Western security officials have issued a stark warning that Russia is waging a deliberate campaign of sabotage across Europe, designed to exhaust the continent's investigative resources and weaken its resolve in supporting Ukraine. An investigation by The Associated Press has documented 145 separate incidents linked to this covert operation since President Vladimir Putin's full-scale invasion began in 2022.
A Campaign of Disruption and Drain
The strategy, officials say, is not necessarily to inflict catastrophic damage but to create a constant, draining burden on European security services. From acts of vandalism and cyberattacks to warehouse fires and railway sabotage, each event forces a complex, cross-border investigation. The head of a major European intelligence service revealed that probes into Russian interference now consume as much agency time as counter-terrorism work. For Moscow, this represents a high-impact, low-cost victory, tying up Western resources even when plots are foiled.
"It's a 24/7 operation between all the services to stop it," a senior European intelligence official told AP, speaking on condition of anonymity due to the sensitivity of the matter. The official emphasised that while the campaign burdens Europe, it costs Russia very little, often using cheap proxies instead of risking its own intelligence operatives.
Incidents Spike and Tactics Evolve
AP's database shows a significant escalation in the campaign's boldness. Incidents involving arson and explosives jumped from just one in 2023 to 26 in 2024, with six already recorded in 2025. The countries most frequently targeted are those bordering Russia or key supporters of Kyiv, including Poland, Estonia, Latvia, the UK, Germany, and France.
A telling example occurred in November in eastern Poland, where a broken overhead line halted a passenger train carrying nearly 500 people, and explosives detonated under a freight train on the same line. Poland blamed Russia's intelligence services and responded by deploying 10,000 troops to protect critical infrastructure.
Officials noted the campaign appeared to slow in late 2024 and early 2025, likely as Moscow sought to curry favour with the new administration of U.S. President Donald Trump. However, it has since resumed at full pace. "They are back to business," the European official stated.
The Criminal Proxy Network
A key facet of Russia's method is its reliance on recruiters and perpetrators with criminal backgrounds, avoiding the use of its own easily identifiable spies. The man accused of orchestrating the Polish railway attack, for instance, is Yevgeny Ivanov, a Ukrainian convicted in absentia of working with Russian military intelligence (GRU).
"Outsourcing to people with criminal backgrounds means Russia doesn't have to risk highly trained intelligence operatives," explained a Baltic intelligence official. These individuals are sometimes recruited directly from European prisons or soon after release. In one case, the Museum of the Occupation of Latvia was set ablaze by a person released from prison just a month prior.
This method creates investigatory nightmares, as perpetrators often cross multiple borders. For two arson attacks in Estonia in January, the hired individuals had never even visited the country before. After setting a Ukrainian restaurant alight, one perpetrator fled through Latvia, Lithuania, and Poland before being captured in Italy.
Triinu Olev-Aas, Estonia's State Prosecutor, confirmed the shift from local actors to unknown foreigners, necessitating vastly increased international cooperation to track and detain suspects.
Strained Resources Foster Unprecedented Cooperation
While the sheer volume of plots is stretching some European law enforcement agencies thin, it has also spurred unprecedented levels of collaboration. Prosecutors in Latvia, Lithuania, and Estonia have established joint investigation teams specifically for attacks orchestrated by foreign intelligence services.
In the UK, frontline police officers are now receiving training to identify suspicious incidents that may be state-backed. Commander Dominic Murphy of the Metropolitan Police's counter-terrorism squad cited an example where a trainee detective linked a London warehouse arson to Russian intelligence after noting the business was Ukrainian-owned and held military communications gear.
Officials warn that Russia is continually testing new methods of hybrid attack. Smugglers in Belarus, a Russian ally, have repeatedly forced the shutdown of Lithuania's main airport by sending hundreds of weather balloons carrying cigarettes across the border. "Nowadays they only carry cigarettes," warned Jacek Dobrzyński, spokesperson for Poland's security minister, "but in future they could carry other things."
The Kremlin has denied any involvement. Putin's spokesman, Dmitry Peskov, told AP that Russia does not have "any connection" to the campaign. Despite the denials, Western officials remain clear that the shadow war is ongoing, demanding constant vigilance and shared resources across the continent.
