Estonia to Close Its Russian Border After a Plot to Burn a Drone Factory Blamed on the GRU

Estonia spent Sunday counting what did not happen. Somewhere just after three in the morning on Saturday, a group tried to break the windows of a drone factory in Viimsi, a wooded parish on the edge of Tallinn, pour flammable liquid through the gaps and light it. The building belonged to Threod Systems, which makes reconnaissance and attack drones and sells them to Ukraine. The company's own security team stopped them. Nobody was hurt. Nothing burned. By Sunday afternoon, Estonia had announced it would shut its border with Russia.

Estonia to Close Its Russian Border After a Plot to Burn a Drone Factory Blamed on the GRU

Tallinn, Estonia — The prime minister, the interior minister and the foreign minister each announced the closure on Sunday, and the Internal Security Service attributed the attack to Russian military intelligence.

Six Minutes Past Three in Viimsi

The Prosecutor General, Astrid Asi, put the time at 3.06 a.m. on Saturday 14 November. The attackers tried to break into Threod Systems' property, she told a press conference in Tallinn, with the aim of starting a fire and causing an explosion. Margo Palloson, the director general of the Internal Security Service, known as Kapo, described the method: the windows were to be smashed so that flammable liquids could be poured inside. "We assess that if this attack had succeeded in the way the attackers planned, it would have caused very significant damage to the company," Palloson said. What stopped it was not a patrol or a checkpoint but the firm's own guards, who intervened before the fuel could be lit. Asi credited them directly. No one was injured, the company suffered no significant damage, and Palloson said production and delivery capabilities were unaffected.

Eight Detained, and a Night of Raids in Latvia

Eight people were detained, all of them residents of neighbouring Latvia, by Kapo and the Police and Border Guard Board. The exact status of the eight is one of several details on which the published accounts do not agree. ERR, Estonia's public broadcaster, describes them as eight Latvian citizens; Hromadske reports that their citizenship had not been established; Latvian authorities, as carried by Estonian World, say four are Latvian citizens and four hold Latvian non-citizen status, and that several had previous criminal convictions. Asi said the Prosecutor's Office had applied to a court to remand five of the suspects in custody. Politico and the Helsinki Times report that five have been remanded; the Estonian government's own statement says only that the application was made. On one point the prosecutor was explicit: preliminary evidence indicated the suspects had been commissioned to carry out the attack and had travelled to Estonia for that purpose. They came from different backgrounds and different age groups, she said.

What Kapo Says It Knows

Latvia's State Security Service, the VDD, said intelligence received on its own soil about a sabotage being prepared in Estonia prompted a coordinated operation with Kapo. On 14 November the VDD carried out procedural actions at nine locations in Latvia connected to the arrested individuals, and seized explosive items, pyrotechnics, ammunition, a large number of mobile phones and other data carriers, according to the Latvian news agency LETA. Palloson said counter-intelligence had confirmed that Russia was behind the attempt and that it had been coordinated by the GRU, the Main Directorate of the General Staff of the Russian armed forces. "This was yet another attempt by Russia to carry out an act of sabotage in Estonia," he said. The case is being investigated as activity against Estonia's security on behalf of a foreign intelligence or security service. Kapo says it and its partners have identified and apprehended more than 20 people involved in kinetic attacks on behalf of Russian services since the full-scale invasion of Ukraine began.

The Factory Moscow Wanted Quiet

Threod Systems was founded in 2012 and builds unmanned aircraft and surveillance equipment, including its Eos drones and eOpic electro-optical units, from a site in Viimsi. The company says it has delivered products to 27 countries, among them 14 NATO member states and Ukraine. Breaking Defense reported in March that Threod had grown from roughly 50 employees to nearly 200, that its chief executive Arno Vaik described a 1,100 percent increase in sales over five years, and that the firm had supplied between 100 and 200 drones to Kyiv, where its Eos C airframe has been used for reconnaissance and for guiding artillery. Threod trains the operators itself and runs a training and service centre inside Ukraine. It has also been preparing serial production of a fourth-generation aircraft, the Eos D, which integrates laser target designation. Kapo has said repeatedly that drone manufacturers and organisations supporting Ukraine sit at the top of Moscow's target list.

The British Contract and the Carrier Deck

What makes the Viimsi factory a strategic target rather than a commercial one is where its hardware ends up. Threod's Cata launcher, a pneumatic system that throws one-way attack drones of 50 to 400 kilograms off a single platform at up to 55 metres per second, was selected by the UK Ministry of Defence for the British Army's one-way effector capability under the ASGARD programme. The company announced in March that a contract with a total value of £4,996,500 was being prepared after 2025 trials with the British Army. In October, the Cata B variant supported the Royal Navy's first strike drone launches from a British aircraft carrier, during trials aboard HMS Queen Elizabeth in the North Atlantic in which Callen-Lenz's British-built Nyan Maritime drones were flown alongside F-35B jets. An Estonian factory floor is a long way from the North Atlantic, but the same launcher connects the two.

Three Months to the Day: Milrem

This is the second time this year that an Estonian defence company has been targeted. In the early hours of 15 August, a building used by Milrem Robotics on Betooni Street in Tallinn's Lasnamäe district caught fire; the Rescue Board kept it in check, nobody was injured and the damage was initially unclear. Milrem supplies unmanned ground vehicles to Ukraine. Latvian citizens were detained in connection with that case, and in September Kapo formally attributed the arson to Russian security services, describing it as "a deliberate and pre-planned act commissioned by Russian security services" whose method matched other sabotage carried out across Europe on Russia's behalf. Fifteen August to fifteen November is 92 days — three calendar months to the day. The Estonian government's statement on Sunday notes that defence companies were warned and given hardening recommendations after Milrem, and that Threod followed them. "We do not warn about these threats without reason," the prime minister said.

How the GRU Builds a Sabotage Team

Palloson set out the recruitment model with unusual bluntness. One of the GRU's methods, he said, is to recruit residents of the European Union who can move freely across the Schengen Area to carry out physical attacks and sabotage. Recruits are drawn from criminal circles and from people in difficult economic and social circumstances. Kapo's own written assessment adds a further detail that matters for anyone tempted to treat the suspects as ideologues: individuals recruited for such operations "may be misled or manipulated and may be given false or fabricated justifications for their actions in an effort to conceal the involvement of the Russian state." That is a description of how a deniable operation is staffed — foreigners who can cross borders without a visa, misled or manipulated, and given false justifications for what they are doing. It is also why the searches in Latvia matter as much as the detentions in Estonia: the operation, whatever its size, was run across a Schengen frontier.

The Border Goes Down on 1 December

Estonia has three open road crossings with Russia — Narva, Luhamaa and Koidula — admitting pedestrians and freight, open twelve hours a day from seven in the morning. On Sunday the Interior Minister, Igor Taro, said he would propose that all of them close to pedestrians and vehicles from the beginning of December, and that Estonian citizens in Russia would have two weeks to come home. The Ministry of Foreign Affairs then stated the date flatly: "Estonia will close all Estonian-Russian border crossing points as of 1 December." The Foreign Minister, Margus Tsahkna, said the closure would cut Russia's ability to run hostile operations from Estonian soil and would help curb sanctions circumvention. Two things remain open. The government has yet to give the measure formal approval, and it has not decided whether the closure will be temporary or indefinite; Taro said ministers would settle that at the end of the coming week.

A Border That Was Already Shrinking

The Narva crossing is one of the last land routes into Russia still open to ordinary travellers in Europe, and it has been narrowing for years. On Saturday, the day of the attack, Estonia opened the Saatse "boot" bypass, a new road that finally ends the need for drivers to pass through a slice of Russian territory to reach the Setomaa villages. On the same day the prime minister said Estonia had "nothing to discuss with Russia on European security". Tsahkna has now told his counterparts in Latvia, Lithuania and Finland what is coming and briefed EU colleagues, and he will raise further pressure on Moscow at Monday's meeting of EU foreign ministers in Brussels — "tougher sanctions, a stricter visa policy, and additional measures". The sequencing is the message: a road that stops crossing Russia on Saturday, a border that closes on 1 December.

Moscow Has Not Answered

Russia had made no immediate comment on either the accusation or the closure by Sunday evening, and Moscow routinely denies involvement in sabotage operations across Europe. That silence is the honest limit of this story. What Estonia has published is an intelligence assessment by its internal security service, endorsed by its prime minister and foreign minister, supported by arrests and seizures in a second country — not a court finding. No suspect has been named, no charge has been read in open court, and the investigation into who organised the operation and who else may be connected is, in the prosecutor's words, only beginning. What is not in dispute is physical and documented: eight people were detained, a security team interrupted a group pouring fuel through broken windows at three in the morning, and a NATO member state has announced that the cost of answering will be paid at its eastern frontier.

What Comes Next

Kristen Michal has convened the government's Security Cabinet for Friday, to be briefed on the incident and on the wider sabotage threat, and to discuss further steps — which means the border decision is not the last one. Estonian prosecutors will argue over remand and then over evidence, with Latvian investigators working the other end. Kapo has warned that the threat will remain high for years, and that defence manufacturers across Europe, not just in the Baltics, are the target set. For readers outside the region the practical question is simpler than the geopolitics: if a drone factory outside Tallinn can be attacked with a can of fuel and a broken window, then every supplier feeding Ukraine's war effort is a building with a perimeter to defend. Estonia's answer was to defend it, and then to close a border.

By Jessica Ali, Staff Writer

This article was produced with AI-assisted research and editorial support. Sources: ERR News, the Estonian Government Communication Unit, the Estonian Ministry of Foreign Affairs, the Estonian Internal Security Service (Kapo), the Estonian Prosecutor's Office, Reuters, AFP, CNN, Politico Europe, Euronews, the Helsinki Times, Estonian World, BB.LV/LETA, Hromadske, Breaking Defense and Threod Systems. Photographs: ERR (Threod Systems factory in Viimsi); Estonian Ministry of Foreign Affairs (Estonian-Russian border crossing posts); Royal Navy/Michael Allen via Estonian World (Cata B launcher and Nyan Maritime drone, HMS Queen Elizabeth). Cover composite: Global 1 News.