Lithuania has backed Estonia in accusing Russia of an arson attack on a defense company in Tallinn, as a map shows the spread of suspected sabotage acts across Europe linked to Russia since the start of the Ukraine War.
Lithuania’s foreign ministry expressed solidarity with Estonia on Wednesday over a fire that damaged a building in Tallinn belonging to defense firm Milrem Robotics on August 15.
Estonia’s Internal Security Service said it was an act of sabotage ordered by Russian secret services, an accusation Moscow denied.
Read More on World
NATO‘s eastern flank members continue to warn that Russia is testing the alliance’s resolve with hybrid actions that fall below the traditional threshold of war. These include GPS jamming, airspace violations, and arson.
Data and mapping by Kyiv-based Sahaidachnyi Security Center show that since February 24, 2022, there have been 522 incidents in Europe either attributed to Moscow by European government officials or fitting the pattern of Russian acts, but not formally attributed.
The purpose of Russia’s operations is “to coerce allies into reducing support for Ukraine and undermine public support for Ukraine by imposing social and economic costs on European societies,” Elena Davlikanova, a Sahaidachnyi senior fellow, told Newsweek.
Kremlin spokesman Dmitry Peskov has previously rejected Western claims about Russian hybrid operations and in August called them “scare stories.” Newsweek reached out to the Kremlin for comment.
Latest Suspected Hybrid War Incidents
The data from Sahaidachnyi Security Center outlines incidents which include airspace violations by planes, drones and missiles, jamming and spoofing, as well as sabotage against critical and military infrastructure.
It documents military provocations, sabotage acts, cyberattacks, and other hybrid operations targeting Europe since the start of Moscow’s full-scale invasion and is based on verified open-source intelligence.
Its map shows the incidents spread right across the continent, including the United Kingdom, Italy, Germany and Poland.
Davlikanova said Russian sub-threshold activity was relatively dispersed in the first two years of the full-scale invasion, but there were two clear surges in spring 2024 and autumn 2025, and activity had remained elevated into this year.
This was because Russia needed time to adapt after its failure at the start of the war, as Ukraine had absorbed military and intelligence resources.
Russia then expanded drone production, electronic-warfare capacity, cyber capability and the infrastructure surrounding its sanctions-busting shadow fleet of vessels while gaining battlefield experience in using cheap autonomous and remotely controlled systems.
Davlikanova said what began largely as cyber pressure, intelligence activity, signaling and relatively isolated incidents has developed into a multidomain campaign. This combines sabotage, recruited proxies, drones, GNSS interference, maritime activity, cyber operations, electronic warfare and increasingly overt military probing.
“The desired political reaction is therefore more important than the destruction of any single target,” she said.
“Russia benefits if European citizens begin asking their governments to avoid ‘escalation’, and seek a political accommodation with Moscow.”
In two of the latest incidents, Poland and Romania scrambled jets overnight Tuesday during a Russian bombardment of Ukraine. Both countries are among NATO members who have expressed alarm at repeated incursions into their airspace as fear grows over the Ukraine War spilling over into the rest of Europe.
On Wednesday, a drone crashed in Hîrbovăț, Moldova, after being spotted flying at low altitude over the city of Bender, with video on social media showing the fiery moment of impact. Moldova is not a NATO member, but it has accused Moscow of deliberately launching drones into its airspace and warned of increasing Russian aggression.
On Monday, Russian forces conducted a Geran-5 jet-powered drone strike less than a mile from the Ukrainian-Polish border, according to Warsaw.
The drone struck a truck parking lot near the Yahodyn international border checkpoint in Volyn Oblast only weeks after a drone hit the same area soon after top European security officials had passed through by train.
The Danish Defense Intelligence Service said last week Moscow would step up its hybrid actions in the coming months and cited a foiled drone attack on Leipzig/Halle Airport in Germany.
It warned that Moscow was preparing sabotage on Danish soil against defense companies and that Russian forces are increasingly acting aggressively toward NATO units in the Baltic Sea region.
“There is now a clear history of such Russian aggression, a recurring pattern that is clearly escalating,” said Matthew Arnold, program director of the London School of Economics think tank LSE IDEAS’ Democratic Resilience in a New Age of War Program.
“The most important response from Western governments should be to methodically investigate and document such incidents and be more forceful in quickly calling out Russia’s actions,” Arnold said, “not doing so allows Russia to agitate Western politics largely uncontested.”
“Either through the EU or NATO, there should be a stronger collective effort to explain to European publics what is happening, systematically detailing Russia’s tactics and explaining why Russia is doing it,” he added.
Susan Lilleväli, Estonia‘s foreign ministry spokesperson, told Newsweek last week that Russia’s actions are because it wants to paralyze Ukraine’s supporters by making them fear escalation.
However, NATO members have shown airspace violations can be met with a decisive response, she added.
“There is no better way to achieve a just and lasting peace than to continue supporting Ukraine, increase pressure on Russia, and show Moscow that Europe will not allow threats to push it off course,” she said.
Contact Newsweek editors on this story: Matthew Robinson and Sam Wilson.