Russia's GRU Unit 29155 Targets NATO Defense Industry in Sustained Sabotage Campaign
Source: X | @globalbrief_now
EXECUTIVE SUMMARY
The September 12, 2026, explosion at an EMCO ammunition depot in Bulgaria is the latest incident in a documented Russian military intelligence sabotage campaign targeting NATO defense industrial capacity and Ukraine-bound weapons supply chains. Attribution of prior EMCO blasts to GRU Unit 29155 combined with parallel sabotage operations across Europe establishes a state-directed covert offensive against the NATO defense industrial base that Western governments have not yet matched with coordinated protective measures.
ANALYSIS
Russia's Main Intelligence Directorate (GRU) Unit 29155 is a specialized covert action element responsible for foreign sabotage, assassination, and poisoning operations. Western intelligence services and investigative outlets including Bellingcat and The Insider documented Unit 29155 activity beginning with the 2018 Salisbury poisoning of Sergei Skripal in the United Kingdom. Since Russia's full-scale invasion of Ukraine in February 2022, Unit 29155 operations shifted toward sabotage of military logistics and defense production capacity in North Atlantic Treaty Organization (NATO) member states supporting Ukraine, rather than individual targeted assassination.
Bulgaria has been a repeated target within the campaign. Bulgarian prosecutors tied earlier EMCO blasts to Russian nationals connected to Unit 29155 and issued arrest warrants for six individuals. Bellingcat and The Insider identified a 2011 attack on Bulgarian defense infrastructure as the first Unit 29155 operation convincingly attributed in a NATO and European Union member state, suggesting more than a decade of Russian intelligence entrenchment in Bulgaria predating the 2022 invasion. EMCO produces 122mm and 152mm artillery shells for which Ukrainian forces have sustained high demand.
The Bulgarian operations fit a documented European pattern. In Germany, investigators attributed infrastructure sabotage operations to Russian-linked suspects in 2024 and 2025. Poland, Lithuania, Estonia, and the United Kingdom each reported suspected Russian sabotage targeting transportation and logistics infrastructure during the same period.
The back-to-back EMCO fires 33 days apart point to persistent operational access rather than a single opportunistic breach. Bulgarian authorities conducted an active investigation of the August 10 Belitsa blast when the September 12 Tsareva Livada fire occurred, indicating the saboteurs either pre-positioned assets before the first attack or maintained access despite the investigation. Both fires destroyed storage buildings through fire and explosion consistent with incendiary device placement, which requires physical entry to the facility. That points to either compromised personnel or physical security gaps that were not closed after the first incident. The targeting rationale connects directly to Ukraine's artillery situation. Following Russia's 2022 invasion, Ukrainian forces consumed Soviet-caliber artillery shells at rates that exhausted Eastern European legacy stockpiles; Western manufacturers like EMCO became the primary alternative supply source. Destroying EMCO storage capacity extends the resupply timeline by removing munitions already produced and ready for shipment. A sustained campaign against Bulgarian, Czech, Slovak, and Polish ammunition producers does not need to stop all supply to achieve effect; it only needs to introduce enough disruption to degrade the reliability of Ukrainian resupply planning.
NATO member state response to the GRU 29155 campaign has been fragmented. Individual countries have issued arrest warrants, made public attributions, and expelled Russian diplomats, but coordinated defensive measures for defense industry facilities have not been adopted as a binding standard. Physical security at ammunition depots across Eastern Europe varies considerably. A NATO-wide protective framework for defense industrial sites has been discussed but not implemented.
SOURCES
