On the night of May 17, debris from Ukrainian drones fell on the grounds of Sheremetyevo, Russia’s largest airport, while three people died in the suburbs of Moscow and twelve more were wounded near the city’s oil refinery. Russia’s Defense Ministry reported intercepting 556 Ukrainian drones across more than a dozen regions in a single twenty-four hour period; by midday local time on May 18, that figure had crossed 1,000. Ukrainian President Volodymyr Zelensky confirmed the strikes and described them as “entirely justified.” He was not wrong, on his own terms. Russia has launched hundreds of drones against Ukrainian cities almost every night of this war, including a daytime barrage of over 800 in a single day on May 13. The accounting is clear. So is the trajectory.
Two days before Sheremetyevo, on May 15, the Russian Defense Ministry issued a statement that received less coverage than the airport debris. It named specific companies in London, Munich, Prague, Riga, Barcelona, and Turin. It described them as manufacturers and financiers of the weapons now burning inside Russian territory. It called their host countries Ukraine’s “strategic rear.” It warned of consequences it declined to specify. Russia has trained its European interlocutors to discount such language by attaching it to Dmitry Medvedev, a political casualty of the Putin system deployed primarily to say things the Kremlin wants said without formal accountability. The training has been effective. European governments noted the statement, assigned it to the routine pile, and continued their procurement schedules.
Whether that judgment is strategically sound depends on what one believes Russia is actually doing in Europe, and at what pace.
The Industrial Commitment
The scale of European financial involvement in Ukraine’s drone economy in 2026 does not resemble conventional arms support. It resembles integrated industrial co-production of a strategic strike capability. The difference matters.
The European Commission announced a €6 billion allocation specifically for the Ukrainian Drone Alliance in April, financed from the frozen profits of Russian sovereign assets and structured as a loan under the €90 billion Ukraine Support Loan framework. Of the first €45 billion tranche released on April 1, the opening disbursement was designated for drone procurement: €5.9 billion for unmanned aerial vehicles, €3.2 billion to cover Ukrainian military salaries. On April 14 in Oslo, Zelensky and Norwegian Prime Minister Jonas Gahr Støre signed a joint declaration covering drone production, electronic warfare, and maritime security. Norwegian defense minister Tore Sandvik said the cooperation would see several thousand mid-strike drones built inside Norway and delivered to Ukrainian forces by summer. Norway’s total military commitment to Ukraine in 2026 stands at €7.66 billion. The day before Oslo, in Berlin, German Chancellor Friedrich Merz agreed to a €4 billion package that included joint production of Deep Strike drones with a range of 1,500 kilometers. That range puts the Russian capital within reach from Ukrainian launch positions well behind the front line. The Netherlands committed €248 million in drone support in the same week. Belgium €85 million. Italy expressed formal interest in production cooperation. Spain contributed to the combined €2 billion pledged alongside Belgium.
Germany’s decision is worth isolating for a moment. Building production lines jointly with Ukraine for a drone system that can reach Moscow is categorically different from supplying defensive hardware. Germany is fusing its industrial base with a long-range offensive strike capability that Russia’s Defense Ministry has formally designated as targeting the Russian state. Berlin has concluded that the strategic logic is sound. That conclusion may well be correct. The Russian military has advanced at a glacial pace across Ukrainian territory since 2022, sustained by revenues from hydrocarbon exports that Europe’s drone funding is now systematically targeting. The economic warfare argument is coherent. It is also irreversible once fully committed, and Germany has not publicly told its citizens what the industrial commitment means for German cities named on a Russian ministry list.
Ursula von der Leyen told the European Parliament in April that more than two-thirds of Russia’s battlefield equipment losses were attributable to Ukrainian drone operations. She used the figure to argue for scaling up production further. She was describing an extraordinary operational record. She was also describing the record that Russia reads when it calculates what the industrial alliance has cost it, and what it will do in response.
What the Strikes Have Actually Achieved
The operational results of Ukraine’s long-range campaign are documented and severe. Ukraine struck Russian oil infrastructure twenty-one times in April alone, including nine direct hits on processing facilities. Bloomberg reported that Russian crude oil processing fell to its lowest volume since 2009. Leningrad Oblast, the administrative territory enclosing St. Petersburg, was declared a “frontline region” by its own governor after 243 Ukrainian drones were intercepted over the province in the first quarter of 2026, with a number getting through. Export terminals on the Gulf of Finland sustained strikes. Refineries in the Krasnodar port of Tuapse burned in mid-April, with satellite images showing smoke columns rising for days. In late April, Ukrainian drones reached Yekaterinburg and Chelyabinsk in the central Ural mountains for the first time, over 2,000 kilometers from the nearest Ukrainian launch position.
The Russian state has been structurally unable to defend its own territory against this campaign. Ukraine’s deputy defense minister, Serhiy Beskrestnov, posted photographs in April of Russian improvised air defenses: truck-mounted R-77-1 air-to-air missiles repurposed for ground launch against subsonic drones. The Institute for the Study of War assessed that Russia has not fielded the mobile intercept systems or distributed low-cost interceptors needed to cover a territory of its scale. Russia designed its military doctrine around projecting force outward. It did not design its interior for defense because it did not expect to need it. Four years into a war it chose and launched, it still has not resolved that design gap.
The attrition logic Ukraine and its European partners are pursuing is militarily coherent. Russia’s oil revenues fund the state budget that funds the army. Every barrel that does not process and does not ship reduces the Kremlin’s fiscal capacity to sustain the campaign. Ukraine has built a theory of economic warfare from below, targeting the revenue infrastructure rather than the deployed force. It is working in the narrow sense: refinery output is down, Leningrad Oblast is treating its coast as a war zone, and Moscow’s suburbs are burning two years after Russian officials assured their public that the war was a contained operation in a neighboring country.
The question that the operational success generates, and that European capitals have not answered formally, is what Russia does when the campaign reaches a threshold it cannot absorb economically or politically.
The List of Addresses
The April 15 Russian Defense Ministry statement was not primarily a diplomatic communication. It was a target list made public.
Russia named companies in London, Munich, Prague, Riga, Barcelona, and Turin. It said these entities were either manufacturing or financing the drones now striking Russian territory. It said their host countries had become part of Ukraine’s strategic rear and would bear consequences accordingly. The same day, Russian officials published not just the names of the companies but their addresses. The addressees are specific: production facilities, logistics operations, component suppliers. Russian intelligence does not require the ministry’s public list to know where these facilities are. The publication served a different purpose. It was notice to the European public that their governments had made decisions with physical consequences for their cities, and that Russia had formalized those cities as objects of its military calculus.
Medvedev framed it with less institutional caution on X: “When strikes become a reality depends on what comes next. Sleep well, European partners.” The statement was received as characteristic bluster from a figure whose credibility as a standalone voice eroded years ago. His role in the Russian system, however, is to say formally and loudly what the Kremlin wants communicated without an official imprimatur. His repeated nuclear threats across four years of war have largely not materialized. His consistent messaging about European co-belligerency has, in the hybrid domain, been consistent with Russian behavior.
The Department That Was Built for This
In 2023, the GRU established a new structural unit housed at its headquarters at the Aquarium complex outside Moscow. Western intelligence agencies, as reported in the Wall Street Journal, identified it as the Department of Special Tasks. It was built specifically in response to Western military aid to Ukraine. Its mandate covers three areas: organizing assassinations and sabotage abroad, infiltrating Western companies and institutions, and recruiting foreign agents for operations in target countries. The unit is led by Colonel General Andrey Averyanov, a veteran of the Chechen campaigns who is also wanted by Czech authorities for coordinating the 2014 ammunition depot explosions at Vrbětice that killed two people and were later traced to the same GRU unit involved in the Skripal poisoning.
The creation of a dedicated European sabotage directorate inside GRU at this level of seniority is not a reactive measure. It is a long-term institutional investment. Averyanov is not a middle manager. His presence at the head of the unit signals that Russia’s political leadership has authorized a sustained, expanding European campaign to be run by the same apparatus that conducted the Skripal operation on British soil in 2018.
The campaign’s operational record since 2022 is documented across multiple NATO member states. CSIS tracked Russian attacks in Europe tripling between 2023 and 2024, after quadrupling between 2022 and 2023, covering twenty-seven percent of incidents against transportation infrastructure, twenty-seven percent against government targets, and twenty-one percent against critical infrastructure. Germany’s domestic intelligence agency, the BfV, recorded 321 suspected sabotage incidents in 2025. In early 2026, ICCT and GLOBSEC documented more than 150 confirmed or probable Russian hybrid incidents across EU and NATO member states.
The operational taxonomy is worth running precisely because the cumulative record is what the individual incidents conceal.
In May 2024, a massive fire destroyed the Marywilska 44 shopping centre in Warsaw during the night. More than 1,000 shops burned. Polish investigators established in 2025 that the arson had been ordered by a GRU officer operating from Russia, with local hired proxies executing the operation. The same week, an IKEA store in Vilnius was set alight after closing hours. Lithuanian prosecutors attributed it to GRU. Two Ukrainian nationals who had fled the war and were living as refugees in Lithuania and Poland were charged as local perpetrators; they had been promised €10,000. In September 2024, a GRU-linked network mounted two arson attempts against a Lithuanian manufacturer of military equipment for Ukraine. The operational network that day drew on a Spanish citizen, a dual Spanish-Colombian national, a Russian, a Belarusian, and a Cuban deployed to assess the damage, with a Colombian logistics intermediary in Spain. In November 2025, an explosion disrupted the Warsaw-Lublin railway, a primary logistics corridor for weapons shipments to Ukraine. Two Ukrainian nationals suspected of involvement fled to Belarus. Poland deployed thousands of soldiers to protect critical infrastructure and closed the last Russian consulate remaining on its territory.
In Paris, two Moldovan nationals admitted to painting Stars of David across multiple neighborhoods at the express direction of a foreign handler. More than a thousand Russian-linked social media bots then amplified images of the painted symbols internationally. The operation combined a criminal act, a false-flag attribution, and an information warfare campaign against French domestic cohesion, all in one evening’s work.
The DHL cargo plane operation is more technically demanding. Incendiary devices were placed in packages routed through civilian logistics systems across multiple European countries. RUSI researchers, working from law enforcement data, traced the financing chain through cryptocurrency payments made without obfuscation: three GRU-directed saboteurs in Europe each received approximately $1,000 in USDT stablecoin from a single broker wallet, with all three payments traceable to the same upstream source. Russia is not using sophisticated financial concealment for these operations. It is using speed, expendability, and the sheer volume of activity to overwhelm European law enforcement’s capacity to attribute and respond in time.
The financing infrastructure for the campaign runs through over-the-counter cryptocurrency exchange desks that RUSI documented operating across Eastern Europe and major Western cities. Fifteen such operators were identified by investigators on a single street in Toronto. Similar networks exist in London, New York, Montreal, and cities across Central Asia. These desks handle tens of millions of dollars, operate openly on Instagram, and require minimal documentation. They are the conversion layer between Russian state funds and locally recruited European proxies. Closing them requires financial intelligence cooperation at a scale and speed that no European government has yet organized.
What Russia Is Building While Europe Debates
The GRU’s European campaign is one dimension of a broader military investment that runs on a longer timeline. Foreign Policy’s January 2026 analysis of Russian military procurement documented three converging trends: rapid expansion of production capacity, prioritization of long-range strategic platforms, and investment architecture that does not reflect a short wartime surge but rather sustained operational endurance.
The Votinks Machine-Building Plant, which produces Iskander ballistic missiles and components for intercontinental systems, has brought on thousands of additional workers since 2022. Hiring continues into 2026 on documented open postings. Russia is building a new production facility at the Biysk Oleum Plant with a projected capacity of 6,000 metric tons of high explosives per year. Kalibr cruise missiles, Kh-101 air-launched weapons, and Iskander ballistic systems are being produced at a rate that exceeds the consumption rate of strikes on Ukraine, suggesting stockpiling for a theater that extends beyond the current war. Russia’s Black Sea Fleet has been badly degraded by Ukrainian maritime drones, and the Bosporus closure under the Montreux Convention prevents replacement vessels from entering. Russia has responded by shifting its naval construction emphasis toward Baltic and Arctic platforms.
The missile systems rolling off these production lines can reach European capitals and NATO bases. The Kremlin’s current preference for cheap Shahed-type drones over cruise and ballistic missiles in Ukraine is a tactical choice, not a capacity constraint. The stockpile is growing. The logic of that stockpile is not confined to the Ukrainian front.
Russia’s domestic budget tells the same story. For 2026, the Kremlin has raised VAT from twenty to twenty-two percent, lowered the VAT threshold for small businesses, introduced a gambling tax, and projected that economic growth will slow to 1.3 percent from 4.1 percent in 2024. Defense spending is budgeted at 13 trillion rubles. National security and law enforcement spending is rising by thirteen percent. The war is transferring its costs to Russian consumers in visible, quantifiable ways, and the Kremlin is sustaining the investment regardless. A government that raises consumer taxes in wartime to maintain defense spending is not preparing to negotiate from a position of exhaustion.
The Threshold That Has Never Been Drawn
Europe has been in a structurally untenable position since 2022, and has not resolved it. NATO has Article 5, the collective defense commitment triggered by an armed attack on a member state. No allied government has publicly defined, in terms that bind operational planning, what threshold of Russian hybrid activity constitutes the attack that triggers it. Russia has understood and exploited this gap continuously.
A shopping mall fire is a police matter. A Baltic cable cut is a maritime incident. A parcel bomb on a DHL aircraft is a customs and security investigation. Each of these, processed individually through domestic legal frameworks, remains below the threshold of collective military response. Processed collectively across fifteen countries and four years, they constitute a military campaign against the European rear of the Ukraine war. The European Commission and NATO leadership have both said so publicly. Ursula von der Leyen called it “hybrid warfare” from the Parliament floor in October 2025. Danish Prime Minister Mette Frederiksen said Europe was in “the most difficult and dangerous situation since the end of the Second World War.” These are correct assessments. Neither has produced a deterrence framework with defined red lines and specified costs.
The Recorded Future analysis from February 2026 assessed that Putin views the period through the 2028 US election as a strategic window: sufficient time to test NATO’s cohesion, exploit US-European tensions under the Trump administration, and prepare the physical and psychological environment for whatever follows Ukraine. The GRU’s European campaign is not tactical pressure designed to stop the current drone financing. It is preparation of the terrain for a longer confrontation. The targets are chosen accordingly: transport logistics feeding Ukraine, defense supply chains, civilian infrastructure with high psychological value, and now specifically the companies named on the April 15 list.
Europe’s anti-drone investments are real but structurally insufficient for the cost differential. Russia deploys cheap commercial-grade drones and proxies paid €10,000 per job. Europe counters with electromagnetic intercept systems, sensor networks along eastern borders, intelligence coordination across fifteen jurisdictions, and legal proceedings through national court systems. The cost asymmetry is not a temporary imbalance; it is the operating model Russia chose precisely because it is sustainable at scale and Europe’s response is not.
The Swedish war game on Gotland on May 11, where Ukraine’s military was present to advise NATO allies on drone warfare tactics, illustrated the gap differently. The exercise exposed that radar systems produced by different NATO member companies cannot yet share targeting data in real time. “We’re not there yet,” one Swedish military official told the Associated Press. That is a three-word summary of Europe’s anti-drone posture four years after the GRU’s campaign began.
The Diplomatic Vacuum
There is no active diplomatic channel between Europe and Russia. There is no agreed de-escalation framework, no defined red line on either side, no back-channel verified by multiple governments as operational. The Trump administration’s intermittent ceasefire mediation in early 2026 has not produced terms that either Ukraine or Russia has accepted. European governments have positioned themselves outside those negotiations rather than inside them, partly from principled solidarity with Kyiv, partly because the negotiations are proceeding from a Kremlin baseline that requires Ukrainian territorial concessions no European government can endorse without destroying its own credibility.
Russia’s formal negotiating position has not changed materially from its December 2021 treaty draft: Ukrainian neutrality, no NATO membership, rollback of NATO’s eastern posture to pre-1997 positions. Ukraine and its backers have rejected this as legitimizing the aggression. The argument is correct. It is also true that the war has not forced Russia to move off that position, and Russia’s missile stockpile is growing while the negotiations stall.
Both parties have a structural incentive to avoid defining a settlement. Russia benefits from sustained ambiguity because its hybrid campaign operates in ambiguity and because a frozen negotiation forestalls coordinated Western pressure. Ukraine and its European backers benefit from sustained ambiguity because naming a settlement requires specifying what Ukraine concedes, and no European government has the political bandwidth to make that case to its own public while also asking that public to absorb the costs of Russia’s hybrid campaign on their streets.
The cost asymmetry runs through the political domain as much as the military one. Russia’s operations in European cities are not random. CSIS and Prevail Partners analysis shows Russian sabotage incidents are timed around NATO summits, major aid announcements, and elections. The Paris Stars of David operation coincided with a period of elevated anti-EU sentiment in France. The GRU’s recruitment of Ukrainian refugees as proxy operatives in Poland and Lithuania was a deliberate strategy to inflame domestic tensions over Ukraine policy. Russia is not only targeting infrastructure. It is targeting the political coalitions that sustain European support for Kyiv.
The European public has not been given a full account of what its governments have committed. A €6 billion drone alliance financed from frozen Russian assets, joint production lines in Germany for weapons that can reach Moscow, drone factories in Norwegian fjords delivering systems to Ukrainian forces by summer: these are decisions with geopolitical consequences that function as acts of co-belligerency under the classification Moscow has publicly adopted. They may be the right decisions. They have been made without a formal parliamentary account of what Russia has already done, at factory level and railway level and shopping mall level, across the continent in direct response.
The Kremlin’s private calculation, reflected in its budget commitments, its missile stockpile, and its investment in a dedicated European sabotage directorate, is that Europe’s political will is more fragile than its industrial capacity. Russia is not primarily trying to destroy European drone factories. It is trying to make European electorates decide the cost is not worth it.
Whether that calculation is wrong depends entirely on what European governments are prepared to tell their citizens about what the commitment actually entails, and whether those citizens, once told, will hold.