If Russia were to attack a NATO member, Germany would have six months to move as many as 800,000 allied troops and 200,000 vehicles across its territory toward the alliance's eastern flank. The ports, airports and railways required for that movement are the same infrastructure that already carries military equipment through Europe and toward Ukraine. According to German statements, Russia attempted to bomb a Ukrainian cargo aircraft at Leipzig/Halle Airport, which houses NATO's heavy-airlift program. Fires and incendiary devices have subsequently reached European ammunition, drone and military-electronics companies, followed by three attempts against German electricity infrastructure. Europe's support for Ukraine and NATO's reinforcement plan both rely on the same civilian transport and power networks. Both missions have grown heavier since Russia's full-scale invasion of Ukraine in 2022: military aid to Kyiv has expanded steadily, and NATO has reinforced its eastern members while Germany, sitting at the geographic center of the alliance, has become the principal transit corridor between Western ports and the eastern flank.

Leipzig/Halle had already figured in a Russian sabotage case. On July 20, 2024, a parcel containing an incendiary device and explosives ignited inside a DHL container at the airport. Polish prosecutors later charged five people with working for Russian intelligence to send incendiary parcels through European courier networks. A second parcel ignited at Birmingham Airport, a third burned inside a truck trailer in Poland, and a fourth failed to ignite. The group also sent test parcels to the United States and Canada to record international delivery routes and transit times. The parcels demonstrated how little-specialized methods can weaponize ordinary commercial logistics, the same networks military planners count on in a crisis.

On August 10, explosions and fire struck an ammunition warehouse operated by the Bulgarian arms manufacturer EMCO near Belitsa. The company ruled out human error, while prosecutors continued to examine both accidental and deliberate causes. Five days later, fire damaged a Tallinn building used by Milrem Robotics; Latvian security officers arrested three Latvian citizens on suspicion of arson and assistance to a foreign state. Slovak police stopped three foreign nationals from setting fire to a Skyeton drone factory near Prešov on August 25. On August 31, an incendiary charge burned warehouse space at a WB Electronics plant in Poland, causing at least 15 million zloty in damage. Polish prosecutors are investigating that fire as an act of terrorism carried out on behalf of a foreign intelligence service. The targets span several NATO members and all sit in supply chains that produce ammunition, drones and electronics for Ukraine's war effort.

German authorities found more than a dozen pyrotechnic launch devices at a substation near the Jänschwalde power station on September 2. One device carried a cable into a high-voltage line and connected it to the ground. Hours later, conductive material caused a short circuit at the Bergheim substation, disconnecting five generating units with 4.2 gigawatts of combined capacity. Police found six launch devices in a nearby field. Two more devices were discovered beneath a high-voltage line near Dormagen on September 4. A 48-year-old man claimed responsibility for Bergheim and Dormagen, citing opposition to fossil fuels. Interior Minister Alexander Dobrindt said the evidence in those cases pointed to climate extremism, while the Jänschwalde investigation remained separate. The Bergheim short circuit showed that even non-state actors with simple materials can knock gigawatts of capacity offline, a vulnerability that becomes more consequential when the same grid powers rail traction, port cranes and fuel pipelines tied to a military deployment.

Shortly after midnight on September 3, police arrested two Bulgarian nationals after incendiary devices were thrown from a moving car at a construction site outside the Munich headquarters of Rohde & Schwarz. Two devices ignited and a third failed. Rohde & Schwarz produces military communications equipment and systems used to detect, track and jam drones; the nearby offices of Helsing belong to a German company producing combat drones for Ukraine. The fire caused no material damage to either company, and German authorities have not publicly connected the two suspects to Russia.

Germany's Federal Criminal Police Office had recorded 160 possible acts of sabotage and more than 700 suspicious drone sightings in 2026 by early September, according to an internal document cited by German media. Those totals include incidents with different suspected perpetrators and do not constitute 160 Russian operations.

The German Grid Could Be NATO's Weak Link

Germany's classified, 1,400-page operations plan assigns a major part of the NATO deployment to civilian companies. Deutsche Bahn and other transport businesses hold standby contracts, and Rheinmetall has agreed to establish staging areas where military convoys can refuel, eat, sleep, and repair vehicles. Germany is not capable of executing this logistics plan without commercial companies.

In February and March 2026, Germany tested its logistics role during the Bundeswehr's Quadriga exercises and NATO's Steadfast Dart exercise. Germany received and moved about 6,400 members of NATO's Allied Reaction Force, handling 75 military flights, seven cargo and ferry ships, and almost 100 road convoys. The operation consumed 300,000 liters of diesel and 170,000 liters of aviation fuel.

The ports, railways, airports and motorway systems in Germany's NATO plan all depend on the civilian electricity grid. An attack on the grid near one of these transport nodes could interrupt several parts of a NATO deployment without ever striking a military installation.

Germany's electricity system is divided among four high-voltage transmission operators and 851 distribution-network operators. Of the distribution companies, 767 serve fewer than 100,000 customers and 643 serve fewer than 30,000. NATO convoys crossing Germany would therefore rely on electricity networks owned and operated by hundreds of companies with widely different territories, staffing levels and financial resources. That fragmentation stands in contrast to the unified chain of command of the forces those networks would be moving.

Protection of substations falls to the operators themselves, while police protect the surrounding public space. The country's new critical-infrastructure law had yet to take effect when saboteurs targeted electricity installations at Jänschwalde, Bergheim and Dormagen in September. As a result, NATO's logistics plan depends partly on security decisions made by hundreds of grid companies. What to watch next is whether Germany accelerates physical protection of substations and implements the pending critical-infrastructure rules faster than planned, and whether the exercises and incidents prompt NATO to harden civilian transport nodes on the alliance's other logistics routes as well.

Next on Russia's Target List

On April 15, Russia's Defense Ministry published the names and addresses of 11 companies it described as European branches of Ukrainian drone producers, along with 10 foreign manufacturers of drone components used by Ukraine. The ministry called their host countries Ukraine's "strategic rear." Dmitry Medvedev, deputy chairman of Russia's Security Council, then called the companies "potential targets for the Russian armed forces." In doing so, Moscow had publicly placed factories inside NATO countries within the geography of its war four months before the attacks at Leipzig/Halle Airport, European defense plants and German electricity installations.

On September 5, Steve Witkoff and Jared Kushner met Vladimir Putin in Moscow to revive negotiations over Ukraine. That same day, Denmark's intelligence service disclosed concrete Russian preparations for sabotage in Denmark, directed primarily at defense companies and businesses connected to military aid for Ukraine. The American envoys traveled to Kyiv on September 6 and left without a breakthrough. The Danish disclosure signaled that the sabotage campaign documented in Germany and Eastern Europe extends to at least one more NATO state, and that European security services are now warning of it openly.

German voters delivered Moscow a more favorable result on September 6. The Alternative for Germany won 43.8% of the vote in Saxony-Anhalt, more than doubling its 2021 share. The AfD has called for reducing Germany's financial and military assistance to Ukraine, easing sanctions during negotiations, and removing them after a peace agreement. Russian presidential envoy Kirill Dmitriev celebrated the result as a "historic win for the pragmatic AfD." Russia ended the weekend negotiating over the war in Moscow while gaining ground inside the German political system responsible for sustaining Ukraine and moving NATO forces east.

By Charles Kennedy for Oilprice.com