Russia’s War on Western Europe: Warehouses, Drones, and Narratives

In the past weeks Ukraine’s allies in western Europe have experienced a string of drone sightings, often near key strategic sites. The culprit is generally considered Russia, yet this assumption can occasionally be itself what Russian misinformation would like us to believe, even when it isn’t the case. Drones targeting western European infrastructure come in conjunction with sabotaged warehousing and a thrust to bend public opinion among Ukraine’s allies. It is thus key to clarify, to the greatest extent possible with the evidence at hand, the Kremlin’s motives, methods and capabilities.

Warehouses on fire

Firstly we will consider three cases of European warehouse fires that illustrate key examples of Russian methodology. In the case of Russian sabotage it can be assumed many more cases have been thwarted by European intelligence agencies [1].

London (UK), 20 March 2024
Five men were convicted in July 2025 for an arson attack on a London warehouse that held supplies for Ukraine. Police and prosecutors said the operation was commissioned by Russia’s Wagner network with British intermediaries paying local recruits. Court material and official statements explicitly describe the contact chain, the money, and further plots (including Mayfair targets and a kidnap plan). This is one of the clearest cases tying a UK warehouse attack to Russian state-linked tasking [6][7][8][9][10]. A distinguishing factor is that all five men were British, exemplifying Russia’s use of paid proxies.

Dylan Earl 21, one of the ring leaders of the group was in direct contact with the Wagner group via telegram. Earl, as per other members of the group, was also a known drug dealer [1].

Leipzig (Germany), 2024
German authorities investigated fires at a DHL facility in Leipzig caused by incendiary devices hidden in parcels. The head of Germany’s domestic intelligence agency, Thomas Haldenwang, made it clear that the incident almost became a plane crash [12]. Subsequent statements by Lithuanian prosecutors (Sept 2025) allege the 2024 parcel blasts across Europe were organised and supervised by Russian citizens with ties to Russian military intelligence, part of a test for a wider plan to trigger fires on cargo flights. This remains an active investigative strand but the official Lithuanian position is unambiguous as to the intent. [12][11][13][14]

At least some of the incendiary devices were intended for flights to North America [13].

Swindon (UK), 24 Sept 2025

A spectacular industrial blast at Swindon led to an assumption of further Russian sabotage. However, UK fire authorities and the Health and Safety Executive state the cause is believed accidental - failure of a printing machine - with targeted product-safety guidance issued sector-wide. This followed (by two weeks) a high-profile MoD announcement that the UK’s largest drone factory will open in Swindon in 2026.

With the explosion happening in the same city as the planned drone factory Russian-language outlets, such as Russia Today, readily tried to fuse into a single “story” sowing the seed of fear of yet another successful Russian act of sabotage. This highlights one of the key motives, to promote fear and doubt among the public of Ukraine’s closest allies whether through actual acts of sabotage or through the misinformation of accidents being actual acts.. As of yet there is no official support for a sabotage link in this specific case. [15][16][17].

EADaily, assumed owned by Vigen Akopyan who has Kremlin ties, outright lied stating the explosion was at the drone factory [31].

Whilst the explosion occurred at ESP Smile, Crompton Road, Groundwell Industrial Estate in North Swindon [15], the drone factory TEKEVER announced is in The Spectrum Building, Mead Way (SN5 7UT) in West Swindon. [30]

Drone sightings across Europe including attack drones over Poland and Romania

In September a wave of drone sightings occurred across Europe. What is often misunderstood is that these can be delineated into those directly sent from Russia, and those likely requiring a local operator.

Germany: Multiple airport closures (notably Munich) and sightings over military sites (such as Erding, an air base). This has triggered policy shifts; Berlin is now moving to give police shoot-down powers. The Chancellor said the government assumes Russia is behind the recent drone incursions, stressing they were unarmed and likely reconnaissance. [18][19]
Denmark: In late September, Denmark reported repeated sightings over military installations and imposed a temporary national ban on civilian drones during a high-level summit week. Allies sent anti-drone units and radars to bolster Danish airspace protection. Danish officials referenced possible hybrid activity; attribution remains formally open. [20][21][2][3]
France: Mourmelon-le-Grand (a base that has trained Ukrainian troops) reported unidentified drones overhead, prompting tightened security. Officials did not publicly disclose types. [22]
Belgium: Elsenborn military base reported overnight drone overflights; an investigation remains under way. [23]

What kinds of drones were they, and where did they originate?

Several European countries have claimed Russian drone incursions in NATO airspace are deliberate [File: Roman Petushkov/Reuters]

Open sources are deliberately sparse on models. German reporting seen by Reuters cites a police brief saying some drones were “used militarily”; none were armed. Elsewhere in Schleswig-Holstein, sighting reports mention a fixed-wing UAV with a wingspan greater than 4 metres, a size compatible with tens of kilometres of range, and smaller drones operating alongside it. Investigators are exploring whether at least part of the activity was ship-launched, after boarding the cargo vessel Scanlark in the Kiel Canal on suspicion it served as a drone base; multiple outlets report that link is being probed. Though this is not yet adjudicated it can be assumed under investigation [9][4][5][27]

Whilst in Germany, Denmark, France, Belgium, no government has publicly named a launch site for the unarmed drones, these smaller drones will most certainly have had local operators suggesting the use of Russian agents within western European nations. This emphasises the importance on intelligence gathering with regards these groups, as had become clear following the initiation of sabotage attacks, and recognised by the MI5 as a serious threat[1].

The exceptions, Poland and Romania faced a more sinister threat

Poland (10–11 Sept 2025): Poland became the first NATO state to shoot down drones during Russia’s overnight strikes on Ukraine; allied jets helped. This is not the “mystery drone” phenomenon — this was a spill-over from a Russian mass strike, with drones crossing into Polish airspace; Poland treated it as a security event under NATO procedures. [24]
Romania (multiple incidents): In March, Romania has repeatedly found Russian drone debris in its territory and, in one case, detonated active explosives on recovered fragments. These events correlate with Russian attacks on Ukrainian Danube ports across the border. [26]. On the 8^th of September Romania scrambled F16s to intercept a Shahed drone in its airspace. Romania has not yet confirmed that it has found the drone [33].

In Poland/Romania, drones originated from Russia/Belarus/the Black Sea theatre during Russian strike packages. Types are broadly in the one-way attack (OWA) family used against Ukraine such as the infamous HESA shahed drone; national authorities focus their public messaging on airspace defence outcomes, not airframe specs. [24][26] Nevertheless, Russia is clearly insinuating an altogether more sinister threat.

How Russia’s proxy grooming echoes extremist recruitment

Whether the operation of drones or arson attacks, understanding Russian recruitment within western Europe’s own borders is now paramount. European services increasingly describe state threats and terrorism as overlapping problem sets requiring the same counter-terrorism tooling — collection, online disruption, and proxy-network mapping. MI5’s Director General said the UK needs “all that same capability” developed for counter-terrorism to confront state threats in parallel; he also accused the GRU of a mission to generate “mayhem” across Europe. Europol’s 2025 SOCTA details how hybrid threat actors (including states) now exploit criminal networks and online channels for deniable sabotage . This leads to a shadow alliance that lets states outsource cut-outs, muddy attribution and plausible deniability. [1][2][3][4]

Tactical overlap in grooming mechanics similar to terrorist organisations:

Online spotting & outreach: Applications such as Telegram and fringe forums identify prospects. (In the London case, the organiser contacted Wagner via Telegram.) [7][6][8]
Grievance → narrative: anti-NATO/pro-Russia frames used to mobilise; financial incentives sweeten the pitch. [7][8][3]
Step-up testing and cut-outs: small tasks escalate; intermediaries insulate the handler. (Explicitly stated in UK police/CPS materials.) [6][7][9][10]
Criminal crossover: Europol flags criminal networks leveraged for arson/sabotage on behalf of hybrid actors — precisely what CT investigators fought in other extremist ecosystems. [3][4]

Caveats on ideology: In recent UK convictions, official records do not show proven membership of named ideological groups; what is evidenced is exposure to pro-Russia content and paid tasking via encrypted apps. We should avoid over-claiming or stating that only one method is employed. [6][7][8][9][10].

Nevertheless, the overlap of mutual ideological positions and grievances are clearly sought to ensure loyalty. With many of those recruiting on behalf of Russia having far-right/neo-nazi beliefs the appeal to those of a similar mindset makes those weak to far-right ideals easiest to appeal to [34][35][40]

Information war: using ambiguity and “victim” narratives

European leaders and security agencies frame the drone wave and sabotage attempts as elements of a “grey-zone” campaign, deniable and escalatory in effect. The European Commission president has warned of a targeted grey-zone campaign involving airspace violations, sabotage and cyber attacks, urging EU states to build a cost-effective anti-drone “wall.” [28][3]

President Vladimir Putin tells the Valdai Discussion Club's annual international conference in Sochi that 'Russia will never show weakness or indecisiveness' [Mikhail Metzel/Reuters]

Moscow’s communication line is two-track: official denial (e.g., dismissing reports of Russian surveillance drones over Germany as “fake”) plus provocative rhetoric from senior figures implying that the disruption is a “useful reminder” to Europeans of war’s dangers, nudging the public to blame their own leaders for escalation. That juxtaposition—deny formally yet hint menacingly—is familiar from earlier Russian campaigns. [29][28]

The two channels of thought, that Russia is behind the aggression, or that they are falsely accused, can both be warped to Russia’s interests. On one hand it is in Russia’s interest in promoting doubt and fear among the public of Ukraine’s allies to support political pressure to reduce support, or push for peace at all costs. Ambiguity as such serves Russia well, enough plausible deniability to avoid outrage on the global stage, yet enough believability for the public to fear further escalation.

On the other hand, those prone to a more conspiratorial mindset will be prone to even the most outlandish ideas that Russia is falsely accused, or that these were mere accidents. This further isolates this section of the public from support or belief in their own country.

What now?

There is a clear and dangerous presence of Russian assets in western Europe. A layered proxy architecture that mixes state handlers, foreign intermediaries, and local recruits. It demonstrably operates in the UK (arson conviction) and is alleged across the EU (parcel plots), with criminal networks leveraged for deniable acts and documented in Europol’s strategic assessments. [6][7][8][9][10][3][4][11][12][13][14]. Moreover, with many attacks likely thwarted the breadth of this network is likely larger than first appears.

It isn’t proven that every drone sighting in western/northern Europe is a Russian operation. Despite arrests many cases may have been false alarms as the public were on alert. This, to an extent, suits Russia’s agenda of promoting fear among the public when more cases are assumed than is the fact. Nonetheless, the proximity to so many key sites suggest many were likely examples of Russia flexing its tentacles, showing its presence, and promoting fear. The reconnaissance and mapping that Russia gained of key targets does have value into itself [18][19][22][23] . Additionally, western nations will now seek to bolster their own defences, potentially reducing exports to Ukraine in order to defend key sites at home.

The attacks on warehouses housing Ukraine bound supplies and logistics shows that this is one key Russian motivation [6][7][8][9][10][11][12][13][14]. We can assume further disruption of the supply chain to Ukraine.

The partnering of these attacks with with a staunch misinformation campaign is a two pronged attack on the resolve of the public to support Ukraine. Thus, in many respects, the measure of Russia’s success on this front will be seen in the polling, for political parties loyal to Ukraine’s survival, and for support for Ukraine as a whole.

In many respects this deserves to be called Russian terrorism with the recruitment and grooming akin to the methods employed by terrorist organisations.

Although not every incident fits the statutory definition of terrorism, the strategic intent is plainly to intimidate, coerce, and disrupt through violence —highly terroristic by nature. The sober response is to apply the same counter-terrorism seriousness and tooling. A clear focus should be on identifying groups and individuals prone to Russian grooming and prioritising the combating of Russian misinformation with the information war being a key, often neglected, frontline.

Bibliography

[1] MI5 — Director General Ken McCallum, latest threat update (8 Oct 2024).
[2] Reuters — “Russia’s GRU seeking to cause ‘mayhem’ in Britain and Europe, UK’s MI5 spy chief says” (8 Oct 2024).
[3] Europol — EU-SOCTA 2025: The changing DNA of serious and organised crime (report).
[4] Europol — EU-SOCTA 2025 Executive Summary.
[5] Reuters — “Germany to allow police to shoot down drones” (8 Oct 2025).
[6] Counter Terrorism Policing (UK) — “Group convicted after Russian-ordered arson attack in London” (11 Jul 2025).
[7] CPS (UK) — “How the CPS used the National Security Act to prosecute the plot to sabotage Ukrainian aid” (8 Jul 2025).
[8] Reuters — “Three men guilty over UK arson attack ordered by Wagner” (8 Jul 2025).
[9] AP — “UK court convicts 3 men… attack linked to Russia’s Wagner group” (9 Jul 2025).
[10] The Guardian — “Three men found guilty over London arson attack on Ukraine-linked firms” (8 Jul 2025).
[11] Reuters — “2024 parcel blasts in Europe organised by Russians with intelligence ties, Lithuania says” (17 Sep 2025).
[12] Reuters — “Germany investigates fires caused by incendiary devices in parcels” (15 Oct 2024).
[13] AP — “Western officials suspect Russia behind plot to put incendiary packages on cargo planes” (5 Nov 2024).
[14] Reuters — “German firms warned of packages containing incendiary devices” (30 Aug 2024).
[15] Dorset & Wiltshire Fire & Rescue — Groundwell Industrial Estate fire — cause believed accidental (printing machine failure) (updated 29 Sep 2025).
[16] UK Health and Safety Executive — “HSE urges industry to check guidance following Swindon explosion” (10 Oct 2025).
[17] UK Ministry of Defence — “New drone factory to open in Swindon” (15 Sep 2025).
[18] Reuters — “Drone sightings disrupt Munich airport; halt flights; impact thousands” (3 Oct 2025).
[19] Reuters — “Germany’s Merz: We assume Russia is behind drone incursions” (5 Oct 2025).
[20] Reuters — “Denmark bans drone flights after fresh sightings at military bases” (28 Sep 2025).
[21] Reuters — “Sweden sends anti-drone systems, radars to Denmark to support summit security” (29 Sep 2025).
[22] Euronews — “Unidentified drones spark security alert at France’s Mourmelon-le-Grand base” (26 Sep 2025).
[23] Reuters — “Belgium investigates flight of drones over Elsenborn base” (3 Oct 2025).
[24] Reuters — “Poland downs drones in its airspace, becoming first NATO member to fire during war in Ukraine” (10–11 Sep 2025).
[25] Reuters — “How Europe might tackle the threat of drone incursions at airports” (10 Oct 2025).
[26] Reuters — “Romania finds Russian drone fragments; detonates explosives on board” (1 Mar 2025).
[27] Maritime Executive; United24 — reports on cargo vessel Scanlark detained on Kiel Canal amid probe into ship-launched drones (Sept–Oct 2025).
[28] AP — “EU chief says Russia is waging a ‘grey zone campaign’ and Europe must meet the challenge” (8 Oct 2025).
[29] Reuters — “Medvedev: drone disruption is a useful reminder to Europeans of the danger of war”; Kremlin denial of German surveillance-drone report (6 Oct 2025; 28 Aug 2025).

[30] Bibliography / Sources (numbered)

[30] tekever.com “Tekever announces fourth Uk Facility in iconic Swindon Building, expanding its UK footprint”

[31] EADaily — “It shook like an earthquake: the explosion in Britain was at the construction site of a drone factory” (25 Sep 2025). “

[32] Militarnyi — “Romania is searching for a Russian Shahed drone that flew in from Ukraine” (news report; accessed 12 Oct 2025).

[34] RFE/RL — Exclusive: The Russian Neo-Nazi Behind A Shadowy GRU Sabotage Network (25 Sep 2025).

[35] Reuters — Poland says Russian secret service behind 2024 fire in Warsaw shopping centre (11 May 2025).

[38] LRT (Lithuanian Public Broadcaster) — Lithuania says it busted Russian-linked network that planned terror attacks in Europe (17 Sep 2025).

[40] Europol (IOCTA 2025) — Internet Organised Crime Threat Assessment (2025), sections on hybrid actors and criminal collaboration