Poland has deployed 10,000 soldiers to protect critical infrastructure, directly blaming Russian intelligence services for a campaign of sabotage that forms part of a wider, disruptive operation targeting nations across Europe.
A Campaign of Disruption and Division
This decisive military move follows a series of unsettling incidents on Polish soil. In November, a passenger train carrying nearly 500 people in eastern Poland was brought to a sudden, violent halt by a broken overhead line, shattering windows and damaging the track. In a separate attack, explosives were detonated beneath a passing freight train. While these acts resulted in no injuries and limited physical damage, the political and security impact was immediate and severe.
Western officials contend these events are not isolated. They form part of a database of 145 incidents compiled by the Associated Press, which are alleged to be components of a coordinated Russian campaign of hybrid warfare. Since President Vladimir Putin's full-scale invasion of Ukraine in 2022, this campaign has sought to undermine European support for Kyiv, foster societal divisions, and expose security vulnerabilities across the continent.
The Evolving Tactics of a 'Hybrid War'
While most acts have caused minimal physical damage compared to the devastation in Ukraine, they are draining vital security resources. A senior European intelligence official revealed that investigations into Russian interference now consume as much agency time as counter-terrorism operations. Crucially, officials state the campaign places a heavy burden on European services while costing Moscow next to nothing.
This is achieved through cross-border operations that force extensive international cooperation on investigations. Moscow frequently uses foreigners with criminal backgrounds as cheap proxies for its own intelligence operatives, a tactic that minimises risk and diplomatic fallout. "It's a 24/7 operation between all the services to stop it," a senior European intelligence official told AP.
The AP's data shows a significant escalation, with arson and explosives plots spiking from one in 2023 to 26 in 2024, with six documented so far in 2025. The countries most frequently targeted border Russia or are key Ukrainian allies: Poland, Estonia, Latvia, the UK, Germany, and France.
International Plots and Criminal Proxies
The mechanics of these plots are designed to maximise strain. Officials cite the case of Yevgeny Ivanov, a Ukrainian convicted in absentia of working with Russia's GRU military intelligence. Ivanov is alleged to be behind the attack on the Polish railway line used to supply Ukraine. He left Poland after the attack, and Polish officials stated they were not informed of his prior conviction by Ukraine.
Estonian State Prosecutor Triinu Olev-Aas explained that the profile of attackers has shifted from known locals to unknown foreigners, necessitating complex, multi-country manhunts. In one January attack on a Ukrainian restaurant in Estonia, a Moldovan man was hired, set the building alight, and then fled through Latvia, Lithuania, and Poland before being captured in Italy.
This outsourcing to individuals with criminal connections provides Russia with deniability and avoids risking its own trained agents, many of whom were expelled from Europe in recent years. In one case, the Museum of the Occupation of Latvia was set on fire by a person released from prison just one month prior.
The campaign's sheer volume is overstretching some law enforcement agencies, but it has also spurred unprecedented cooperation. Prosecutors in Latvia, Lithuania, and Estonia have created joint investigation teams for attacks organised by foreign intelligence services. In the UK, frontline police officers are being trained to spot state-backed incidents.
Commander Dominic Murphy, head of the Metropolitan Police's counter-terrorism squad, noted a trainee detective helped flag an arson attack on a London warehouse storing goods for Ukraine, which was later linked to Russian intelligence.
Officials warn that Russia is continually testing new methods. Recent incidents include hundreds of weather balloons carrying cigarettes, sent from Belarus into Lithuania and Poland, repeatedly shutting down an airport in what authorities called a hybrid attack. "Nowadays they only carry cigarettes," warned Jacek Dobrzyński, spokesperson for Poland's security minister, "but in future they could carry other things."
The Kremlin has denied any involvement. Putin's spokesman, Dmitry Peskov, told the AP that Russia does not have "any connection" with the alleged campaign.
