Police Thwarted a Napalm Attack on a Slovak Drone Factory. Five Days Earlier, Three European Arms Plants Burned

Over five days in August, fires and explosions hit three European sites producing ammunition and equipment for Ukraine: an ammunition plant in Bulgaria, a factory near Rome, and a hall belonging to an Estonian manufacturer of combat robots in Tallinn. The British daily The Telegraph wrote on Sunday, August 23, citing unnamed Western intelligence sources, that Russia is said to be behind the series, hiring members of local criminal groups for the attacks. Neither the Italian nor the Bulgarian government has confirmed this so far, and both speak of an internal cause. The model the newspaper describes as new, however, has been under investigation in Czechia since March — and the Bulgarian businessman who owns the first of the three plants is appearing in it for the second time in twelve years. On Tuesday, August 25, Slovakia was added to the chain: the anti-crime unit ÚBOK charged three foreigners with preparing an arson attack using napalm on a plant producing unmanned systems in eastern Slovakia. It is the first case in the series in which police intervened before a fire broke out. ta3 ↗ During the night into Monday, Poland was added as well, bringing a case in which the authorities went further in naming the matter than anywhere before: a hall at WB Electronics in the town of Skarżysko-Kamienna burned, the flagship company of the country’s largest private arms group, which manufactures drone parts for both the Polish and Ukrainian armies. Within a day, the prosecutor’s office opened an investigation into participation in the activities of a foreign intelligence service against Poland and into a crime of a terrorist nature. It has not yet charged anyone. Interia ↗

Three Plants, Five Days

• 26.08.The nationalities of the accused are out and confirm the Latvian trail: two Latvians and one Ukrainian. Greece’s Protothema states them directly in the headline, as does Austria’s ORF. Slovak police did not name them, which is why we had not included them in this text until now. Latvia is also the country that detained the three people suspected of setting fire to the Milrem Robotics hall in Tallinn — in two of the four cases in the series, then, the perpetrators came from the same state. Protothema ↗ ORF ↗
• 26.08.The third suspect was detained in Hamburg. Germany’s Spiegel specifies the city where the arrest on a European arrest warrant took place; until now, we only knew that it was in Germany. Spiegel ↗
• 26.08.Lithuania’s 15min named the tempo that gets lost in individual reports: in Europe, it was the fourth attempt in a single month to blow up a military factory. That is the same number we are tracking in this text, but it is the first time an editorial office outside the affected countries has summarized it this way — which is also an answer to the question of whether the series can be read as a series. 15min ↗

- 25.08.The target was a Ukrainian company. The Kyiv Independent, citing Denník N, reports that the plant belongs to Skyeton, which manufactures long-range reconnaissance drones and is Ukrainian-owned. In its statement, Slovak police named neither the owner nor the nationalities of those detained. According to the Kyiv Independent, Skyeton did not immediately comment. This places the Slovak case more precisely: it was not a random industrial site, but a manufacturer of equipment for the Ukrainian army — as in Pardubice. (Kyiv Independent ↗)

• 25.08.The fourth target, the first foiled attempt. Officers from the anti-crime unit ÚBOK announced on Tuesday that they had foiled a planned arson attack on a manufacturing plant in eastern Slovakia where unmanned systems are produced. Police intervened before the attack. Around seventy employees could have been inside the hall at the time of the planned attack, and the value of the property inside reaches tens of millions of euros. ta3 ↗Aktuality.sk ↗
• 25.08.The intelligence services alerted them. Police Presidium spokesman Roman Hájek said ÚBOK launched the search on the basis of information and intelligence from the Slovak Information Service and Military Intelligence. During the operation, officers seized a large quantity of incendiary mixture, tools, mobile phones, an action camera, and a hand-drawn plan. According to a preliminary examination, it was a mixture of gasoline and polystyrene, commonly referred to as napalm. Refresher ↗Živé.sk ↗

On August 10, shortly before 10:30 in the morning, a truck caught fire on the premises of the EMKO ammunition plant in the village of Belica near Tryavna in central Bulgaria. The fire spread to part of the warehouses, detonations followed, and the BG-ALERT warning system was activated. The company evacuated about three hundred employees and, as a precaution, also residents of nearby villages. No one was killed and no one was injured. info.cz ↗

Bulgarian Interior Minister Ivan Demerdzhiev said later that day that the explosion was most likely an accident and that nothing indicated the involvement of a foreign power. According to the authorities’ preliminary assessment, the incident had an internal cause. Sofia has not changed that position since. Aktuality.sk ↗ Novinite ↗

Three days later, on August 13, an explosion and fire shook the KNDS Ammo Italy ammunition factory in Colleferro, Italy, near Rome. The plant, which previously belonged to Italy’s Simmel Difesa, produces medium- and large-caliber ammunition for land and naval defense. According to the first witness accounts, a press exploded in the powder-pressing department. Twenty-four people were on the premises; all were evacuated without injuries. Pravda ↗ Il Fatto Quotidiano ↗ ANSA ↗

The case is being handled by the prosecutor’s office in Velletri, which opened a file for arson and has so far ruled out subversive sabotage. La Repubblica wrote that investigators were also looking into a possible connection with the Bulgarian explosion three days earlier, but Italian Defense Minister Guido Crosetto told the Adnkronos agency on August 17 that nothing suggested it was anything other than an internal problem. La Repubblica ↗ Reuters ↗ La Repubblica ↗

On the night of August 14 to 15, a building used by the Estonian company Milrem Robotics burned in Tallinn’s Lasnamäe district. The company manufactures THeMIS and VECTOR ground combat robots and supplies them to Ukraine. Estonian authorities assessed the fire as deliberately set. ERR ↗ Novinky.cz ↗

Latvia’s State Security Service, VDD, announced on August 20 that it had detained three Latvian citizens and that all are in custody. They face two charges: intentional destruction of property by arson and assisting a foreign state against another state. The VDD did not name which state that was supposed to be in its statement. Estonian Prime Minister Kristen Michal has spoken more openly about possible Russian involvement. According to the company, the attack did not interrupt deliveries of robots to Ukraine. VDD ↗ LSM ↗ Euromaidan Press ↗

What Is New Is Not Sabotage, but the Chain of Intermediaries

• 25.08.The Slovak accusation says “on commission.” The investigator charged three foreigners with preparing the especially serious crime of general endangerment, which, according to the police, they were allegedly preparing on commission. Two of them were detained in Slovakia, the third in Germany on the basis of a European arrest warrant. The police did not name who ordered the job, as in Tallinn and Pardubice. iROZHLAS ↗Novinky.cz ↗
• 25.08.Macko: who hired them? Retired General Pavel Macko told the daily Plus JEDEN DEŇ that similar incidents may be part of hybrid attacks. Slovak police have not commented on the background of the case, and the person who ordered it has not yet been publicly named. Plus JEDEN DEŇ ↗

The Telegraph wrote on August 23, citing unnamed Western intelligence sources, that Moscow had launched a new wave of attacks on European arms factories and was recruiting members of local criminal groups for them. According to the newspaper, officers of Russia’s GRU military intelligence are making contact with informants inside gangs through apps such as Telegram. They then distribute specific tasks among people who are paid in cryptocurrency and often have no idea whom they are working for. Ukrajinska Pravda ↗ Novinky.cz ↗

According to the same sources, the attacks are supposed to be planned so that they do not reach the threshold after which Article 5 of the Washington Treaty on collective defence could be activated. The Bulgarian daily 24 Chasa, which picked up the report, quotes the head of Latvia’s State Security Service, Normunds Mežviets: GRU agents “remain in Russia, where it is safe, because they take no risks for their own security.” 24 Chasa ↗

It is also appropriate here to say what still does not follow from this report. Although media outlets in several countries picked it up, from Belgium’s De Morgen through Italy’s Open to Bulgaria’s 24 Chasa, all are based on a single Telegraph text that relies on unnamed intelligence sources. Independent confirmation is not yet public, and the governments of the affected countries are speaking more cautiously than anonymous officers. De Morgen ↗ Open ↗

Czechia Knows This Model, and Pardubice Is Not Vrbětice

In the early hours of March 20, 2026, a warehouse belonging to the arms company LPP Holding in Pardubice burned down. The fire destroyed a substantial part of its production capacity, and Czech authorities have been investigating it from the beginning as a terrorist attack. Interior Minister Lubomír Metnar at the time spoke of a probable connection with terrorism. RFE/RL ↗

A group called Earthquake Faction claimed responsibility for the act on Telegram, describing the plant as a production centre for Israeli weapons. Police President Martin Vondrášek said that shortly after the fire was reported, several Czech journalists received messages from an address registered in the same domain as the group’s website. The outlet Seznam Zprávy, citing unnamed sources, wrote that the security services are also considering a false-flag operation, since the group has no traceable history. LPP says that planned cooperation with the Israeli company Elbit Systems never took place because the tender was cancelled. However, it did manufacture drones used by the Ukrainian army. RFE/RL ↗

The investigation is still ongoing, and it involves significantly more people than originally seemed. The damage reached hundreds of millions of Czech crowns; police detained eleven people, eight of whom ended up in custody in Czechia, while three remained detained in Poland. The Constitutional Court rejected one of the accused’s complaint against custody as manifestly unfounded, and at the end of July the Pardubice District Court extended the custody of four others by three months. Bulgaria extradited one suspect to Czechia back in April. Novinky.cz ↗ iDNES ↗ Aktuality.sk ↗

And it is precisely at this point that the chain closes. The EMKO ammunition plant, which burned on August 10, belongs to Bulgarian arms dealer Emilian Gebrev. His ammunition was also stored in the Moravian village of Vrbětice, where two warehouses exploded in 2014 and two people died. In April 2021, the Czech government published a well-founded suspicion that officers of Russian military intelligence, namely its Unit 29155, were involved in the explosions. Gebrev himself was the target of an attempted poisoning a year after the first explosion, in the spring of 2015. Deník ↗ Bellingcat ↗

The publicly known difference between 2014 and the cases from 2026 so far looks exactly as The Telegraph describes it. In Vrbětice, according to Czech findings, two Russian intelligence officers came in person, using false identities and requesting access to the warehouse. In Pardubice and Tallinn, no one has yet publicly identified an officer who was present on the ground. The suspected perpetrators are in custody, and who ordered the job remains the subject of the investigation.

Governments Talk About Accidents, Intelligence Services About a Campaign

• 31.08.The series continued in Poland and hit one of its most sensitive targets. On the night from Sunday to Monday, a WB Electronics hall burned in the town of Skarżysko-Kamienna, about 150 kilometers south of Warsaw. It is the flagship company of Grupa WB, Poland’s largest private arms group, and this very plant produces composite structures and control components for drones used by both the Polish and Ukrainian armies. The fire broke out shortly after midnight, when the facility was closed; five fire units responded and no one was injured. Do Rzeczy ↗ORF ↗Interia ↗
• 31.08.The cameras show a person in a balaclava climbing over the fence. The fire was detected quickly because an alarm sensor went off on the premises and an operator from an external security service called the police. The fire was in a building near a warehouse of electronic components. Investigators found a backpack and a hoodie near the plant; a dog handler with a service dog and a drone with a thermal imaging camera also arrived at the scene. Do Rzeczy ↗
• 31.08.This time, foreign intelligence is directly included in the legal classification, and within a single day. According to its statement, the prosecutor’s office opened an investigation into participation in the activities of a foreign intelligence service against the Republic of Poland and into the commission of a terrorist offense, allegedly consisting of the deliberate placement of a charge containing flammable materials. Damage to the destroyed storage facilities amounts to at least fifteen million zlotys. The case was assigned to a prosecutor from the Krakow branch of the National Prosecutor’s Office unit for organized crime and corruption; he is working on it together with the ABW and the regional police headquarters in Kielce, and a special police group is being led by his deputy Jacek Cholewa. No one has been charged so far. Interia ↗Do Rzeczy ↗
• 31.08.The Polish services themselves are more cautious than both the legal classification and the headlines. Jacek Dobrzyński, spokesman for the minister-coordinator of special services, told TVN24 that they are taking the matter very seriously and that officers of the civilian counterintelligence service ABW are already on site, but that it is too early to speak of sabotage with certainty. The Military Counterintelligence Service also arrived, and the services are at the same time warning against the spread of unverified information and possible disinformation. ORF ↗Do Rzeczy ↗
• 31.08.Abroad, the same fire was given a firmer framing than at home. Romania’s Digi24 and Pro TV both described it directly in their headlines as a suspected act of Russian sabotage, and Pro TV added that Warsaw is “in the Kremlin’s sights.” Kyiv Post framed it as an attack on a plant that supplies Ukraine, while Slovakia’s Aktuality.sk was writing at the same time that the cause was still unclear. It is the same difference between domestic caution and foreign interpretation that this article has been describing since Belica. Digi24 ↗Pro TV ↗Kyiv Post ↗Aktuality.sk ↗
• 31.08.The Slovak case, meanwhile, is moving in the opposite direction from the Polish one. In Košice, a fourth person was detained, a Ukrainian citizen suspected of cooperating in a planned arson attack on the plant in Haniska near Prešov, Police Corps President Jana Maškarová announced. The three foreigners charged earlier face charges of preparing the especially serious crime of public endangerment committed on order, for which they face ten to fifteen years. The case, however, has not yet been classified as a terrorist offense, the police have not publicly identified who ordered the attack, they are working with several versions, and government officials have not officially mentioned a Russian lead. So while Warsaw had foreign intelligence in the case file within a day, Bratislava has no such classification after a week. We summarized the details in the daily overview from August 29. Aktuality.sk ↗SITA ↗iROZHLAS ↗
• 31.08.Moscow, meanwhile, has turned the accusation on its head. Russia’s Foreign Intelligence Service, according to the RIA Novosti agency, claims that it was European countries that, in July on the sidelines of the Paris summit of the Coalition of the Willing, urged Kyiv to intensify sabotage and attacks on Russian territory. It is a claim by one side without presented evidence, picked up by the Italian agency AGI, and it fits the pattern in this article: authorship becomes disputed before the investigation has concluded anything. AGI ↗

• 28.08.The campaign has moved from factories to the sea: the German navy is accusing the Russian navy of “aggressive behavior” in the Baltic Sea and is accelerating the search for suspicious vessels. The report was picked up in one wave by Dutch, Belgian, Croatian and Bulgarian media, and the German vice admiral presented it as an ongoing activity, not as an incident. This is the first time in this series that we are talking about infrastructure sabotage and that it is being discussed by a uniformed commander, not by intelligence services through anonymous sources. AD ↗De Morgen ↗24 Chasa ↗
• 28.08.Germany is convening a meeting on hybrid threats against the Baltic Sea. Bulgaria’s Dnevnik presents it as a planned international discussion — meaning the same shift from individual investigations to policy that we have tracked in this text in the case of factories. Dnevnik ↗
• 28.08.Russia’s ambassador to Germany, meanwhile, claims that Ukraine could not have carried out the Nord Stream pipeline attack on its own. It is a claim by one side without presented evidence, but it fits the pattern this article describes: with every strike against European infrastructure, authorship immediately becomes a matter of dispute before the investigation has concluded anything. Kurir ↗
• 28.08.The Croatian press cites intelligence concerns that Russia could repeat the Crimea scenario in order to test NATO. That too is so far an assessment, not a finding. But it stands next to the opposite signal from the same day — the US president says Putin will not attack the alliance. Večernji list ↗
• 28.08.The Slovak case has also been confirmed by Ukrainian and Hungarian media, but they brought no new facts. Ukrainska Pravda and Censor.NET both state that the target was Ukraine’s Skyeton and that those detained include two Latvians and a Ukrainian — in other words, what this article has contained since the second and third waves. The only new thing is how far the report has spread: Hungary’s Telex also picked it up. Ukrajinska Pravda ↗Censor.NET ↗Telex ↗

• 26.08.German companies are reporting an increase in attacks by foreign intelligence services — sabotage, espionage and data theft. This is the first data point in this series that comes not from governments or anonymous intelligence officials, but from the companies themselves. It shifts the debate from the question “is this happening?” to the question of how much of it there is. n-tv ↗
• 26.08.Drones over German airports have already caused millions of euros in damage, and smaller airports are also in the crosshairs. The aviation sector is talking about operational disruptions; this is the same branch of the campaign that includes the three machines carrying explosives near Leipzig airport from the previous wave, only now quantified. n-tv ↗ Tagesspiegel ↗
• 26.08.And an expert tells Welt bluntly that Germany is largely without means when it comes to counter-drone defense. Merz’s promise from the previous wave that the perpetrators will “pay” has thus received a counterweight: the tool needed to stop such an attack before it happens is missing. Welt ↗
• 26.08.Latvia reports that state-backed hackers attacked EU officials through WhatsApp. The logic is the same as with the arsonists — a foreign state acts through an intermediary channel that is hard to attribute. The difference is that here the target is the European administration, not a production hall. LSM ↗
• 26.08.And the same country is also building a warhead factory worth 200 million euros. According to Ukrainian media, the plant in Jēkabpils Municipality is to produce up to 200,000 warheads a year. It is exactly the type of target hit by the series of attacks — so the same country figures in the story at once as the origin of the operatives and as a future target. LSM ↗ Censor.NET ↗

• 25.08.On the same day, a Kremlin adviser spoke of British drone factories as possible targets. Andrei Fyodorov told the BBC that British drone-production plants could face attacks “of a military nature” from “unknown sources” because of London’s decision to provide Ukraine with materials for missile production. Britain agreed to hand over drawings of British components of the Scalp missile, the French version of Storm Shadow, so that Ukraine could produce it itself. This is the first time in this series that someone from the Russian side has named the target — and even then with wording that keeps a degree of distance. Vijesti ↗
• 25.08.Near Stuttgart, a counterterrorism unit is investigating severed cables. According to dpa, police have almost certainly ruled out construction work: unknown perpetrators climbed into a concrete shaft under a bridge on the line near Backnang and cut several cables, knocking out data transmission and disrupting transport as well as internet and telephone connections in the town. The line was closed from midnight on Sunday until 3:30 a.m. on Monday. Traces were found in the shaft that probably came from tools, and investigators also searched for DNA. The case is being handled by a special unit for combating terrorism and state security. Radio Sarajevo ↗
• 25.08.Pickups of the Slovak case spread further over the course of the evening. Hungary’s Index, Croatia’s N1 and Lithuania’s LRT were added; Belgium’s Het Laatste Nieuws put “improvised napalm” in the headline. The series thus reads as a European topic even in countries that so far do not have an incident of their own in it. Index ↗N1 Croatia ↗LRT ↗Het Laatste Nieuws ↗

• 25.08.For the first time, the chain did not stop only at the ashes. The argument about missing attribution has a different starting point in the Slovak case than in Belica or Colleferro: the police have three accused suspects, their phones, and the attack plan, and all of that before anything burned down. Whether this produces the name of the client will be shown by the investigation. ta3 ↗
• 25.08.Berlin toughened its stance on the same day. Chancellor Friedrich Merz said that perpetrators of hybrid attacks against Germany would “pay” for their actions, and pointed to drones near Leipzig airport, where investigators found a third machine with explosives. According to him, Germany is increasingly finding itself in the sights of hybrid attackers. Aktuality.sk ↗Spiegel ↗
• 25.08.Europe read the Slovak case as a continuation of a series. The report was picked up by Austria’s ORF and Kurier, Germany’s Die Zeit, Finland’s Yle, Hungary’s Telex, and Poland’s Onet and TVN24. Belgium’s De Morgen placed it in the same live feed as the Leipzig drones and the war in Ukraine, meaning not as a Slovak crime story, but as another point in the same campaign. ORF ↗Die Zeit ↗Telex ↗

That is precisely what makes this wave a political problem, not just a security one. If an attack is carried out by a hired local person paid in cryptocurrency who has never seen the client, the investigation usually stops with him. Without attribution there is no retaliation, and without retaliation there is no deterrence.

Responses therefore differ from country to country, and much more substantially than headlines about a Russian campaign would suggest. Sofia and Rome both insist on an internal cause; only Tallinn speaks openly about possible Russian involvement. An analysis by the British magazine UnHerd, republished by Romania’s Digi24, also describes the political consequence of this divergence: Poland and the Baltic states are pushing for a loud response, Italy and Germany do not want to provoke Moscow, and the result is a more divided alliance. Digi24 ↗

Germany, meanwhile, is also dealing with a more personal branch of the same campaign. Stefan Thumann, head of the Bavarian drone company Donaustahl, told RTL that after a warning from German services he is living in undisclosed locations and has written a will, because according to them Russian agents had planned to poison him. Rheinmetall CEO Armin Papperger has also long been under protection. In mid-August, a German court sentenced a Ukrainian man to fifteen months for preparing sabotage with explosive packages for Russian intelligence. Pravda ↗ Živé.sk ↗ HN ↗

This is the fifth and final update to this article. The series has clearly not ended, the Polish investigation has only just begun, and the Bulgarian, Italian, Estonian, and Pardubice branches also remain open. We will therefore cover further developments in a separate article, not in another wave.

Illustrative photo: the fifth-generation THeMIS combat robot from the Estonian company Milrem Robotics, whose hall in Tallinn was set on fire by someone in August. Photo: Milrem Robotics, CC BY-SA 4.0, Wikimedia Commons.

What hotinfo is watching