Russia is leading a secret, underworldly war, unconventional against Europe. A real in its own campaign of sabotages, acts of vandalism, espionage and hidden actions, Moscow’s goal is to undermine the stability of European governments, putting public support to Ukraine at risk by imposing social and economic costs for Europe and weakening the collective capacity of NATO and European Union to respond to the Russian aggression. This unconventional, hybrid war began to intensify in 2022 parallel to the Russian invasion of Ukraine. Although Russia has so far not managed to achieve its primary objective, the European capitals have struggled to respond to Russian sabotage operations and have found it difficult to agree on a unitary response, coordinate actions, develop effective deterrence measures and impose sufficient costs in the Kremlin. The most affected area is obviously that of the Baltic and Scandinavian countries. Although in more isolated cases, however, Moscow has also carried out hostile actions towards the great nations of NATO, from Germany to Great Britain to France, and also Italy.
The map of Russian attacks on Europe
Table of Contents
The International Institute for Strategic Studies (IISS) has created an Open Source database complete with suspicious and confirmed Russian sabotage operations against Europe. A map with the data that reveal how Russian sabotage has targeted European critical infrastructures, how decentralized and, despite the European security and intelligence officials have launched the alarm, both largely indifferent to the responses of NATO, EU and Member States to date. The Kremlin exploited the gaps of legal systems through its approach based on the “Gig Economy”, which allowed her to avoid attributions and responsibilities. Since 2022, the year in which hundreds of officials of its secret services have been expelled from European capitals, Moscow has been very effective in the online recruitment of third countries of third countries to evade European counterintelligence measures. Although the tactic has proven effective in terms of flow and volume, allowing large -scale operations, the main challenge for the Russian secret services was the quality of the proxy, often poorly trained or poorly equipped, which makes their activities subject to detection, interruption or bankruptcy.
The hybrid war
Russian military doctrine deeply integrates the sabotage of national critical infrastructures (CNI) in Gibridnaya Voyna (hybrid war). European critical infrastructures are particularly vulnerable to sabotage because they pay in poor condition following decades of deferred maintenance and lack of investments from national and private sector governments. Russia has targeted critical infrastructures to obtain a direct strategic advantage in its war in Ukraine and as part of its wider conflict with the West. Although some initiatives, such as the Maritime Operation born Baltic Sentry in the Baltic Sea, were in some way effective, the lack of budgets and resources has prevented the Atlantic alliance and the EU of adopting a lasting and concrete response. Furthermore, it is not clear, in the face of contrasting national security priorities, how busy European capitals are in dissuading Russia’s unconventional war against Europe.
Moscow’s actions and Kiev’s response
As part of the Moscow ambitions against Europe, sabotage operations and the subversion and uninformation campaign of the Kremlin, combined with the Vast Scala of Ukraine in 2022, are an integral part of its wider hybrid war aimed at weakening the West. A primary objective of the unconventional war of Russia is to reduce support for Ukraine by increasing costs for governments and industries, molesting populations and exploiting the vulnerability of European defenses. Ukraine is also actively involved in IT operations and with drones against oil infrastructures and Russian gas and the installations of the defense industry, exploiting the persistent vulnerabilities. These reprisal operations aim to impose costs, stop operations and influence the public will of both parties, characterizing a wider and wider context. Some NATO Member States evaluated Putin’s hybrid war as part of the long -term preparations for a potential military confrontation with NATO and believe that attention is paid to attacking physical and virtual objectives using espionage, subversion, ransomware and abuse of global IT supply chains. To this are added information operations that use disinformation, propaganda campaigns and the spread of Deepfake and conspiracy theories. These attack carriers intersect in methods and effects, integrating the ability of various sectors of the Russian army, secret services and non -state actors, including the Wagner group and crime.
The Russian objectives
Over the past ten years, the Kremlin has targeted sectors such as energy, transport, banks, financial market infrastructures, health, water, digital infrastructures and government structures, including military installations. More recently, Russian sabotage operations have expanded the radius of their goals and the severity of attacks. The number of attacks has almost quadrupled from 2023 to 2024. ISIS data show that the most frequent objectives are the structures connected to the war in Ukraine and the government structures. Russia targets bases, production plants and structures involved in the transport of military aid to Ukraine. This report is based on a detailed database assembled by the IISS, built at the work of Professor Bart Schuurman of the University of Leiden in the Netherlands and expanded thanks to the integration with the ACLED (Armed Conflict Location & Event Data) project and with the monitoring of accidents carried out by the Iiss itself. The result is the most complete open source database currently available on Russian sabotage operations in Europe and in peripheral areas and covers the entire spectrum of activities with physical effects: from the sabotage of submarine cables to the block of GPS in different areas and geographies.
2025, the advent of Trump and the EU actions
The Russian sabotage operations in Europe also continued in 2025, although ISS data suggest a break in these activities during the first half of the year. Although the reported attacks seem to have decreased between January and July, several factors could explain this apparent drop. First, some accidents that occurred at the beginning of 2025 are probably not yet confirmed by the local authorities, and the police and intelligence services often take time to collect evidence, thus creating a delay in data. Secondly, it is possible that the beginning of the second mandate of the US president Donald Trump has led the Kremlin to temporarily suspend operations, to avoid alienating a more conciliatory American administration. Finally, the response led by the United States to the 2024 DHL accident may have pushed the Kremlin to temporarily interrupt the operations and induced the Ris to contain them. In addition, European governments have started numerous initiatives this year. In March 2025, Estonia, Latvia, Lithuania and Poland retired from the Ottawa Convention which prohibits anti -human mines, citing a “fundamental deterioration of the security situation” in the Baltic region. On April 1, Finland also followed the example. This change probably reports a greater military readiness to the Kremlin, in an attempt to avoid a direct confrontation with NATO. In the maritime field, in 2025 Northseal was launched, a joint effort for safety in the North Sea, together with Baltic Sentry.
© RESERVED REPRODUCTION
