How Russian Intelligence Is Targeting Europe's Logistics Networks

A sabotage campaign attributed to Russian intelligence services is putting growing pressure on European cargo hubs, warehouses, railways and defence suppliers. In an analysis published on 5 October 2026, The Telegraph reviews fires and explosive devices recorded in a dozen or more European countries and warns that only luck has so far prevented mass casualties. Moscow denies any involvement in these incidents.

The Birmingham parcel fire remains one of the clearest warnings for the logistics sector. On 22 July 2024, a parcel containing an incendiary device ignited at a DHL depot in Minworth, near Birmingham, after being flown in from Lithuania. Nobody was injured. In the same three-day period, a freight container caught fire at Leipzig/Halle Airport shortly before it was due to be loaded onto a DHL cargo aircraft, and another parcel burned at a transport company near Warsaw. A fourth parcel was intercepted after its device malfunctioned. Investigators also traced test shipments sent to the United States and Canada, which suggests that the group was mapping air freight routes to North America.

The investigation has moved forward since then. On 6 March 2026, British counter-terrorism police said they believed Russian military intelligence, the GRU, had orchestrated the plot, and a joint European investigation identified 22 suspects in Lithuania and Poland. A 38-year-old Romanian man arrested over the Birmingham fire was released under investigation. A trial of five defendants opened in Warsaw in March 2026, followed by a second trial of five defendants in Vilnius on 17 April 2026. In testimony reported in August 2026, a DHL representative told the Vilnius court that a delayed takeoff explained why the Leipzig device ignited on the ground and not in flight. He added that the parcels had passed X-ray screening without being detected and that security procedures were tightened afterwards.

The threat to air cargo returned in the summer of 2026. At around 23:40 CEST on 4 August 2026, an airport employee found a drone carrying an explosive charge and a detonator on the apron of Leipzig/Halle Airport, close to Antonov An-124 freighters operated by Ukraine's Antonov Airlines. The device did not explode. Bomb disposal teams were deployed, flights were suspended for a time and several aircraft were diverted. Video analysis reported later by the press indicated that the drone had hit the wing of one aircraft near its fuel tanks without detonating. A third drone and suspected military explosives were found in a field west of the airport on 14 August. Leipzig/Halle hosts DHL's largest air freight hub and serves as a base for heavy airlift, including NATO charter flights.

On 1 September 2026, the German government formally blamed Russia for the attempted attack. Berlin ordered the closure of the Russian consulate general in Bonn from 18 September, ended the agreement covering the Russian House cultural centre in Berlin and announced tighter entry checks for Russian nationals. Moscow rejected the accusation and said it would respond. On 2 October 2026, The Telegraph reported that investigators suspect a man holding Russian and Latvian citizenship of handling logistics and reconnaissance for the operation, and that European security services view the attack in the context of the sabotage work of GRU unit 29155. According to press reports, a second suspect left Finland before police there could detain him.

Defence suppliers are also being targeted. On 29 September 2026, Estonia announced that it could state with full confidence that Russian special services had commissioned the arson attack on a building used by Milrem Robotics in Tallinn during the night of 14 to 15 August. Milrem builds the THeMIS unmanned ground vehicles supplied to Ukraine. The fire was brought under control quickly and nobody was hurt. Three suspects detained in Latvia were handed over to Estonia on 17 and 18 September. Estonia's Internal Security Service warned that defence manufacturers and organisations supporting Ukraine face an elevated threat and advised them to strengthen their security measures.

The Telegraph places these events in a longer series. On 20 March 2024, a warehouse in Leyton, east London, holding aid and communications equipment bound for Ukraine was set on fire. A large shopping centre in Warsaw burned down in May 2024, a fire that Polish authorities later attributed to Russian intelligence. In November 2025, two acts of sabotage hit the railway line between Warsaw and Lublin, a route used for deliveries to Ukraine, including an explosion that destroyed a section of track.

The newspaper also mentions explosive devices found near high-voltage power lines in Germany in early September 2026. That case should be treated with caution. German police defused 21 devices in Saxony and arrested a 48-year-old man on 8 September. Officials described him as a probable lone perpetrator, and letters claiming responsibility cited opposition to fossil fuel power generation. German authorities have not attributed those attacks to Russia.

According to The Telegraph, three services share responsibility for Russian covert action abroad: the foreign intelligence service SVR, the domestic security service FSB and the military intelligence agency GRU. European governments most often point to the GRU, which specialises in sabotage outside Russia. Former GCHQ director Sir David Omand told the newspaper that Russia treats its agencies as instruments of "a secret form of political struggle" whose role is to weaken adversaries, and not simply to gather information. Experts quoted in the article believe the three services are now cooperating more closely and that the SVR is becoming more aggressive.

The method has changed since 2022, when European countries expelled as many as 600 Russian diplomats, most of them thought to be intelligence officers, according to the newspaper. With fewer officers on the ground, handlers recruit local proxies through Telegram, starting with small paid tasks such as graffiti and moving on to reconnaissance and arson. The Leyton case showed how this works. Six men were jailed in 2025, and ringleader Dylan Earl, who had been recruited online by a contact linked to the Wagner Group, received a 17-year sentence. These recruits are cheap and expendable, but they are also untrained, which has helped police break up several plots.

British authorities continue to report new cases. In July 2026, the United Kingdom designated the GRU Volunteer Corps as a national security threat. On 9 September 2026, a 31-year-old man arrested in Swindon was charged under the National Security Act with assisting a foreign intelligence service, after allegedly receiving instructions with a view to committing an act of sabotage.

As of 5 October 2026, the campaign shows no sign of slowing. The Telegraph warns that a successful attack on a cargo aircraft or a military site could trigger a direct crisis between NATO and Russia. Investigations and court proceedings are still under way in Germany, Estonia, Poland, Lithuania and the United Kingdom.