Russia calls arms plants potential targets. The saboteurs are disposable

Russian Foreign Ministry spokesperson Maria Zakharova said on 30 September that weapons factories in Europe producing arms for Ukraine "are potential military targets for Russia," per the Kyiv Independent. German investigators suspect the GRU organized the 2–3 September arson beside the Munich headquarters of Rohde & Schwarz and Helsing, according to Meduza, citing the Frankfurter Allgemeine Zeitung. On 29 September, Estonia's government said the August fire at a Milrem Robotics building in Tallinn was "an act of sabotage commissioned by the special services of the Russian Federation," per Defense News. Zakharova's statement followed a pattern of suspected Russian sabotage.

The suspects look like recruits, not intelligence officers. Police detained a 28-year-old woman and a 38-year-old Bulgarian man in Munich, and investigators believe the GRU recruited both, Meduza reported. German security sources place the Munich suspects in a GRU-linked group operating from Slovakia, per EUobserver. The same wider network was reportedly preparing an arson attack on Skyeton's drone plant near Prešov. Recruitment in such operations may run through Telegram with crypto payments, the outlet notes, so a professional GRU officer can stay several layers removed.

Disposable recruits can slip past threat models built around trained officers, because they may carry little of the tradecraft those models look for. One step stays observable: reconnaissance, as two recent cases show. Latvia's State Security Service said on 1 October it had detained a Latvian couple in June; one had photographed Ādaži Military Base from a small private airplane on behalf of the GRU. A Justice Department indictment unsealed on 15 September describes a Kremlin-backed network, including an alleged FSB officer, promising a Brooklyn-based recruit money to photograph locations tied to the intended victim of an alleged murder-for-hire plot in Washington, per NBC News.

OBSIDIAN — Counterintelligence is designed for this seam. It supports security and counterintelligence teams in correlating signals the organization already governs — security-incident reports, badge and access anomalies, open-source targeting indicators, and supplier and partner vetting — and resolving them to the people, facilities, and programs they concern. The aim is early warning during the reconnaissance phase, before an attempt. Analysts validate each warning, and security leads choose the response.

This extends the gray-zone pattern we covered earlier, with one change: Moscow has now named arms plants supplying Ukraine as potential targets. Defense-industrial and dual-use operators in Europe should assume the next attacker was recruited last week and may not know who hired them. The recruit is replaceable. Reconnaissance is the part a security team can watch for.