Western Officials Warn: Russia’s Sabotage Campaign Aims to Overwhelm Europe
In November, a train carrying nearly 500 passengers abruptly halted in eastern Poland due to a broken overhead line that shattered several windows and damaged the track ahead. Meanwhile, explosives detonated beneath a passing freight train. Fortunately, no injuries were reported, and the damage was limited. However, Poland attributed the attack to Russian intelligence services and responded decisively by deploying 10,000 troops to safeguard critical infrastructure.
This incident is part of a larger pattern, with Poland experiencing one of 145 recorded acts of sabotage in an Associated Press database. Western officials assert that these acts are part of a Russian-led campaign aimed at disrupting Europe, undermining support for Kyiv, and exposing security vulnerabilities across the continent. This hybrid warfare has been ongoing since President Vladimir Putin’s invasion of Ukraine in 2022.
Read more: Poland Expects Russia to Escalate Sabotage After Rail Explosion
While the majority of these sabotage acts have resulted in minimal damage compared to the extensive loss of life and destruction in Ukraine, they still impose a significant burden on European security resources. A senior intelligence official noted that investigations into Russian interference now consume as much time as counter-terrorism efforts.
Interestingly, the cost to Russia for executing these operations is minimal. By conducting cross-border operations that necessitate extensive cooperation among European nations, Moscow effectively ties up valuable resources. Often, it employs individuals with criminal backgrounds as proxies for Russian intelligence operatives, allowing Russia to achieve its goals even when plots fail.
“It’s a 24/7 operation between all the services to stop it,” remarked a senior European intelligence official, who requested anonymity due to the sensitive nature of the discussions.
Throughout the year, the Associated Press interviewed over 40 European and NATO officials from 13 countries to map the extent of this hybrid warfare, documenting incidents only when linked to Russia, its proxies, or its ally Belarus.
Putin’s spokesperson, Dmitry Peskov, denied any connection between Russia and the campaign.
Spike in Arson and Explosives Plots
The AP database indicates a significant increase in arson and explosives-related plots, rising from just one in 2023 to 26 in 2024, with six documented so far in 2025. While three vandalism cases were recorded last year, only one has been noted this year.
This data remains incomplete, as not all incidents are disclosed, and establishing a link to Moscow can take months. However, the upward trend aligns with warnings from officials that the campaign is becoming increasingly perilous.
Countries bordering Russia, particularly Poland and Estonia, are the most frequently targeted. Additional incidents have occurred in Latvia, the U.K., Germany, and France, all of which are significant supporters of Ukraine.
According to intelligence officials, the campaign noticeably slowed in late 2024 and early 2025, likely as Moscow sought to improve relations with the new U.S. administration. However, it has since resumed at full force.
“They are back to business,” stated a European official.
Multicountry Plots Drain Resources
Yevgeny Ivanov, a Ukrainian convicted of collaborating with Russian military intelligence, is believed to be behind the attack on the Polish railway that transports supplies to Ukraine. Ivanov, who fled Poland after the incident, had previously worked for Yury Sizov, an officer from Russia’s GRU military intelligence service. His entry into Poland was facilitated by a lack of communication from Ukraine regarding his conviction.
Staging plots involving perpetrators from multiple countries drains investigatory resources across Europe, a key objective of Moscow’s strategy, according to Estonian State Prosecutor Triinu Olev-Aas. Over the past year, the profile of attackers in Estonia has shifted from known locals to unknown foreigners, necessitating increased cooperation among nations to thwart plots or apprehend suspects.
In January, two attacks involving fires at a supermarket and a Ukrainian restaurant were executed by individuals who had never been to Estonia before. One suspect, a Moldovan, set fire to the restaurant after smashing a window, fleeing with his arm ablaze.
Turning to Criminals
While Russian intelligence may orchestrate these operations, they often rely on recruiters with criminal backgrounds to assign tasks to ground-level saboteurs. This outsourcing minimizes the risk to highly trained intelligence operatives, especially as many have been expelled from European countries in recent years.
In one instance, a man accused of coordinating a plot to place explosives in cargo plane packages was recruited by Russian intelligence after his involvement in smuggling operations. He is linked to at least four other plots.
Some recruits come from European prisons or are approached shortly after their release, as seen in the case of an arson attack on the Museum of the Occupation of Latvia, which was set ablaze by someone released from prison just a month prior.
Greater Strain, Greater Cooperation
Even thwarted plots benefit Moscow by testing defenses and wasting resources. In 2024, a Ukrainian man, acting on orders from Russian military intelligence, unearthed a cache of drone parts and explosives buried in a Lithuanian cemetery. Although the plot was foiled, significant resources were expended in the investigation, according to Jacek Dobrzyński, spokesperson for Poland’s security minister.
The sheer volume of plots is straining law enforcement agencies, but it has also fostered enhanced cooperation among European nations. Prosecutors in Latvia, Lithuania, and Estonia have formed joint investigation teams to address attacks organized by foreign intelligence services, as noted by Mārtiņš Jansons, a special prosecutor in Latvia.
In the U.K., police officers are being trained to identify suspicious incidents that may be state-sponsored. Cmdr. Dominic Murphy, head of the counterterrorism squad at the Metropolitan Police, highlighted a recent arson attack at a warehouse owned by Ukrainians, which was linked to Russian intelligence.
However, officials caution that Russia continues to explore new methods. Smugglers in Belarus have launched hundreds of weather balloons carrying cigarettes into Lithuania and Poland, prompting repeated airport shutdowns in Lithuania, which authorities have labeled a hybrid attack.
“Currently, they only carry cigarettes,” Dobrzyński warned, “but in the future, they could carry other items.”
___
Associated Press writers John Leicester in Paris, Claudia Ciobanu in Warsaw, Poland, and Volodymyr Yurchuk in Kyiv, Ukraine, contributed.
Photograph: This 2024 handout photo provided by the Metropolitan Police shows damage to a warehouse in east London that was storing goods for Ukraine, after a fire that prosecutors said was organized on behalf of Russia’s intelligence services. (London Metropolitan Police via AP, File)
Related:
Copyright 2025 Associated Press. All rights reserved. This material may not be published, broadcast, rewritten or redistributed.
In November, a train carrying nearly 500 passengers abruptly halted in eastern Poland due to a broken overhead line that shattered several windows and damaged the track ahead. Meanwhile, explosives detonated beneath a passing freight train. Fortunately, no injuries were reported, and the damage was limited. However, Poland attributed the attack to Russian intelligence services and responded decisively by deploying 10,000 troops to safeguard critical infrastructure.
This incident is part of a larger pattern, with Poland experiencing one of 145 recorded acts of sabotage in an Associated Press database. Western officials assert that these acts are part of a Russian-led campaign aimed at disrupting Europe, undermining support for Kyiv, and exposing security vulnerabilities across the continent. This hybrid warfare has been ongoing since President Vladimir Putin’s invasion of Ukraine in 2022.
Read more: Poland Expects Russia to Escalate Sabotage After Rail Explosion
While the majority of these sabotage acts have resulted in minimal damage compared to the extensive loss of life and destruction in Ukraine, they still impose a significant burden on European security resources. A senior intelligence official noted that investigations into Russian interference now consume as much time as counter-terrorism efforts.
Interestingly, the cost to Russia for executing these operations is minimal. By conducting cross-border operations that necessitate extensive cooperation among European nations, Moscow effectively ties up valuable resources. Often, it employs individuals with criminal backgrounds as proxies for Russian intelligence operatives, allowing Russia to achieve its goals even when plots fail.
“It’s a 24/7 operation between all the services to stop it,” remarked a senior European intelligence official, who requested anonymity due to the sensitive nature of the discussions.
Throughout the year, the Associated Press interviewed over 40 European and NATO officials from 13 countries to map the extent of this hybrid warfare, documenting incidents only when linked to Russia, its proxies, or its ally Belarus.
Putin’s spokesperson, Dmitry Peskov, denied any connection between Russia and the campaign.
Spike in Arson and Explosives Plots
The AP database indicates a significant increase in arson and explosives-related plots, rising from just one in 2023 to 26 in 2024, with six documented so far in 2025. While three vandalism cases were recorded last year, only one has been noted this year.
This data remains incomplete, as not all incidents are disclosed, and establishing a link to Moscow can take months. However, the upward trend aligns with warnings from officials that the campaign is becoming increasingly perilous.
Countries bordering Russia, particularly Poland and Estonia, are the most frequently targeted. Additional incidents have occurred in Latvia, the U.K., Germany, and France, all of which are significant supporters of Ukraine.
According to intelligence officials, the campaign noticeably slowed in late 2024 and early 2025, likely as Moscow sought to improve relations with the new U.S. administration. However, it has since resumed at full force.
“They are back to business,” stated a European official.
Multicountry Plots Drain Resources
Yevgeny Ivanov, a Ukrainian convicted of collaborating with Russian military intelligence, is believed to be behind the attack on the Polish railway that transports supplies to Ukraine. Ivanov, who fled Poland after the incident, had previously worked for Yury Sizov, an officer from Russia’s GRU military intelligence service. His entry into Poland was facilitated by a lack of communication from Ukraine regarding his conviction.
Staging plots involving perpetrators from multiple countries drains investigatory resources across Europe, a key objective of Moscow’s strategy, according to Estonian State Prosecutor Triinu Olev-Aas. Over the past year, the profile of attackers in Estonia has shifted from known locals to unknown foreigners, necessitating increased cooperation among nations to thwart plots or apprehend suspects.
In January, two attacks involving fires at a supermarket and a Ukrainian restaurant were executed by individuals who had never been to Estonia before. One suspect, a Moldovan, set fire to the restaurant after smashing a window, fleeing with his arm ablaze.
Turning to Criminals
While Russian intelligence may orchestrate these operations, they often rely on recruiters with criminal backgrounds to assign tasks to ground-level saboteurs. This outsourcing minimizes the risk to highly trained intelligence operatives, especially as many have been expelled from European countries in recent years.
In one instance, a man accused of coordinating a plot to place explosives in cargo plane packages was recruited by Russian intelligence after his involvement in smuggling operations. He is linked to at least four other plots.
Some recruits come from European prisons or are approached shortly after their release, as seen in the case of an arson attack on the Museum of the Occupation of Latvia, which was set ablaze by someone released from prison just a month prior.
Greater Strain, Greater Cooperation
Even thwarted plots benefit Moscow by testing defenses and wasting resources. In 2024, a Ukrainian man, acting on orders from Russian military intelligence, unearthed a cache of drone parts and explosives buried in a Lithuanian cemetery. Although the plot was foiled, significant resources were expended in the investigation, according to Jacek Dobrzyński, spokesperson for Poland’s security minister.
The sheer volume of plots is straining law enforcement agencies, but it has also fostered enhanced cooperation among European nations. Prosecutors in Latvia, Lithuania, and Estonia have formed joint investigation teams to address attacks organized by foreign intelligence services, as noted by Mārtiņš Jansons, a special prosecutor in Latvia.
In the U.K., police officers are being trained to identify suspicious incidents that may be state-sponsored. Cmdr. Dominic Murphy, head of the counterterrorism squad at the Metropolitan Police, highlighted a recent arson attack at a warehouse owned by Ukrainians, which was linked to Russian intelligence.
However, officials caution that Russia continues to explore new methods. Smugglers in Belarus have launched hundreds of weather balloons carrying cigarettes into Lithuania and Poland, prompting repeated airport shutdowns in Lithuania, which authorities have labeled a hybrid attack.
“Currently, they only carry cigarettes,” Dobrzyński warned, “but in the future, they could carry other items.”
___
Associated Press writers John Leicester in Paris, Claudia Ciobanu in Warsaw, Poland, and Volodymyr Yurchuk in Kyiv, Ukraine, contributed.
Photograph: This 2024 handout photo provided by the Metropolitan Police shows damage to a warehouse in east London that was storing goods for Ukraine, after a fire that prosecutors said was organized on behalf of Russia’s intelligence services. (London Metropolitan Police via AP, File)
Related:
Copyright 2025 Associated Press. All rights reserved. This material may not be published, broadcast, rewritten or redistributed.
