Russian security services moved from gathering intelligence to preparing arson and other acts of sabotage against Danish defence companies supplying military aid to Ukraine, Denmark’s Security and Intelligence Service (PET) has warned.
The warning, reported by Aftonbladet on 3 September 2026, said Russian agents had targeted defence-industry businesses, military storage sites and supply routes. The purpose was to disrupt deliveries to Ukraine and exert political pressure on Copenhagen.
Agents exposed during attack preparations
Emil Gresholm, PET’s head of counter-intelligence, said the Danish service had uncovered Russian agents while they were preparing specific forceful actions. The disclosure prompted the agency to issue a public warning that the threat to Denmark’s national security had entered a practical phase.
Possible methods identified by the Danish authorities include arson. The alleged operations would not be confined to traditional intelligence collection: they would involve direct efforts to damage facilities that form part of the military support reaching Ukraine.
The choice of targets reflects the strategic purpose of the campaign. Defence manufacturers, warehouses and transport routes connected with arms deliveries are all intended to affect the flow of assistance without requiring Russia to confront European states openly. By taking the fight beyond the frontline and into the European rear, Moscow is attempting to weaken the coalition supporting Ukraine and create pressure on governments that continue to provide aid.
Recruitment through social media and gaming platforms
PET also identified attempts to recruit Danish citizens through social networks, the Telegram messaging service and gaming platforms. People were offered apparently limited intelligence-gathering tasks, including taking photographs of warehouses, production facilities and weapons-delivery schedules.
Recruiters can disguise the purpose of such assignments and offer financial rewards for activities that may initially appear harmless. But the information sought would help identify vulnerable sites, understand production capacity and map the timing of military deliveries. The method allows Russian services to use civilians in European countries while concealing the wider objective of sabotage.
The Danish case therefore points to a model that relies not only on trained agents. Ordinary residents can be approached online, given small tasks and drawn into operations whose consequences they may not fully understand. That creates a security problem extending beyond the immediate protection of defence plants and military infrastructure.
Part of a wider campaign across Europe
Nato intelligence structures regard Denmark’s warning as part of a broader hybrid campaign by the Kremlin. A series of arson attacks, sabotage operations and other provocations across Europe is intended to spread fear among the public, unsettle domestic politics and encourage western governments to reduce or end military and financial support for Ukraine.
Similar incidents have already been reported in other EU countries. German authorities directly accused Russia of attempting to strike Leipzig airport with drones carrying explosives. The European Commission described such actions by Russian security services as “state terrorism”, while several European countries, including Sweden, summoned Russian ambassadors to lodge formal protests.
These responses show that European governments are treating the activity as more than isolated criminality. The operations are being understood as coordinated state-backed pressure designed to test the security of critical infrastructure, exploit public anxiety and raise the political cost of helping Ukraine.
Pressure on support for Ukraine
For Denmark, the immediate concern is the protection of companies and facilities involved in supplying Ukraine. For Russia, the value of sabotage lies not only in any physical damage. Even an attempted arson attack or a successful recruitment operation can force authorities to divert resources, tighten security and confront public fears about whether national territory is being used as a battleground.
The pattern also carries a wider strategic message. Russia’s resort to covert attacks deep inside Europe demonstrates its willingness to use clandestine force against the infrastructure sustaining Ukraine’s war effort. European capitals have responded with protests and diplomatic measures, but the Danish warning indicates that the campaign is continuing and that online recruitment may make it harder to prevent the next operation before it begins.
Will stronger protection of defence infrastructure be enough to deter Russian sabotage, or will European governments need a broader response to the recruitment of civilians for covert operations?
