Sabotage Incidents Inside Russia Surge 88 Percent in 2026
Publicly documented sabotage operations inside Russian territory jumped by approximately 88 percent in the first ten months of 2026, surpassing the combined total of the previous two years. The surge highlights a dramatic escalation in domestic disruptions as Moscow simultaneously faces accusations of organizing arson attacks and covert operations across the continent.
The stark metrics emerge from an investigation published on November 7 by the OSINT community InformNapalm. Researchers tracking incidents through the group’s Fire OSINT database documented 242 separate sabotage operations between January 1 and November 6, 2026. For comparison, the database recorded a combined 239 incidents throughout the entirety of 2024 and 2025. Since the launch of Moscow’s full-scale invasion of Ukraine in February 2022, the cumulative total has reached 569 documented events.
These figures exclude Russian-occupied Ukrainian territories, alongside Ukrainian drone and missile strikes, which are cataloged separately. The recorded operations inside Russia focus heavily on infrastructure vulnerabilities, including arson attacks targeting railway signaling equipment, military recruitment offices, and telecommunications towers.
Domestic Resistance Networks Execute Sabotage Operations
InformNapalm emphasized that its database relies entirely on open-source reporting and does not definitively establish that Ukrainian intelligence services organized every single operation. While some attacks stem from coordinated state action, others are carried out independently by domestic underground resistance networks.
The domestic friction compounds logistical hurdles for the Kremlin’s military machine. On November 4, Ukrainian partisans from the ATESH movement reported executing a sabotage operation against a power substation supplying the Voronezh aircraft plant. The facility is a critical hub responsible for producing and repairing Il-76 military transport aircraft. According to the partisan group, the strike destroyed a transformer and severely disrupted electricity supplies to the plant.
This internal instability mirrors an aggressive campaign abroad. By September’s close, experts from GLOBSEC and the International Centre for Counter-Terrorism had tracked upwards of 180 Russian sabotage plots throughout Europe, covering successful, unsuccessful, and thwarted attempts alike. Multiple cases have been uncovered where the culprits recorded their arson strikes explicitly to feed Russian propaganda channels, pointing to a dual objective of physical destruction and psychological influence.
Cross-Border Networks and Arrests in Romania
The widening scope of these operations has triggered sharp crackdowns by European security services. During August of 2026, a facility belonging to Estonia’s Milrem Robotics—a builder of uncrewed ground vehicles provided to the Ukrainian armed forces—was targeted in an arson strike. On September 29, the internal security service of Estonia announced it had established that Russia commissioned the strike.
A parallel investigation in Romania uncovered a Russian-coordinated sabotage network following a September fire near the CARFIL defense manufacturing facility in Brașov. According to a report by the Romanian state agency AGERPRES, the Bucharest Court of Appeals ordered the arrest of Oemis Romagoza Durruthy on November 2 at the request of the anti-terrorism prosecution unit DIICOT.
Oemis Romagoza Durruthy, a 35-year-old Cuban resident in Russia, is accused of hiring a former Colombian military officer, Luis Alfonso Murillo Diosa, to target oil and natural gas infrastructure in Romania. Investigators established that Romagoza Durruthy financed the Colombian’s travel to Bucharest in July 2024 to photograph strategic sites, including two oil wells and a natural gas regulation station. The plan was dismantled by police intervention, with the support of the Romanian Intelligence Service, and Murillo Diosa was sentenced to six years in prison in September 2025.
The United States Department of Justice has identified Romagoza Durruthy as a coordinator of attacks for a network linked to Russian intelligence. He is currently being investigated by authorities in Latvia, Poland, and the Czech Republic for alleged sabotage. In September, Washington indicted five members of that same network—including another Cuban national, Yaidel Delgado Suárez—on charges of conspiracy to finance terrorism and commit contract killings. The Cuban Ministry of Foreign Affairs has denied institutional involvement, with Deputy Minister Josefina Vidal Ferreiro dismissing the allegations as a veiled accusation against Havana.
Russian Handlers Target Vulnerable Refugees for Hybrid Operations
As European nations tighten security around logistics hubs and defense plants, intelligence agencies have uncovered shifting recruitment tactics. Ukraine’s Foreign Intelligence Service (FIS) reported that Russian handlers have targeted refugees in vulnerable circumstances—including low-income individuals, persons from temporarily occupied territories, people with criminal connections, and teenagers seeking easy money—to carry out hybrid operations.
According to the FIS, using Ukrainian nationals grants Moscow a “plausible alibi” by establishing a toxic image for refugees. In many cases, operatives are pushed into executing crimes without realizing who they are ultimately working for, only to face immediate blackmail, arrest, and lengthy prison sentences once the task is complete.
