Slovak police detained three foreign nationals on suspicion of preparing an arson attack on a plant operated by the Ukrainian drone manufacturer Skyeton in the village of Haniska. Two suspects were detained in Slovakia and a third in Germany under a European arrest warrant. Police seized an incendiary mixture, tools, phones, an action camera, and a map
of the facility. According to police, the fire could have caused substantial casualties, as around 70 people were present at the site at the time of the planned attack, while the damage could have amounted to “tens of millions of euros.” A Skyeton representative said that Russia regularly attempts to attack the company’s production facilities and described the failed arson attempt as evidence that Ukrainian defense manufacturers have become “a real thorn in the Kremlin’s side.”
One indication of possible Russian involvement in the attempted arson attack on Skyeton’s Slovak plant is the fact that the facility produces UAVs for the needs of Ukraine’s defense forces.
The detention of three foreign nationals linked to the plot, against the backdrop of a series of other similar attacks on defense and logistics facilities in Europe, points to the systematic and planned nature of coercive actions by Russian intelligence services aimed at disrupting and obstructing military support for Ukraine.
For Slovakia, this incident should be a warning that Russian hybrid aggression is not an abstract threat: the sabotage was being prepared on Slovak territory and could have endangered the lives of dozens of people. Bratislava should treat such cases as a challenge to its own national security and strengthen counterintelligence and physical protection for defense enterprises.
The Skyeton incident should be presented not as an isolated act of sabotage in Slovakia, but as a new episode in a campaign of physical pressure against Europe’s defense-industrial ecosystem supporting Ukraine. This makes it possible to connect the Slovak case with developments in Germany — from preparations for arson and bomb attacks to the plot against the head of Rheinmetall. At the same time, attribution should not be overstated: Slovak police have not yet publicly identified Russia as the sponsor of the attempted attack on Skyeton. (euronews) (euronewseuronewseuronews)
The detention in Slovakia and Germany of three foreign nationals suspected of preparing an arson attack on a facility operated by the Ukrainian drone manufacturer Skyeton should be viewed in the context of a broader campaign of sabotage, target reconnaissance, and physical pressure against European defense companies and logistics infrastructure involved in supporting Ukraine.
Slovak police have not publicly established Russian responsibility for the operation. At the same time, the nature of the target, preparations for the attack “on the instructions of another person,” the use of foreign operatives, and the wider European context provide grounds for treating the Russian connection as one of the principal working hypotheses.
Germany’s Federal Prosecutor’s Office has already charged individuals who, according to investigators, maintained contacts with Russian intelligence and prepared explosions and arson attacks against military and industrial infrastructure with the aim of weakening military support for Ukraine. In 2024, U.S. intelligence also uncovered a Russian plot to assassinate Rheinmetall CEO Armin Papperger; NATO later publicly placed that episode within a broader sabotage campaign against Alliance countries. (Presseportal) (PresseportalPresseportalPresseportal)
The potential Russian campaign therefore appears to be expanding across the entire supply chain supporting Ukraine: defense-company executives, production facilities, railway routes, military sites, air-logistics hubs, and freight transport. Its strategic objective may be less the physical destruction of individual enterprises than the raising of the cost, risk, and political price of European defense cooperation with Ukraine.
For Slovakia, the Skyeton case has particular significance. If a Russian link is confirmed, it would amount to an attempt to conduct a potentially lethal operation on the territory of a NATO member whose government has taken a considerably more cautious approach to supporting Ukraine than Poland, Czechia, or the Baltic states. This would mean that political accommodation or pragmatic relations with Moscow do not provide immunity from Russian coercive operations when infrastructure critical to Ukraine’s defense capacity is located on a state’s territory.
The Attempted Attack on Skyeton
On August 25, Slovak police announced the detention of three people suspected of preparing an arson attack on an industrial facility in the east of the country. Two suspects were detained in Slovakia and a third in Germany under a European arrest warrant. None of the detainees is a Slovak citizen. According to police, they acted as accomplices “on the instructions of another person.” (euronews) (euronewseuronewseuronews)
Police seized a substantial quantity of incendiary mixture, tools, mobile phones, an action camera, and a hand-drawn plan of the facility. According to information released later, the mixture consisted of gasoline and polystyrene — effectively an improvised form of napalm. (euronews) (euronewseuronewseuronews)
Law-enforcement officials stressed that the plan, if carried out, could have caused a major fire, created a direct threat to human life, and inflicted significant material damage. Around 70 employees could have been present at the facility at the same time, while the value of the property was estimated in the tens of millions of euros. (euronews) (euronewseuronewseuronews)
Slovak police initially did not identify the company, but Skyeton confirmed that the target was one of its production facilities. The Ukrainian-founded company manufactures unmanned systems used by Ukraine’s defense forces.
Importantly, Slovak law enforcement received information about preparations for the attack from the Slovak intelligence service. This may indicate that the investigation has a broader counterintelligence dimension, although neither the sponsor nor the state on whose behalf the suspects may have acted has yet been publicly identified. (euronews) (euronewseuronewseuronews)
It would therefore be premature to claim that Russian involvement has been proven. A more defensible analytical formulation is:
the nature of the target and the method used to organize the attack are consistent with sabotage models previously employed by Russian intelligence services against military and defense-industrial infrastructure in Europe.
From Arson to Assassination: The German Precedent
Germany provides the most important context for the Slovak incident.
In April 2024, Germany’s Federal Prosecutor’s Office detained two German-Russian citizens in Bayreuth — Dieter S. and Alexander J. The main suspect was accused of contacts with a person linked to a Russian intelligence service and of discussing sabotage operations in Germany. (Presseportal) (PresseportalPresseportalPresseportal)
According to federal prosecutors, the plans included explosions and arson attacks, primarily against military infrastructure and industrial facilities. Their purpose was allegedly to weaken military assistance to Ukraine originating from German territory. The suspects also conducted reconnaissance of potential targets, photographed and filmed military installations and military cargo movements. Sites of interest included U.S. military facilities and infrastructure connected to the movement of military supplies. (Presseportal) (PresseportalPresseportalPresseportal)
In December 2024, federal prosecutors formally charged three individuals. The allegations against Dieter S. included intelligence activity for the purpose of sabotage, conspiracy to cause an explosion, preparation of arson, and preparation of dangerous interference with railway traffic. (Presseportal) (PresseportalPresseportalPresseportal)
The case illustrates a key feature of the Russian model: rather than deploying a professional sabotage team to Europe, Moscow can rely on low-level or disposable agents recruited for a specific task.
German counterintelligence increasingly describes Russian operations in these terms: operatives may not be professional intelligence officers, may have only limited knowledge of the ultimate sponsor, and may be paid to reconnoiter a site, commit arson, damage equipment, or carry out another narrowly defined act. (tagesschau.de) (tagesschau.detagesschau.detagesschau.de)
This is directly relevant to the Skyeton case. The three foreign nationals who, according to Slovak police, acted on someone else’s instructions conceptually fit this model. A connection can be established, however, only after investigators identify the communication channels, financing, and the coordinator.
The Plot Against Armin Papperger: A Shift Toward Personal Terror
The clearest indication that the campaign was escalating was the plot to assassinate Rheinmetall CEO Armin Papperger.
In July 2024, Reuters, citing CNN, reported that U.S. intelligence had uncovered a Russian plot to kill him. Washington passed the information to German services, after which Papperger’s protection was strengthened. (Reuters) (ReutersReutersReuters)
According to U.S. and other Western officials, Papperger was not the only potential target. The plan to kill him was part of a series of Russian plots against executives of European defense companies supplying weapons to Ukraine; the German case was reportedly the most advanced. (tagesschau.de) (tagesschau.detagesschau.detagesschau.de)
The choice of Rheinmetall was strategically logical. The company was rapidly increasing production of artillery ammunition and armored vehicles, supplying Ukraine, and expanding industrial cooperation directly with Ukraine’s defense sector.
In January 2025, NATO Deputy Assistant Secretary General James Appathurai effectively placed the Papperger case within the wider picture of Russia’s sabotage campaign, alongside arson attacks, attempts to damage railways, and other coercive operations on Allied territory. (Reuters) (ReutersReutersReuters)
This changes the threat assessment.
The issue is no longer limited to attempts to damage equipment or disrupt logistics, but extends to the possible physical elimination of individuals who constitute critical nodes in Europe’s defense-industrial complex.
Under this logic, the chief executive of a major defense company becomes, from the perspective of Russian intelligence, analogous to a critical infrastructure asset.
Air Logistics as the Next Level
Another important German episode concerns freight transportation.
In July 2024, self-igniting parcels were sent through the European logistics network. One caught fire at a DHL sorting center at Leipzig/Halle Airport shortly before it was due to be loaded onto an aircraft. In March 2026, Eurojust reported that a joint investigation by Germany, Lithuania, the Netherlands, Poland, and the United Kingdom had identified 22 suspects who, according to investigators, acted in the interests of the military intelligence service of the Russian Federation. (Eurojust) (EurojustEurojustEurojust)
Western intelligence services linked this operation specifically to the GRU. German investigations indicated that senior officers of Russian military intelligence may have been involved in planning it. (WDR Presselounge) (WDR PresseloungeWDR PresseloungeWDR Presselounge)
The risk went far beyond damage to the cargo: had the device ignited after loading, the result could have been the loss of a civilian cargo aircraft.
In August 2026, Leipzig/Halle again became the focus of an investigation after drones carrying explosives were found near the airport, including close to a Ukrainian An-124 transport aircraft used to move military cargo. The federal government has not yet announced an official attribution, although German media, citing security sources, report that investigators are examining a possible Russian connection. (Reuters) (ReutersReutersReuters)
Skyeton should therefore be assessed together with this logistics component. The potential Russian target architecture no longer encompasses a single factory, but an entire network for the production and delivery of weapons.
From Individual Acts of Sabotage to a Systemic Campaign
Taken together, the incidents reveal a clear progression: target reconnaissance → preparation of arson and bomb attacks → attacks on logistics → attempts to create the risk of an aviation disaster → personal assassination plots against defense-industry executives.
This progression matters more than the number of individual incidents.
The strategic target of the campaign is no longer a specific factory, but Europe’s defense-support ecosystem for Ukraine.
Potential target categories include enterprises directly producing weapons for Ukraine, European facilities of Ukrainian defense companies, defense-industry executives and key engineers, railway routes and logistics hubs, airports and air-freight operations, military bases and training centers, ammunition and component depots, production chains, and suppliers of critical components.
This explains why the Skyeton plant in Slovakia is a logical target regardless of the Slovak government’s political position.
For a Russian planner, the decisive factor is not whether a government is “pro-Russian” or “anti-Russian,” but what function a particular facility performs within Ukraine’s military-industrial system.
Why Foreign Nationals and “Disposable Agents” Are Used
The use of non-professional operatives offers Russian intelligence services several advantages.
It reduces the risk of losing career officers, complicates attribution, allows operations to be scaled quickly, and creates additional distance between the operative and the state sponsor.
Following the mass expulsions of Russian intelligence officers working under diplomatic cover in Europe after 2022, the importance of such proxies has naturally increased.
German cases show that operatives can be tasked with reconnoitering a site, photographing military cargo, committing arson, or damaging transport infrastructure without the need to build a classic agent network.
In the Skyeton case, the presence of an action camera also merits attention. It may have been intended to document the site before the attack or to record the result afterward. For now, this remains an analytical hypothesis, but determining what footage was stored on the device and to whom it was meant to be transmitted could be important for identifying the role of an external coordinator.
Why Skyeton Is a Strategic Target
An attack on a Ukrainian defense enterprise outside Ukraine could create a potentially greater strategic effect for Moscow than destroying a comparable facility inside the Ukrainian theater of war.
Inside Ukraine, defense enterprises already operate under constant missile and drone threat. Relocating production to the EU is intended, among other things, to reduce physical risk.
If Russian intelligence services can continue to target these enterprises after they move into NATO states, Moscow undermines the very logic of safe-haven production.
The signal is not directed at Skyeton alone.
It may be aimed at all European companies considering joint ventures, licensed production, repair centers, or investment in Ukraine’s defense industry: cooperation with Ukraine brings Russian risk onto your territory, your facilities, and your personnel.
That is why even a failed act of sabotage can have strategic effect by increasing the costs of security, insurance, personnel vetting, counterintelligence, and executive protection.
Implications for Slovakia
For Bratislava, the case has a particularly important political dimension.
Slovakia is not among Moscow’s most hard-line European opponents. Yet the potential operation was prepared on Slovak territory.
If Russian sponsorship is confirmed, it would demonstrate that Moscow distinguishes between relations with a government and operational targets located on that state’s territory.
In other words, political caution toward Russia does not guarantee security if a country hosts an enterprise that Moscow regards as part of Ukraine’s military infrastructure.
The consequences could have been severe. According to police, around 70 people may have been present at the facility. This was therefore not a symbolic act of vandalism, but an operation whose perpetrators should have understood the possibility of casualties. (euronews) (euronewseuronewseuronews)
This should change Slovakia’s perception of the Russian hybrid threat. It can no longer be viewed solely through the prism of disinformation, cyberattacks, or political influence.
The potential threat has a physical dimension.
Assessment
The attempted arson attack on Skyeton most logically fits a broader trend in which Russian intelligence services are moving from intelligence and information operations toward kinetic actions below the threshold of open armed conflict.
The German experience demonstrates almost the full spectrum of such activity: recruitment of low-level agents, reconnaissance of military and industrial facilities, planning of explosions and arson attacks, attacks on freight logistics, and, according to Western intelligence, preparations to assassinate the head of Rheinmetall. NATO has already characterized these developments not as isolated criminal cases but as components of a wider sabotage campaign. (Reuters) (ReutersReutersReuters)
The Slovak episode potentially demonstrates the geographic expansion of this model to Ukrainian defense-production capacity relocated into Central Europe.
The most likely strategic objective of such a campaign is not the destruction of a single enterprise. Moscow may be seeking to create a persistent layer of risk around the entire system of European military support for Ukraine.
The logic is to make every subsequent artillery plant, drone facility, logistics center, or Ukrainian-European joint venture more expensive, more difficult, and more dangerous to operate.
The main conclusion from the Skyeton case is therefore not simply that Russia may have tried to set fire to another factory.
More important is the broader implication: if Russian attribution is confirmed, it would provide additional evidence that Moscow increasingly views Europe’s defense-industrial complex as an extension of the Ukrainian theater of war, and its enterprises, logistics networks, and executives as permissible targets for covert coercive operations.
For Slovakia and other Allies, the response should go beyond strengthening security at individual factories and move toward a model of collective counter-sabotage security: systematic intelligence sharing, vetting of personnel and contractors, monitoring of suspicious reconnaissance around facilities, protection of senior managers and engineers, tracking recruitment channels for low-level agents, and integrating private defense companies into national counter-hybrid security planning. One further line of inquiry could substantially strengthen this analysis: building a 2023–2026 chronology of all confirmed and suspected Russian sabotage operations against Europe’s defense industry and military logistics — in Germany, Poland, Lithuania, the United Kingdom, Czechia, and Slovakia — and separately identifying where GRU involvement and the disposable-agent model can be traced. This would help determine whether Skyeton is part of a single operational campaign rather than merely a similar incident.
