Europe Faces Hybrid Threats
European security agencies are grappling with a series of sabotage incidents that Western officials link to Russian intelligence. While most attacks have caused limited physical damage, the campaign is stretching security resources and raising concerns across the continent.
In November, a train carrying nearly 500 passengers in eastern Poland was forced to halt due to a broken overhead line, while explosives detonated under a freight train on the same route. No casualties were reported, but the incidents prompted Poland to deploy 10,000 troops to protect critical infrastructure.
Officials say these acts are part of a broader hybrid war strategy initiated after Russia’s 2022 invasion of Ukraine, aimed at disrupting support for Kyiv, testing European defenses, and exposing security vulnerabilities.
Minimal Damage, Maximum Disruption
Although the physical impact of these attacks is often minor compared to the devastation in Ukraine, each act—from vandalism and warehouse fires to cyberattacks—demands extensive investigation and coordination among European nations. One European intelligence head noted that countering Russian interference now consumes as much agency time as counterterrorism operations.
European officials also highlight that these operations cost Russia very little, as they often rely on foreign proxies with criminal backgrounds, rather than risking professional intelligence agents.
Cross-Border Plots
Many operations involve multiple countries, complicating investigations. In Poland, a Ukrainian national, Yevgeny Ivanov, allegedly carried out arson attacks on Russian orders before fleeing the country. He reportedly worked under GRU officer Yury Sizov.
Similar plots in Estonia involved foreigners with no prior connection to local authorities, requiring extensive cross-border cooperation. In one case, two attackers set fires at a supermarket and a Ukrainian restaurant, fleeing through multiple countries before being apprehended.
Outsourcing to Criminal Networks
European officials say Russian intelligence frequently recruits individuals with criminal histories, including recently released prisoners or those involved in smuggling and explosives. This approach reduces Moscow’s risk while keeping operations low-cost and flexible.
Examples include an attempted cargo plane sabotage linked to a man recruited from the European criminal network, and arson attacks on the Museum of the Occupation of Latvia, executed by a recently released inmate.
Tests of European Defenses
Even foiled plots are viewed as victories by Moscow, as they test defenses, consume resources, and highlight gaps. In Lithuania, a Ukrainian operative under Russian orders buried drone parts and explosives in a cemetery; the plan was ultimately thwarted after significant investigative effort.
Increasing European Cooperation
Despite the strain, these incidents have prompted greater collaboration across Europe. Joint investigation teams have been established in Latvia, Lithuania, and Estonia, while UK police officers are being trained to identify potential state-backed attacks.
Authorities warn that Russia continues to experiment with new methods. For instance, weather balloons carrying cigarettes from Belarus have repeatedly disrupted Lithuanian and Polish airports, hinting at the potential for more dangerous uses in the future.