The Baltic states bordering Russia have repeatedly become targets of hybrid attacks by their eastern neighbour. A fire at a defence company in Tallinn that supplies equipment to Ukraine has once again highlighted the existing threat.
The primary line of inquiry: Russian sabotage
About a week ago, a warehouse building occupied by Milrem Robotics caught fire in Tallinn’s Lasnamäe district. The blaze was detected quickly thanks to a passer-by who noticed suspicious individuals on the premises. Estonia’s Internal Security Service immediately suspected sabotage. A few days later, three suspects were detained in neighbouring Latvia, where the State Security Service seized items believed to have been used to set the building on fire.
“Now the investigation must establish why this was done. One of the possibilities being examined is that this may have been an act of sabotage and that Russia was behind the arson. The state takes this possibility seriously and is acting accordingly,” Estonian Prime Minister Kristen Michal commented in the immediate aftermath.
“If the aim of this act was to intimidate Estonia, turn our people against one another or make us abandon our support for Ukraine, it will not succeed. Estonia will not allow itself to be intimidated or pressured. We will stand by our decisions and continue supporting Ukraine. Our task is to protect the people of Estonia, our companies and the security of our country. And we will do so decisively, using all the means at our disposal,” he added.
Margo Palloson, Director General of the Estonian Internal Security Service (KAPO), said that attacks on critical infrastructure must be taken seriously and recommended strengthening security measures for both physical and digital infrastructure.
A drone supplier for NATO and Ukraine
Milrem Robotics is an Estonian defence company that manufactures unmanned ground vehicles as well as autonomous control systems used in military logistics — including the evacuation of wounded soldiers and transportation of ammunition — and reconnaissance. Its best-known product, THeMIS, can also be used as an unmanned combat vehicle. Several years ago, a controlling stake in the successful company was acquired by the UAE defence group EDGE.
Milrem Robotics exports its products worldwide: its vehicles are used in many countries, including several NATO members. Since late 2022, the Estonian company has been supplying its unmanned vehicles to Ukraine. This year, the Netherlands ordered 100 THeMIS units from the company and also plans to transfer them to Ukraine, which is defending itself against Russia’s invasion. There are relatively few suppliers of this type of equipment worldwide, and three of them work with Ukraine — Milrem and Rheinmetall among them. By the end of the year, the Estonian company had planned to increase the number of its unmanned vehicles in Ukraine to more than 200.
Against this background, suspected sabotage was identified from the outset as the primary line of inquiry. However, the perpetrators apparently failed to cause major damage. Milrem CEO Kuldar Väärsi told Reuters that nothing would seriously disrupt deliveries either this year or next, because the incident had not affected production, supply chains or delivery schedules.
Väärsi declined to tell Estonian media what had been stored in the Tallinn warehouse at the time of the fire or what exactly had been damaged. “Now is not the best time for that,” he said, citing the ongoing investigation.
Russia’s hybrid war against the West
The arson attack on Milrem’s Tallinn warehouse is not the first incident of its kind and fits squarely into the broader strategy of hybrid warfare that Russia has been waging against the West.
Such incidents across Europe peaked in 2024. In March, a warehouse in London storing Starlink equipment intended for Ukraine was set on fire. British prosecutors later linked the organiser to a Russian handler and the Wagner Group. That same year saw a series of attempted arson attacks in Lithuania, Poland, Romania and the Czech Republic. The targets included businesses connected to military supplies for Ukraine, oil facilities, post offices and an IKEA store in Vilnius. Lithuanian investigators said this was a coordinated GRU operation. Parcels containing explosive devices were also sent from Lithuania that year, with plans for them to detonate after delivery. A sentence in a similar case was handed down in Germany only a few days ago.
European intelligence agencies have repeatedly warned that the arsenal of hybrid warfare is broad. MI6 chief Blaise Metreweli has cited cyberattacks on critical infrastructure, drones disrupting airports and military bases, aggressive actions at sea, arson and other forms of sabotage, as well as propaganda operations designed to divide societies.
All of this continued through 2025 and 2026. In November 2025, an explosion occurred on the Warsaw-Lublin railway line in Poland. Prime Minister Donald Tusk described it as an “unprecedented act of sabotage”, with suspicions once again falling on Russia. Among the most recent cases, a drone carrying explosives was discovered at Leipzig Airport in Germany. The authorities quickly described the incident as a hybrid attack, although the investigation is still under way.
The Baltic Region and Estonia, at the forefront of Russia’s hybrid campaign
Estonia, too, has not been left untouched. It began with the arson attacks on the cars of the interior minister and the editor-in-chief of the country’s largest Russian-language media outlet in 2023. This was followed by the desecration of monuments.
As Internal Security Service chief Margo Palloson noted a year ago, Russian intelligence services continue to show a sustained interest in Estonia. In 2023, around ten people were arrested in connection with acts of vandalism against monuments and vehicles carried out at the behest of Russian intelligence services. Among other incidents, a car with Ukrainian licence plates was set on fire in the city of Tartu. In 2024, five people accused of links to Russia’s GRU military intelligence agency were put on trial. Fifteen people had their residence permits revoked on KAPO’s recommendation because they were deemed a threat to national security.
It should, however, be noted that in Estonia the label “security threat” has in recent years been applied pretty often, including in cases where the grounds were far from obvious. Nevertheless, the number of sabotage incidents that investigators have in one way or another linked to Russian intelligence services continues to rise. Arson, in particular, remains one of the methods most frequently used by perpetrators.
In 2025, a Moldovan-born man acting on instructions from Russian intelligence services set fire to a Coop store in southern Estonia and later to the Tallinn restaurant Slava Ukraini, owned by a prominent public figure. The perpetrator admitted his guilt and was sentenced to 6.5 years in prison.
In neighbouring Latvia, the State Security Service last autumn detained people linked to Russian intelligence services who, according to the agency, had been reconnoitring potential targets, photographing critical infrastructure and preparing arson attacks. It is also worth mentioning a series of damaged undersea cables in the Baltic Sea, including incidents involving vessels associated with Russia’s shadow fleet.
The arsenal of hybrid warfare is highly diverse, but at least in Estonia, Russian intelligence services and the people they have recruited have so far failed to inflict substantial damage. Forewarned is forearmed, and Estonia is fully aware of the risks it faces.
