Russia Sabotage: Europe Under Pressure | Western Intel

In November, a train carrying almost 500 people suddenly stopped in eastern Poland. A broken power line had shattered several windows and the road ahead was damaged. Elsewhere on the line, explosives detonated as a freight train passed by.

No one was injured in either case and damage was limited, but Poland, which blamed the attack on Russia’s intelligence services, responded forcefully, deploying 10,000 troops to protect critical infrastructure.

The sabotage in Poland is one of 145 incidents recorded in an Associated Press database that Western authorities say are part of a destabilization campaign across Europe orchestrated by Russia. Officials say the campaign, which began with President Vladimir Putin’s 2022 invasion of Ukraine, aims to deprive kyiv of support, create divisions among Europeans and identify security weaknesses on the continent.

So far in this hybrid war, most known acts of sabotage have resulted in minimal damage, nothing compared to the tens of thousands of lives lost and cities devastated across Ukraine.

But officials say each act, from vandalism of monuments to cyberattacks and warehouse fires, consumes valuable security resources. The head of a major European intelligence service said investigations into Russian interference now consume as much of the agency’s time as terrorism.

Although the campaign places a heavy burden on European security services, it costs Russia almost nothing, officials say. This is because Moscow is carrying out cross-border operations that require European countries to cooperate extensively in investigations, and often uses foreigners with criminal records as cheap intermediaries for Russian intelligence operatives. That means Moscow scores a victory simply by committing resources, even when the plots are unsuccessful.

“It’s an ongoing all-services operation to stop him,” said a senior European intelligence official, who, like the head of the European intelligence service and other officials who spoke to the AP, insisted on anonymity to discuss sensitive security matters.

Throughout the year, AP spoke to more than 40 European and NATO officials from 13 countries to document the scope of this hybrid war, including incidents on its map only when Western officials link them to Russia, its collaborators or its ally Belarus.

Putin spokesman Dmitry Peskov told the AP that Russia has “no connection” to the campaign.

The AP map documenting Russian sabotage and destabilization shows an increase in arson and explosives plots from one in 2023 to 26 in 2024. Six have been documented so far in 2025. Three cases of vandalism were recorded last year, and one this year.

The data is incomplete, as not all incidents are made public, and it can take months for officials to establish a link with Moscow. But the increase coincides with what officials have warned: The campaign is becoming more dangerous.

The most frequently attacked countries, according to the map, border Russia: Poland and Estonia. Several incidents have also occurred in Latvia, the United Kingdom, Germany and France. They are all great supporters of Ukraine.

The European official, a senior Baltic intelligence official and another intelligence official said the campaign calmed noticeably in late 2024 and early this year. Their analysis showed that Moscow likely paused the campaign to curry favor with the new administration of US President Donald Trump. Then they recovered their rhythm.

“They are back to work,” the European official said.

The man officials accuse of being behind the attack on the Polish railway transporting supplies to Ukraine is Yevgeny Ivanov, a Ukrainian convicted of working with Russian military intelligence to plan arson attacks on decoration stores, a cafe and a drone factory in Ukraine, according to court documents.

Ivanov, who left Poland after the attack there, worked for Yury Sizov, an agent of the Russian GRU military intelligence service, according to Ukraine’s security service.

Ivanov was convicted in absentia in Ukraine, but managed to enter Poland because Ukraine did not inform Polish authorities of his conviction, Polish Interior Minister Marcin Kierwiński said. Ukraine’s security service said it cooperates closely with allies.

Organizing plots involving perpetrators from multiple countries or who have crossed borders strains the investigative resources of multiple authorities across Europe, one of Moscow’s key objectives, according to Estonian State Prosecutor Triinu Olev-Aas.

Over the past year, he said the profile of attackers in Estonia has changed from locals mostly known to law enforcement to unknown foreigners. That requires greater cooperation between countries to disrupt plots or apprehend perpetrators.

In two attacks in January, arson attacks at a supermarket and a Ukrainian restaurant, the people hired had never been to Estonia before, Olev-Aas said.

At the restaurant, a Moldovan man broke a window, threw a gasoline can and set it on fire. Video showed his arm on fire as he fled.

The man and his accomplice fled through Latvia, Lithuania and Poland before being captured in Italy.

Although Russian intelligence agents could be the masterminds of such operations, they often turn to recruiters, often with criminal convictions or connections, who assign tasks to saboteurs on the ground, the Baltic official said.

Outsourcing people with criminal backgrounds, like Ivanov, means Russia does not have to risk highly trained intelligence operatives, agents Moscow often does not have access to anyway, as European countries expelled dozens of spies as relations deteriorated in recent years.

Russian criminal networks offer a ready-made alternative, the Baltic official said.

The European official said the man accused of coordinating a plot to package explosives on cargo planes, for example, was recruited by Russian intelligence after becoming involved in weapons and explosives smuggling. The man is linked to at least four other plots.

Other people are recruited from European prisons or shortly after being released, the Baltic official said.

In one case, the Latvian Occupation Museum, dedicated to the Soviet occupation of the country, was burned down by someone released from prison the previous month.

Even plots that are foiled are a victory for Moscow because they strain defenses and waste resources.

In 2024, a Ukrainian man working under Russian military intelligence unearthed a cache of objects buried in a cemetery in Lithuania, including drone parts and corn cans filled with explosives.

Officials believe the plan was to equip the drones with the explosives. The plot was eventually foiled, but not before considerable resources were used to track down everyone involved, said Jacek Dobrzyński, spokesman for Poland’s security minister.

The sheer number of plots is overburdening some security agencies, but Moscow’s campaign has also encouraged greater cooperation, the European official said.

Prosecutors in Latvia, Lithuania and Estonia have created joint investigation teams for attacks organized by foreign intelligence services, said Mārtiņš Jansons, a special prosecutor in Latvia.

In the United Kingdom, frontline police officers are being trained to detect suspicious incidents that may be instigated by a state, said Commander Dominic Murphy, head of the Metropolitan Police’s counterterrorism squad.

He noted that a trainee detective detected an arson attack on a warehouse in London after realizing the business was owned by Ukrainians and contained communications devices used by the military. Police determined that the attack was organized by Russian intelligence.

But officials warn that Russia is continually testing new methods.

Smugglers in Russia’s ally Belarus have sent hundreds of weather balloons carrying cigarettes to Lithuania and Poland, repeatedly forcing the Lithuanian capital’s airport to close in what authorities called a hybrid attack.

“Today they only carry cigarettes,” Dobrzyński warned, “but in the future they could carry other things.”

The journalists of Associated Press John Leicester in Paris, Claudia

This story was translated from English by an AP editor with the help of a generative artificial intelligence tool.