. Soviet-bloc intelligence services extended comparable support to other militant networks in Western Europe during the same period, using ostensibly independent radical groups to strike Western targets while preserving official deniability. Individual cases today still vary widely in how far they have been legally established, from Estonia’s court conviction to Sweden’s overturned deportation order, but the recurring target – the executives, factories and supply routes sustaining Ukraine’s war effort – traces back to the source Russian officials have named themselves.
