Key topics:
A Series of Incidents at European Defense Industry Sites
Official Rhetoric: Direct Threats Against Europe, the United Kingdom, and the Baltic States
The Z-Community: A Renewed Rally-Around-the-Flag Effect Driven by Escalation
Executive Summary
The August visit of CIA Director John Ratcliffe to Moscow was a public signal of a trajectory already well underway. As the costs of ending the war rise for the Kremlin - economically, politically, and in terms of regime control - the key question is increasingly not when Putin can end the war, but whether the regime can afford for the war to end at all. Since at least April, EK Stratcom has documented a steady shift in Kremlin rhetoric, propaganda, hybrid operations, and internal signaling toward a scenario in which confrontation with Europe moves from a long-term contingency to a near-term risk. The events of August and early September suggest that this trajectory is now moving beyond rhetoric.
By EK Stratcom’s count, at least 12 incidents at defense-related sites and critical infrastructure facilities were recorded in Europe over the course of August and early September 2026, most of them directly connected to military supplies to Ukraine. At least four involved the appearance of drones on reconnaissance or sabotage missions, predominantly in Germany, and at least another seven were arson attacks, fires, and explosions at military plants and depots, spread across Estonia, Poland, Slovakia, Bulgaria, Germany and Italy. So far only one case has been officially attributed: the attempted sabotage of a Ukrainian An-124 at Leipzig airport on the night of August 5, for which Berlin assigned responsibility to Russia on September 1. All the other cases remain under investigation. On August 6, EK Stratcom immediately identified (1) the Leipzig drone incident as following a familiar Russian intelligence-linked information pattern. The SVR-linked Svarshchiki channel reported it first and pushed an Iran false-flag narrative. As EK Stratcom reported, the same channel had earlier helped shape the propaganda around the assassination of pilot Maxim Kuzminov in Spain, when Russian intelligence-linked sources were the first to proudly signal that Russian security services stood behind the killing of a Russian defector in Europe.
According to The Telegraph on August 23 (2), the Kremlin recruits local criminals as perpetrators. Earlier data indicate (3) that 95% of perpetrators are ordinary citizens without any formal affiliation to Russian intelligence agencies. According to EK Stratcom sources, these operations are mostly carried out by the GRU through intermediaries who recruit coordinators in European countries. Those coordinators, in turn, identify and hire the individuals who carry out the operations, most often either people holding European passports, which makes cross-border movement easier, or individuals of Ukrainian origin with legal residence in Europe, particularly when a false-flag operation is intended. According to Bild (4), two suspects identified following the Leipzig drone attack in August are a Russian-born Latvian passport holder and a Belarusian citizen with a Russian passport. This could signal a shift toward more demonstrative Russian operations. A similar pattern emerged in Poland in June, when two Belarusians were detained over the killing of a Russian opposition activist (5).
Beyond the practical objective of disrupting European defense capacity, the current campaign also relies on a familiar tactic of intimidation. According to EK Stratcom data, such operations have their own KPIs. The objective is not necessarily limited to sabotage itself: in many cases, the information campaign built around the operation, and the political, social or economic effect it produces, are equally important.
The intended outcome may be to generate fear, destabilize public opinion, influence political decision-making, create economic disruption, or amplify existing tensions.
The Kremlin is now signaling both its readiness to escalate and the growing likelihood of further escalation, calculating that this could deepen divisions within NATO. Russian Z-bloggers linked to the authorities say this outright. Writing about the sabotage, Alexander Kots, war correspondent for Komsomolskaya Pravda, says that
“the Baltic states and Poland are nodding confidently in Moscow’s direction. Italy and Bulgaria are staring at the floor and mumbling about a short circuit. Article 5 hangs on the wall like an axe in a glass case marked ‘break in case of war’ - and nobody dares touch the glass” (6).
What was fundamentally new in August was the synchronization of the hybrid campaign with statements by the country’s most senior officials. On August 14, Sergey Lavrov declared that
“we will adopt much harsher methods to destroy everything that enables the West to fuel Kiev’s war machine. We are already doing this, and they are already moaning,”
a statement that directly contradicts the dominant propaganda narrative about staged provocations designed to blame Russia. On September 2, responding to Berlin’s measures, Dmitry Medvedev went further, calling the sabotage “the weakest form of punishment for their sins” and promising “a direct strike against all German production of military equipment for the Bandera clique. And quite possibly against certain other places in Berlin as well.” The focus has also shifted to the Baltic region, which the Kremlin increasingly views as the most likely theater of a potential conflict with Europe. On September 1, Maria Zakharova threatened a “resolute and devastating” response to any further escalation in the region, and on the same day Deputy Foreign Minister Alexander Grushko called the Baltic “a zone not only of military rivalry, but of military confrontation” with the potential for uncontrolled escalation.
The shift from nominal threats to their implementation means that in the conflict (7) inside the elite between the party of “permanent war” and the party of a “strategic pause,” the former has seized the initiative, and the risks of escalation are therefore multiplying.
The recent visit of CIA Director John Ratcliffe to Moscow underscores how seriously Washington is treating the risk: according to Politico (8), he warned Moscow against escalating the conflict with America’s NATO allies, in particular Estonia, Latvia, and Lithuania.
The reaction of the Z-community confirms this dynamic and contrasts sharply with the mood in the spring, when most Z-authors were criticizing Russia’s political and military leadership.
Two things produced the change: the Kremlin has satisfied the demand for escalation, and the July repressions were directed at Z-bloggers themselves.
War correspondent Roman Alyokhin, who was designated a foreign agent over his criticism and who was still calling for a halt to the fighting as recently as the first half of 2026, now writes of the sabotage in Europe that “this is very good” and that “military plants continue to burn in Europe and this must continue,” while the Z-analyst Yury Kotenok moves on to concrete proposals:
“Who can guarantee that a truck carrying a ton of RDX will not drive into NATO headquarters, as happened during the Chechen war, and that everything and everyone there will not be sent flying head over heels? Nobody. But whatever happens, they will pin this on us anyway. So maybe it is time?..”
Channels close to the security bloc, such as Two Majors, meanwhile continue to hold the official line about fabricated sabotage intended “to blame Russia for hybrid attacks.”
The divergence between public propaganda and the actual demand within the pro-war Z-community is a clear sign that the provocation narrative is being retained as insurance in case of attribution, rather than as a reflection of any real position.
A Series of Incidents at European Defense Industry Sites
These incidents fall into three overlapping categories: drone reconnaissance or sabotage missions; arson attacks, fires and explosions; and combat-drone airspace violations. The drone sightings in August occurred mainly in Germany, with one incident in Romania:
August 4-5: an attack at Leipzig airport against a Ukrainian An-124 cargo aircraft;
August 6-7: drones over the Bundeswehr’s “Patriot-Werft” military base in Mechernich, where Patriot air defense systems are repaired (North Rhine-Westphalia, Germany) (9);
August 10-11: a drone detected at Hannover airport (10);
August 20: the destruction of a naval drone carrying explosives near Romania’s Neptun Deep offshore gas platform in the Black Sea (11).
The arson attacks, fires, and explosions recorded in August and early September affected a larger number of countries: Estonia, Poland, Slovakia, Germany, Bulgaria, and Italy.
August 10: a fire and explosions at an ammunition depot belonging to EMCO, a company that exports weapons to Ukraine (Tryavna, Bulgaria) (12);
August 13: a fire and explosions at the KNDS Ammo Italy ammunition plant, which supplies ammunition to Ukraine (Colleferro, Italy) (13);
August 14-15: the arson of a building belonging to the defense company Milrem Robotics, which supplies unmanned ground combat vehicles to the Ukrainian armed forces (Tallinn, Estonia) (14);
September 2-3: an attempted act of sabotage using incendiary devices opposite the headquarters of the technology company Rohde & Schwarz, which had signed a memorandum of cooperation with the Ukrainian drone manufacturer Pegasus Arms that spring (Munich, Germany) (24).
Taken together with EK Stratcom’s source reporting, the concentration of incidents around Ukraine-linked defense supply chains suggests that most should be treated as a single cluster within the Kremlin’s hybrid escalation campaign.
This intimidation logic mirrors the Kremlin-promoted campaign about the “inevitability of mobilization,” examined in EK Stratcom’s recent report (25).
Official Rhetoric: Direct Threats Against Europe, the United Kingdom, and the Baltic States
Against the background of this series of sabotage attacks across Europe, the escalatory rhetoric of Russia’s most senior officials has clearly intensified, ranging from a continuation of Russia’s established threats against Europe to unambiguous hints at Moscow’s involvement in the acts of sabotage. The most aggressive statements in August came from Foreign Minister Sergey Lavrov, who said outright on August 14 that
“We will adopt much harsher methods to destroy everything that enables the West to fuel Kiev’s war machine” (26),
a statement strikingly at odds with the Kremlin’s dominant propaganda narrative about “staged provocations to blame Russia.” Later, on August 23, he stated that “Moscow has the right to regard the participation of European countries in strikes on Russian territory as participation in the war” (27) “with all the consequences that follow” (28). Earlier, on August 8, Deputy Chairman of the Security Council Dmitry Medvedev also issued threats:
“The West is confident that it will be able to quit the game in time, but in vain […] Retribution awaits not only the direct perpetrators of the crimes, but also those who commissioned them” (29). On September 2, responding to Berlin’s measures, he stated (30) that “sabotage is the weakest form of punishment for their sins. They deserve a direct strike against all German production of military equipment for the Bandera clique. And quite possibly against certain other places in Berlin as well”.
In recent days, statements about the Baltic region, which the Kremlin sees as the most likely theater of a potential conflict with Europe, have been especially loud. On September 1, Foreign Ministry spokesperson Maria Zakharova first declared that “the Russian side’s response to the initiators of these insane anti-Russian schemes will be resolute and devastating in the event of further escalation of the military and political situation in the Baltic” (31), and on the same day Deputy Foreign Minister Alexander Grushko described the Baltic region outright as “a zone not only of military rivalry, but of military confrontation, with an enormous risk of unforeseen incidents of a military nature carrying the potential for escalation, including uncontrolled escalation” (32). Earlier in August, meanwhile, Russian officials had placed particular focus on the United Kingdom, against the background of increased British military support for Ukraine: “we have the right to regard the proudly announced direct involvement of British missile forces in strikes against the Russian Federation as participation in the war, with all the ensuing consequences” (Lavrov, August 23) (33); “the response to Ukrainian strikes on Russian territory using British weapons may be directed at any British military facilities and equipment in Ukraine and beyond” (34) (Zakharova, August 27); “That is a secret, a military secret” (Vladimir Putin, answering a question about Russia’s capacity to strike plants in the United Kingdom, September 1) (35). Unlike earlier statements by members of the Russian elite, these recent remarks are clearly synchronized with specific attacks on European infrastructure.
This indicates that the Kremlin is moving from escalatory rhetoric to its implementation, which means that in the conflict (36) inside the elite between the party of “permanent war” and the party of a “strategic pause,” the former has seized the initiative. In the medium term, this threatens real escalation in the European theater, and above all in the Baltic region, as Foreign Ministry officials state directly.
The Z-Community: A Renewed Rally-Around-the-Flag Effect Driven by Escalation
The pro-war Z-community has greeted the current phase of hybrid escalation in Europe and the intensification of strikes on Ukraine with undisguised delight, which contrasts noticeably with the mood this spring, when most Z-authors were criticizing the actions of Russia’s political and military leadership. On the one hand, this is connected to the fact that the Kremlin has effectively satisfied the Z-bloggers’ demand for escalation; on the other, the mood in pro-war circles has also been shaped by the July repressions against Z-bloggers, which EK Stratcom wrote about earlier (37). The most striking changes are visible in the rhetoric of war correspondent Roman Alyokhin, whom the Russian authorities designated a foreign agent over his criticism. In the first half of 2026 he consistently called for a halt to the fighting and for de-escalation; now he says of the Russian sabotage in Europe that “this is very good” and that “Military plants continue to burn in Europe and this must continue. […] We have learned sabotage work as well” (38). He also openly welcomed Lavrov’s hint at Russian involvement in the sabotage:
“The words are clearly aimed at escalation. […] These will no longer be merely words; we will begin to train the adversary to expect that words are immediately followed by action. We are thinking and waiting!” (39).
Lavrov’s words were also endorsed by MIG of Russia, a Telegram channel close to the security bloc, which accompanied its post with the headline “On the threshold of a major escalation, or what Lavrov’s words today mean” (40). Alexander Kots, war correspondent for Komsomolskaya Pravda, likewise expressed the hope that Russia was involved in the sabotage in Europe:
“I very much want to believe that these two events [the explosions in Bulgaria and Italy] are not a coincidence, but another mirror response by Russia to the West” (41).
The Z-analyst Yury Kotenok is also calling for escalation of the hybrid war, arguing for “the conduct of sabotage operations inside Europe itself, and moreover without regard for how Western capitals will react, since the principle already applies here that whether it was us or not, they will blame Moscow anyway” (42). He puts forward the following proposal:
“Who can guarantee that a truck carrying a ton of RDX will not drive into NATO headquarters, as happened during the Chechen war, and that everything and everyone there will not be sent flying head over heels? Nobody. But whatever happens, they will pin this on us anyway. So maybe it is time?..” (43).
At the same time, Telegram channels close to the security bloc, Two Majors among them, consistently promote the dominant narrative of Russian propaganda about provocations:
“All these acts of sabotage look outright fabricated […] The goal is to blame Russia for hybrid attacks in order to move to a new level of escalation, or to create yet another pretext for uniting European countries into a military alliance” (44), and “if hot European heads are not cooled, a similar pretext will be used by EuroNATO [a pejorative Kremlin-aligned coinage merging the EU and NATO] to attack Russia and Belarus” (45).
August marks a qualitative shift: hybrid operations, senior-level Kremlin rhetoric, and pro-war domestic mobilization are increasingly moving in parallel.
Plausible deniability and intimidation are not contradictory tactics but complementary elements of the same escalation strategy. The Baltic region currently appears to be the clearest potential focal point for the next stage of this confrontation.