Kremlin Expands 'Wet Work' Campaign Against European Arms Executives

Key points

• Five European intelligence services confirmed that the Kremlin has ordered an expansion of sabotage and hybrid operations, specifically targeting civilian defence leaders.
• The GRU is shifting from single 'disposable' agents to complex operations involving organized crime groups and divided cells for reconnaissance and execution.
• Germany’s BfV has increased outreach to defence companies, recommending private close-protection teams after warning lawmakers about deliberate state-planned violence.
• Executives at major firms and smaller drone manufacturers have escalated security measures in the past six months, with some relocating production sites to mitigate risks.
• Intelligence officials note that the primary goal is psychological, aiming to make executives hesitate before doing business with Ukraine, even if physical attacks are not carried out.

Background

This escalation follows the 2024 uncovering of a plot against Rheinmetall CEO Armin Papperger, which NATO confirmed in January 2025. Recent months have seen a broader pattern of Russian hybrid aggression, including drone incursions near NATO borders and cyber operations, as noted in earlier coverage of Estonian and NATO security concerns. The current threat represents a shift from traditional state-on-state conflict to targeted violence against the civilian infrastructure of European rearmament.

How outlets are covering it

The Financial Times provides the most detailed account, citing five intelligence agencies and highlighting the shift in GRU methods toward organized crime partnerships. United24 Media corroborates the FT’s findings, emphasizing the financial burden on smaller startups and the relocation of production sites. Ukrainian Pravda mirrors the FT’s narrative closely, focusing on the psychological intent behind the plots. All three sources agree on the involvement of the GRU and the BfV’s response, but the FT uniquely details the specific operational changes, such as the division of tasks among different cells, while United24 highlights the economic impact on the industry.

Why it matters

The targeting of defence executives signals a new phase in Russia’s hybrid warfare, aiming to decouple European industry from Ukraine through fear. If successful, this could slow the pace of European rearmament and reduce the flow of critical military hardware to Kyiv. The involvement of organized crime complicates international investigations and suggests a long-term, sustained campaign rather than isolated incidents, potentially influencing European security policy and corporate risk management strategies.

What to watch

Expect continued increased security spending and private protection contracts for European defence firms. Intelligence services will likely maintain heightened surveillance of 'pattern-of-life' activities near executives' homes and workplaces. European governments may further integrate security advisories into corporate compliance, while smaller firms may face pressure to consolidate operations or relocate to safer jurisdictions to mitigate the threat.