Josefine Christensen, an analyst at Denmark’s Security and Intelligence Service, set out the findings on Russian sabotage operations at a domestic-security conference in Copenhagen on 7 October. She said Russia had stepped up efforts to disrupt Danish companies supplying weapons to Ukraine.
The change, in Denmark’s assessment, follows a Russian conclusion that large-scale hybrid attacks had failed to deter NATO from backing Ukraine. Russia is now focusing more closely on targets directly connected to Western military support, Christensen said, particularly weapons production that can affect the front line.
There had been extensive planning in the spring, Christensen said, though Russia carried out ‘very little’. By early summer, she said, it had begun to carry out ‘a lot more’ operations against defence suppliers.
The operations rely on people recruited online, including homeless people and drug users approached through Telegram and other social-media platforms, according to Christensen. Initial tasks can be as limited as reconnaissance or photographs of a potential target, before moving towards sabotage.
Moscow retains political control over the operations, Christensen said, while showing greater operational boldness. If one recruited person fails, she said, Russia sends another to the same task until it succeeds.
European drone makers and their suppliers have attracted particular attention. Russia’s Defence Ministry released a list in April that included European companies producing drones and related components.
The concern extends beyond defence companies. Germany has officially blamed Russia for an attempted drone attack on Leipzig/Halle Airport. In a separate incident, pro-Russian actors compromised the operational technology system of a small Danish waterworks, manipulated water pressure and temporarily cut supply to about 450 households.
Recorded Future’s Insikt Group said Russia-linked physical sabotage operations rose fourfold from 2023 to 2024, and assessed that the activity would likely intensify over the next two years.
Denmark’s military intelligence service, the DDIS, warned in September that Russia could increase hybrid activity against Western countries in the months ahead. It said this could include destructive cyber operations against critical infrastructure and sabotage carrying a significant risk of casualties. On 24 September, Denmark’s Agency for Societal Security raised its threat level for destructive cyber attacks from medium to high.
There have also been direct encounters at sea. A Russian frigate fired two flares towards a Danish Fennec military helicopter that was photographing it in international waters off Gedser on 14 September.
A DDIS assessment published in February 2025 said that, under certain conditions, Russia could be capable of fighting a local war against a neighbouring country within about six months. It put the timeframe for a regional war involving several Baltic-area states at roughly two years, and for a large-scale European war at around five years.
The Russian embassy in Copenhagen denied claims that Russia was carrying out sabotage operations in Europe. Denmark’s account nevertheless describes a campaign aimed at placing pressure on NATO states and their suppliers.
Comments (0)