A series of sabotage incidents in Europe, linked to Russian intelligence, has raised alarms among Western officials. In November 2023, a train carrying nearly 500 passengers suddenly stopped in eastern Poland due to a damaged overhead line and subsequent explosions beneath a freight train. Although no injuries were reported, Poland attributed the attacks to Russia’s intelligence services and deployed 10,000 troops to safeguard critical infrastructure. This incident is part of a broader campaign of disruption involving at least 145 incidents across Europe since President Vladimir Putin launched the invasion of Ukraine in 2022.
According to data compiled by the Associated Press, these acts of sabotage aim to weaken support for Ukraine, sow discord among European nations, and expose vulnerabilities in the continent’s security framework. While the majority of these actions have resulted in limited damage, they are straining European security resources significantly. A senior official from a major European intelligence agency noted that investigations into Russian interference now occupy as much time as counterterrorism efforts.
The operational cost for Russia remains low, as these cross-border sabotage efforts compel European nations to collaborate extensively in investigations. Often, Moscow employs foreign nationals with criminal backgrounds as proxies for its intelligence operatives, allowing Russia to gain the upper hand by diverting resources from security agencies across Europe. “It’s a 24/7 operation between all the services to stop it,” remarked a senior European intelligence official who requested anonymity due to the sensitive nature of the topic.
Over the past year, the Associated Press has spoken with more than 40 officials from various European and NATO countries to detail the scope of this hybrid war, documenting incidents only when they were officially linked to Russia, its proxies, or its ally Belarus. In response to these claims, Dmitry Peskov, a spokesperson for Putin, stated that Russia has no connection to the campaign.
The AP database indicates a marked increase in arson and explosives-related plots, climbing from just one incident in 2023 to 26 in 2024, with six documented so far in 2025. In contrast, vandalism cases showed a decline, with three reported last year and only one this year. Although the data remains incomplete, it reflects officials’ warnings that the sabotage campaign is becoming increasingly perilous.
The nations most affected by these incidents are predominantly those bordering Russia, such as Poland and Estonia, with additional occurrences reported in Latvia, the United Kingdom, Germany, and France—countries that are instrumental in supporting Ukraine. Intelligence officials observed a noticeable lull in attacks during late 2024 and early 2025, likely aimed at improving relations with the newly inaugurated U.S. President. However, this pause has since ended, with operations resuming at full strength.
One of the individuals implicated in the Polish railway attack is Yevgeny Ivanov, a Ukrainian reportedly convicted of collaborating with Russian military intelligence to orchestrate arson attacks within Ukraine. After the Polish incident, Ivanov fled, having been employed by Yury Sizov, an officer in Russia’s GRU military intelligence. His entry into Poland was facilitated by a failure to communicate his conviction to Polish authorities, according to Marcin Kierwiński, Poland’s Interior Minister.
The complex nature of these sabotage plots, often involving perpetrators from multiple countries, further strains law enforcement resources across Europe. Triinu Olev-Aas, a state prosecutor in Estonia, observed a shift in the profile of attackers, with a rise in foreigners unfamiliar to local law enforcement. This necessitates enhanced cooperation among European nations to disrupt and apprehend potential saboteurs. For instance, two attacks in January 2025 involved hired individuals who had never previously visited Estonia, with one assailant setting fire to a Ukrainian restaurant after breaking a window.
While the involvement of Russian intelligence operatives is evident, they frequently delegate tasks to individuals with criminal records. The Baltic official explained that this strategy minimizes the risk to trained operatives, especially as many have been expelled from European nations in recent years. Criminal networks within Russia offer a convenient resource for these operations, allowing Moscow to execute its plans without exposing its own agents.
One notable case involved a man accused of coordinating a plot to place explosives in cargo plane packages, who had previous connections to smuggling operations. Others have been recruited from European prisons or shortly after their release, as evidenced by an arson attack on the Museum of the Occupation of Latvia carried out by an individual released from prison just a month earlier.
Both foiled and successful plots yield benefits for Moscow, as they test European defenses and waste valuable resources. An example from 2024 involved a Ukrainian man, following orders from Russian military intelligence, attempting to retrieve a cache of drone parts buried in a Lithuanian cemetery. Although the plot was thwarted, it required substantial resources to investigate the matter.
The escalating frequency of these sabotage activities is overwhelming European law enforcement agencies. However, it has also fostered greater collaboration among nations. Prosecutors in Latvia, Lithuania, and Estonia have established joint investigation teams to address attacks attributed to foreign intelligence services. In the UK, police officers are receiving training to identify suspicious incidents that may have state backing. For example, a trainee detective successfully flagged an arson incident at a Ukrainian-owned warehouse, which was later linked to Russian intelligence.
As Russian operatives continue to innovate their tactics, authorities are also facing new hybrid threats. Smugglers in Belarus have launched hundreds of weather balloons carrying cigarettes into Lithuania and Poland, causing flight disruptions in Vilnius. “Currently, they only carry cigarettes,” warned Jacek Dobrzyński, spokesperson for Poland’s security minister, “but in the future, they could transport more dangerous items.”
The ongoing sabotage campaign underscores the persistent challenges facing European security and the necessity for cooperative strategies to counter these threats effectively.
