Archived version

…

Dramatic cases involving Russian spies, like the group recently sentenced in Britain for plotting to kill investigative journalist Christo Grozev, or the occasional high-profile spy swap, often make headlines. But much of Russia’s intelligence work abroad is, by nature, less visible … [Russian spies and collaborators] attend public events, gather contacts, and quietly assess potential recruits. Many are not trained agents, but rather trusted intermediaries, opportunists, or individuals who have been pressured, paid, or manipulated into cooperating.

…

[In 2023, for example, at an event in] New York City … prominent journalists spoke about Russia’s slide into authoritarianism. Several attendees - ordinary Americans by their appearance and accent - interrupted the speakers at different intervals, shouting identical lines about the United States being no better than Russia and invoking Edward Snowden, the American whistleblower who fled to Russia and now also has a Russian passport. The hecklers were eventually escorted out, but it was clear they were acting on behalf of the Kremlin.

…

Since the full-scale invasion of Ukraine, Russia’s intelligence services - especially the GRU, its military intelligence agency - have carried out an increasingly aggressive campaign of sabotage and subversion across Europe. A February 2024 report from the Royal United Services Institute (RUSI) in the United Kingdom warned of a mounting threat from the GRU, stating that it was building a covert network of operatives to conduct espionage and sabotage missions across the continent. ‘The GRU is restructuring how it manages the recruitment and training of special forces troops,’ the report noted, ‘and is rebuilding the support apparatus to be able to infiltrate them into European countries.’ Experts and officials say the recent wave of sabotage incidents exemplifies Russia’s strategy of ‘hybrid warfare’, which blends psychological, economic, and political tactics with covert or conventional military force to destabilize its adversaries.

…

Recent attacks underscore this shift. In May 2024, a shopping center in Warsaw that housed around 1,400 shops and service points was almost completely burned down. Polish authorities later stated they had clear evidence linking the attack to Moscow … Other arson attacks have targeted a warehouse in England, a paint factory in Poland, homes in Latvia, and an Ikea store in Lithuania. While these incidents may seem random, European security officials say they are part of a coordinated Russian effort to disrupt arms transfers to Kyiv.

In many of these cases, Russia uses local recruits to carry out attacks.

…

Russia’s sabotage efforts extend to critical infrastructure across Europe, including transportation networks, railways, and energy systems. One specific tactic has involved sending incendiary devices disguised as commercial parcels via cargo services like DHL. These self-igniting packages are intended to catch fire during transit to targets in the EU and the U.K. Notably, such attacks have not occurred in countries seen as friendly to Moscow, such as Serbia and Hungary, raising the likelihood that they are being intentionally spared.

…

Inside Ukraine, Russia has recruited locals, including teenagers, to carry out acts of sabotage. Among them is a 15-year-old boy from Kharkiv, identified to the press as V., who faces years in prison for planting a homemade explosive device near the city’s police department.

…

Ukrainian investigators say Russia has recruited hundreds of minors for sabotage and terrorist acts since the full-scale invasion began, using platforms like TikTok, Telegram, and Discord to reach them. In response, Ukrainian authorities have launched a nationwide high school program to teach students how to avoid falling victim to such recruitment.

…

Since 2022, suspected sabotage of undersea infrastructure in the Baltic Sea has targeted telecom, power, and gas lines connecting countries like Sweden, Finland, Germany, Latvia, and Estonia. At least six such incidents have been reported, and 11 undersea cables have been severed since 2023. These attacks take advantage of the vulnerability of shallow waters in the Baltic and Gulf of Finland, where cables can be damaged with something as simple as a ship’s anchor. In one case, a vessel dragged its anchor for 100 kilometers, cutting multiple lines.

…

In addition to physical sabotage, Russia has intensified its cyber operations against Western companies supporting Ukraine. The state-linked hacking group known as Fancy Bear has expanded its focus to include logistics firms and technology companies involved in delivering aid, according to a cyber threat advisory released recently by the U.S. and ten allied countries. The advisory reports that a wide range of targets have come under attack, including defense contractors, transportation hubs, maritime companies, air traffic control systems, and IT service providers.

…

Russia’s use of low-level operatives and hard-to-trace tactics makes its network difficult to detect but still highly disruptive. Most of this activity happens out of public view, but it puts pressure on security agencies and highlights deeper weaknesses in the system. In response, Western governments are starting to look past isolated incidents to better understand and counter the larger strategy behind them.