Recent Increase of Hybrid Attacks Against Defense Sector in Europe

On August 25, Slovak authorities claimed to have disrupted a planned arson attack against Skyeton drone manufacturing facility near Prešov, a site that produces unmanned systems for the Ukrainian military. [1]

The same day, a suspected sabotage against German energy infrastructure was reported. German authorities reported that improvised devices had been used in an attempt to deliberately short circuit a substation connected to the Jänschwalde power complex. [2]

August 25, Germany also publicly accused Russia of being responsible for the recent drone attack at Leipzig/Halle Airport. German officials elevated the country’s threat assessment, announced diplomatic measures, and described Germany as a frequent target of hybrid attacks. [3][4][5]

Assessment

Recent reporting points to a sharp rise in physical attacks and sabotage attempts across Europe, primarily aimed at disrupting entities directly or indirectly involved in bringing aid to Ukraine. This includes attacks against defense companies involved in producing weapons for Ukraine, but also airports, logistics networks, and energy infrastructure. The breadth of these attacks suggests that they are part of a sustained effort from Russia to disrupt Western aid to Ukraine.

A notable characteristic of these incidents is the prominent use of proxies and intermediaries. Russia’s ability to send trained intelligence operatives to Europe has been degraded as many have been expelled from Russian embassies where they had their cover. Instead, Russia has begun recruiting “disposable” agents among local criminals through online channels like Telegram.

For security teams supporting, among others, defense sector, critical infrastructure and logistics connected to Ukraine, these incidents highlight the need to integrate physical security and insider risk considerations into existing security programs. Cybersecurity operations should view physical sabotage, reconnaissance activity, suspicious site visits, and attempts to recruit local actors as part of the same threat landscape as cyberattacks, rather than as separate security concerns.

If you or your organization have concerns about the topic above or need support, please reach out to your Truesec contact for further assistance.

References

[1] OCCRP, “Slovak Police Foil Possible Napalm Attack on Factory Producing Drones for Ukraine”: https://www.occrp.org/en/news/slovak-police-foil-planned-napalm-attack-on-factory-producing-drones-for-ukraine
[2] CNN, “Germany blames Russia for drone attack on Leipzig airport”: https://edition.cnn.com/2026/09/01/europe/leipzig-drone-germany-russia-intl
[3] Märkische Allgemeine Zeitung, “Anschlag auf Umspannwerk: Innenminister spricht von Sabotage des Stromnetzes”: https://www.maz-online.de/brandenburg/brandenburg-raketen-anschlag-auf-umspannwerk-am-kraftwerk-jaenschwalde-stromausfall-verhindert-QZIRYWEMBRGHRFAT6YQ3R7HRAI.html
[4] Berliner Morgenpost, “Sabotagehandlungen: Innenminister spricht von zwei Kurzschlüssen an Kraftwerk”: https://www.morgenpost.de/politik/article413026805/mit-raketen-beschossen-anschlag-auf-kraftwerk-in-brandenburg-veruebt.html
[5] Euronews, “Improvised explosive devices found near German power plant, police say”: https://www.euronews.com/my-europe/2026/09/01/rockets-fired-at-substation-in-brandenburg-in-suspected-deliberate-attack