# GRU-linked sabotage network in Europe

> Live situation record from CLSTR: https://clstr.news/situations/gru-linked-sabotage-network-in-europe
> Updated: 2026-09-26T05:39:52.000Z. Sources: 24. Developments: 2.

Slovak authorities initially thwarted a planned arson attack on the Skyeton drone manufacturing plant in Haniska, near Prešov. The plot, which targeted a facility producing unmanned systems for the Ukrainian military, resulted in the detention of four suspects, including citizens of Ukraine and Latvia. A group calling itself ‘Global Citizens Against War 1984’ claimed responsibility, though investigators noted that images released by the group appeared to be AI-generated.

Subsequent investigations by security services have linked these activities to a broader network operating out of Slovakia. This network is allegedly managed by a specialized unit of the Russian military intelligence agency, GRU, which utilizes Telegram for recruitment and cryptocurrency for payments. 

The network has been implicated in various hybrid attacks across Europe, including an arson attack in Munich, Germany, targeting a construction site near the headquarters of Rohde & Schwarz—a drone supplier to the Ukrainian armed forces—and a drone attack attempt at Leipzig/Halle airport. 

In Munich, two Bulgarian nationals were arrested following an arson attempt on September 3 near the headquarters of technology and defense companies Rohde & Schwarz and Helsing. German investigators have linked this incident, along with the August 4 drone attack at Leipzig/Halle airport, to the GRU’s Special Activities Service. In Slovakia, the thwarted attack on the Skyeton factory posed a risk to approximately 70 employees and could have caused tens of millions of euros in damage. Following these developments, Slovak opposition parties have called on Prime Minister Robert Fico to convene the Security Council to address the threat posed by Russian operations on Slovak soil.

## Claims

- A group linked to the Russian GRU operated from Slovakia. (corroborated by 15 sources)
- The group planned an attack on the Skyeton drone plant near Prešov. (corroborated by 12 sources)
- Two Bulgarians arrested after an arson attack in Munich are linked to a Russian GRU group. (corroborated by 12 sources)
- The GRU reportedly recruits operatives via Telegram and uses cryptocurrency for payments. (corroborated by 12 sources)
- Investigators have linked the Munich arson and a drone incident at Leipzig/Halle airport to the GRU. (corroborated by 12 sources)
- The GRU's operations aim to disrupt military supplies to Ukraine and pressure European nations to reduce support for Kyiv. (corroborated by 12 sources)
- The planned arson attack in Prešov could have caused an extensive fire and threatened approximately 70 lives. (corroborated by 6 sources)
- Slovak opposition parties are demanding that Prime Minister Robert Fico convene the Security Council to address the GRU links. (corroborated by 2 sources)

## Timeline

### 2026-09-26: GRU-linked network targets European defense firms via Slovakia

German and Slovak authorities have uncovered a GRU-linked network operating from Slovakia, targeting drone manufacturers and defense companies through arson and sabotage to disrupt military aid to Ukraine.

17 sources. https://clstr.news/cluster/gru-linked-network-operating-from-slovakia-implicated-in-european-sabotage

### 2026-08-27: Slovakia thwarts arson attack on Skyeton drone factory

Slovak police foiled a planned arson attack on the Skyeton drone factory near Prešov, detaining four suspects, including Ukrainian and Latvian nationals, and seizing incendiary materials.

9 sources. https://clstr.news/cluster/slovakia-thwarts-arson-attempt-on-ukrainian-drone-plant

---
Cite as: GRU-linked sabotage network in Europe. CLSTR, https://clstr.news/situations/gru-linked-sabotage-network-in-europe