Estonia’s counterintelligence chief, Margo Palloson, has indicated a shift in the nature of Russian sabotage across Europe, noting that the focus has moved beyond symbolic targets. In an interview on Wednesday, Palloson discussed the evolving tactics, stating that earlier assaults included vandalism against Estonian opinion-makers’ vehicles, the burning of Ukrainian flags, and arson at a Ukrainian restaurant.
A notable incident highlighting this change was an August attack on Estonian robotics firm Milrem, which is a supplier to Ukraine’s military. Palloson emphasized that this attack indicated a new phase in Russian tactics, aimed at disrupting military support to Ukraine. “Now the game has changed a little bit—we assess the purpose clearly was to disrupt, restrict, or cancel all the supplies,” he stated.
Recent reports have indicated that Russia has also targeted defense firms in Denmark, further expanding its operations across Europe. An early August attempt involving explosives aimed at a plane in Germany was linked to Russian intelligence operatives, showcasing the increasing seriousness of these operations.
The changing strategy comes as Ukraine continues to resist Russian advances on the battlefield, with Danish intelligence indicating that Russia is likely to escalate its sabotage efforts in Europe in the coming months. Palloson pointed out that the use of explosives in such attacks raises the potential danger for civilians. European Union ambassadors have recently convened to discuss the implications of potential large-scale casualty events stemming from state-sponsored violence.
To address the evolving threats, the Estonian government is collaborating with its defense sector to enhance physical security measures for companies. Additionally, Estonia has intensified its efforts to prevent espionage, having arrested 20 individuals since 2025 who traveled to Russia and were recruited by Russian intelligence. Palloson clarified that those arrested were civilians, not military or intelligence officials, indicating a strategy to utilize non-military personnel for intelligence purposes within Estonia.
The reliance on criminal groups and amateur operatives complicates tracking potential saboteurs, as these networks can create layers of separation between the saboteurs and Russian authorities. Some individuals, including Ukrainian refugees, may unknowingly participate in these activities, believing they are assisting Ukraine’s own security efforts. Despite this, Ukrainian involvement in sabotage within Europe has been infrequent, though a 2022 attack on the Nord Stream pipelines was attributed to Ukrainian military personnel.
Palloson noted that some criminal organizations are seeking to profit from these operations, which adds a troubling commercial dimension to the attacks. While he expressed confidence in Estonia’s legal framework and response to these threats, he acknowledged growing frustration among some European counterparts regarding their counterintelligence capabilities.
Despite the uptick in Russian sabotage, Palloson observed that support for Ukraine remains strong in Estonia, with no visible signs of fear or panic among the populace. Looking ahead, he indicated that Estonian intelligence services are closely monitoring the situation while learning from Ukraine’s experiences. “All [intelligence] services in Europe are trying to study how to protect their societies against intelligence activity, influence activity, and sabotage,” he stated.
