As European security services expose Russian sabotage networks, sabotage activity is rising sharply inside Russia itself, with arson attacks and other clandestine operations becoming increasingly common. According to the InformNapalm Fire OSINT database, 242 sabotage incidents have been recorded in Russia in 2026 to date — more than in 2024 and 2025 combined. The trend adds a new dimension to the European debate: is defending against Russian sabotage enough, or can Moscow itself be made to bear higher costs for its aggression?

European infrastructure in the crosshairs

In August 2026, a fire broke out at a facility belonging to Estonian defense company Milrem Robotics, known for producing unmanned ground systems, and supplying Ukraine. On September 29, Estonia’s Ministry of Foreign Affairs said the country’s internal security service had established that the arson attack was commissioned by Russia. Tallinn summoned a Russian diplomat to lodge a protest.

On September 14, a fire broke out at an industrial site in Brașov, Romania, near the CARFIL SA defense plant, part of the ROMARM group. On October 26, the Romanian Intelligence Service (SRI) announced that it had uncovered a sabotage network coordinated from Russia. According to the service, the network’s tasks were not limited to Romania: potential targets included defense and industrial facilities in other European countries.

These were not isolated incidents. In February 2026, researchers from the International Centre for Counter-Terrorism (ICCT) and GLOBSEC documented 151 cases of Russian sabotage operations in Europe since the start of the full-scale invasion. By the end of September, their database contained more than 180 incidents, including completed, failed, and foiled attacks. Most involved arson or the use of explosive devices.

An important methodological caveat: growth in a cumulative database does not necessarily mean that the number of attacks increased by the same amount in 2026 itself. Researchers identified some incidents from previous years retrospectively. Nevertheless, new cases — including those in Estonia and Romania — confirm that the campaign is continuing and that the defense industry remains among its main targets.

An October study by the Stockholm Centre for Eastern European Studies (SCEEUS) noted that Russia is increasingly linking sabotage activity in Europe to efforts to disrupt military assistance to Ukraine and defense production.

Arson as a tool of physical disruption and information influence

Russian sabotage operations have a distinctive feature: even relatively low-cost attacks can generate a disproportionately large information impact.

The investigations into arson attacks on commercial properties in Poland and Lithuania are illustrative. In April 2026, Polish prosecutors filed an indictment against five individuals in a case involving a sabotage network that, according to investigators, operated in the interests of Russian intelligence.

Prosecutors established that during the April 2024 arson attack on an OBI store in Warsaw, the perpetrator filmed his actions, and some of the footage was later published by Russian propaganda outlets. During the arson attack on an IKEA store in Vilnius, members of the group also filmed the fire and the work of emergency responders for subsequent propaganda use.

Another member of the network was instructed to go to the Marywilska 44 shopping center in Warsaw and film the fire that broke out there on May 12, 2024. The video was passed to a handler based in Russia.

In other words, in the specific cases examined by investigators, filming the fires was not an incidental by-product of the crimes but part of the assignment.

The use of operatives holding Ukrainian passports can also have an information impact.

After sabotage on the Polish railway network in November 2025, Poland’s Ministry of Digital Affairs documented a campaign aimed at shifting responsibility onto Ukraine and discrediting Polish security services. Pro-Russian accounts circulated claims about alleged Ukrainian terrorism.

On November 6, 2026, the Foreign Intelligence Service of Ukraine separately warned of the systematic recruitment of socially vulnerable people, including Ukrainian citizens, to carry out sabotage in Europe.

For Russian intelligence services, this is a way to obtain operatives while simultaneously creating material for information operations. At the same time, the citizenship of a detained suspect does not establish who commissioned the operation or what state, if any, was behind it, and the involvement of a specific individual cannot justify accusations against Ukrainian refugees as a group.

242 sabotage incidents inside Russia in 2026 to date

Alongside Russia’s sabotage campaign in Europe, another trend is developing: growing underground activity inside Russia itself.

Since the start of the full-scale invasion, InformNapalm volunteer intelligence community has maintained the Fire OSINT database, which systematizes publicly documented incidents on Russian territory. The database allows events to be tracked by year, month, date, incident type, and target category.

A separate analysis of the “Sabotage” category shows a notable trend:

Moreover, the 242 incidents recorded in 2026 exceed the combined total for 2024 and 2025, when 239 cases were documented.

In total, from the start of the full-scale invasion through November 6, 2026, the database contains 569 incidents in this category.

The sample includes arson attacks targeting railway relay cabinets, military enlistment offices, and telecommunications towers, as well as other forms of infrastructure damage and other publicly documented actions by underground actors. The temporarily occupied territories of Ukraine are excluded from the count. Drone attacks, missile strikes, and other types of incidents are tracked separately.

This is a fundamental methodological distinction: the figures refer specifically to the sabotage category, not to the total number of fires, explosions, or combat strikes.

An incident’s inclusion in the database confirms that it has been documented through open sources, but it does not mean that Ukrainian intelligence services necessarily organized it. Some cases may involve autonomous actions by ideologically motivated underground groups, and attribution of each operation requires additional evidence.

The database is updated continuously, and the most recent events may be added with a delay while OSINT verification is carried out.

Despite these limitations, the compiled statistics show a substantial increase in the number of publicly documented sabotage incidents in Russia. The increase in recorded incidents does not, on its own, establish the overall scale of underground activity, but it does indicate growing pressure on Russia’s internal security system.

From passive defense to proactive deterrence

As Russia seeks to raise the cost to Europe of supporting Ukraine, the growing vulnerability of Russia’s home front raises a different strategic question for European governments: can Moscow itself be made to bear higher costs for continuing its aggression?

In March 2026, the European Council on Foreign Relations published a study titled “From Shield to Sword: Europe’s Offensive Strategy for the Hybrid Age.”

Its authors argue that Europe’s traditional defensive model should be complemented by more active tools for countering hybrid threats — in the financial, information, cyber, and other domains.

The logic behind this concept is that protecting individual sites does not remove an adversary’s ability to organize new attacks.

A January study by the Royal United Services Institute (RUSI) separately examined the financial infrastructure of Russian sabotage networks. The researchers noted that financial intermediaries and payment channels used to compensate operatives can be proactively identified and subjected to sanctions or law-enforcement action.

Yet even effective disruption of individual networks does not guarantee an end to the broader campaign.

In October, SCEEUS researcher Minna Ålander warned that classical military deterrence is poorly suited to sabotage deliberately organized below the threshold of open armed conflict. In her view, what is needed is a sustained series of measures that constrain Russian operators and gradually raise the costs for Moscow.

Ukraine’s experience adds another dimension to this discussion.

Support for Ukrainian defense and intelligence capabilities, including operations against lawful military targets on Russian territory, can be viewed as one mechanism for increasing the cost of Russian aggression.

Conclusion: sabotage warfare has a two-way dynamic

Two parallel processes have become increasingly visible in 2026.

The first is the continuation of Russia’s sabotage campaign in Europe, aimed at intimidation, disruption of infrastructure, and weakening support for Ukraine.

The second is the growing number of publicly documented sabotage incidents inside Russia itself, alongside a separate campaign of Ukrainian strikes against targets forming part of Russia’s military-economic potential.

In 2026 to date, InformNapalm volunteer intelligence community has recorded more sabotage incidents inside Russia than in the previous two years combined.

This is a clear statistical trend. It does not provide grounds to attribute every successful act of sabotage to Ukrainian intelligence services. It does, however, show that the security of rear-area infrastructure is becoming an increasingly significant problem for Russia itself.

Moscow initiated the full-scale war against Ukraine and continues to use sabotage as a tool of pressure against European states. But the same dynamics — rising costs, disruption, and the need to protect numerous potential targets — are increasingly affecting Russia itself.

For Europe, the key issue is not to mechanically replicate Russian methods, but to determine how counterintelligence, proactive disruption of agent and financial networks, sanctions pressure, and support for Ukraine’s lawful defense capabilities can be combined.

The growing vulnerability of Russia’s home front creates new conditions in which Moscow must account not only for the cost of attacks on other countries’ infrastructure, but also for the cost of protecting its own.

This article was prepared by Andrii Lisitsyn specifically for readers of the InformNapalm volunteer intelligence community website. Sharing and republication with an active link to the source are welcome. (Creative Commons — Attribution 4.0 International — CC BY 4.0).

InformNapalm does not receive any financial support from any country’s government or large donors. Only community volunteers and our readers help us to maintain the site. You can also become one of the community volunteers or support InformNapalm with your donations.