European Officials Tell WSJ US Intelligence Concluded Putin Ordered Sabotage Campaign Against NATO

US intelligence agencies have concluded that Russian President Vladimir Putin personally ordered a stepped-up campaign of sabotage and covert action against NATO countries, according to the Wall Street Journal. The paper cites European officials briefed on the findings. Washington has not put that conclusion on the record itself.

The Journal says the campaign opened with a failed drone attack on Leipzig/Halle Airport, one of Europe's largest air-cargo hubs, on August 4.

What happened at Leipzig

The target was a Ukrainian Antonov An-124 freighter used to carry military aid. According to investigators cited by the Journal, at least three drones loaded with Semtex were hidden near the airport perimeter and controlled remotely through German mobile networks.

One drone hit the Antonov but did not explode. Accounts of the other two differ. One version has a second drone striking another aircraft and a third exploding near the perimeter fence. A source told Ukrainska Pravda that the third drone never got airborne and was found weeks later on the airport's outskirts.

Germany formally blamed Russia for the attempt on September 1. The Journal says German cyber officials traced the communications to servers previously used by Russian military intelligence, the GRU.

Western officials attribute the operation to the GRU's Special Tasks Service, formed in 2023. The Journal says they traced the plot to one of its department chiefs, who is already under EU and UK sanctions.

German investigators believe the ground operation was coordinated by Oleg Lyovushkin, a former Russian serviceman recruited by the GRU. He allegedly directed Belarusian operatives who smuggled explosives, assembled the drones and positioned them. He and an alleged Belarusian accomplice reportedly left Germany for Serbia, then Russia, two days before the attack. These are investigators' claims. No trial or verdict has been reported.

Serbia served as a transit hub for drones and explosives, the Journal reports. Serbian prosecutors have since arrested seven suspects, including one with dual Russian and Serbian citizenship.

The Article 5 question

Aides to German Chancellor Friedrich Merz told the Journal that had the attack caused heavy casualties, Berlin would have considered invoking Article 5 of the North Atlantic Treaty. The collective-defense clause has been invoked once, after the September 11 attacks in 2001.

Britain's MI5 chief, Sir Ken McCallum, addressed that threshold in his annual threat update last week. "Russia remains aggressor number one," he said. He added that Russian military and intelligence services "are once again escalating their attempts at hybrid warfare" while "being careful to stay below the NATO Article 5 threshold."

"It'd be foolish for them to cross" that line, McCallum said. He added that Russia uses tactics that stop short of conventional conflict, "though sometimes not much short."

Putin has not exactly denied the pattern. Asked by reporters whether Russia could attack facilities in the UK defense sector, he answered: "It's a secret. A military secret."

A wider pattern

The Journal says European officials have seen a sharp rise in so-called grey-zone attacks since August. They include arson against drone makers in Estonia and Poland and sabotage of Starlink stations in Poland, Lithuania and Bulgaria.

The OSINT tracker Malcontent News has logged 497 hybrid-warfare acts in Europe since Russia's full-scale invasion in 2022. It links 454 of them to Russian or Belarusian operations. Analyst Clément Molin estimates about 50 incidents since the start of September, at least 10 of them touching the defense industry or military logistics over the past two months.

Molin and Ukrainska Pravda say Russian services plan the operations but recruit civilians to carry them out, often through local criminal intermediaries paid in cryptocurrency.

Washington's mixed signals

The Italian outlet Il Politico Web points to a tension in the American position. It reports that Trump envoy Steve Witkoff is due in St. Petersburg to present Putin with peace proposals drafted in Oslo. It also says Trump has defended a diesel supply arrangement with Russia and said he asked Putin, as a personal favor, to release the detained American Stephen Hubbard.

The outlet argues the Journal's account sits awkwardly beside that diplomacy. It also notes that the Journal's sourcing runs through European officials, not American ones, and asks what Moscow would gain by provoking an alliance that already backs Ukraine after four years of war. Those are the outlet's arguments. The Journal's report does not address them.

Market analysts see a possible energy link. Investing Live notes that Russia's diesel deal with Washington and a pause in new US sanctions were aimed partly at keeping Moscow out of the Iran war. A rupture could tighten fuel markets already strained by attacks on shipping in the Strait of Hormuz. At least 18 vessels have been hit there in two weeks, according to ship-tracking data from Kpler cited by ANZ Research.

Germany had already named the GRU for Leipzig, so the new element is the claim that the order came from the top. No government has announced a new response to that claim. Whether Berlin, Brussels or Washington moves beyond existing sanctions will show how seriously they weigh it against the talks in St. Petersburg.