In November, a train carrying almost 500 people came to\u00a0a sudden halt in eastern Poland. A broken overhead line had smashed several windows, and the track ahead was damaged. Elsewhere on the line, explosives detonated under a passing freight train.<\/p>\n
No one was hurt in either case and the damage was limited, but Poland, which blamed the attack on Russia\u2019s intelligence services, responded forcefully: It deployed 10,000 troops to protect critical infrastructure.<\/p>\n
The sabotage in Poland is one of 145 incidents in an\u00a0Associated Press database\u00a0that Western officials say are part of a campaign of disruption across Europe masterminded by Russia. Officials say the campaign \u2014 waged since President Vladimir Putin\u2019s invasion of Ukraine in 2022 \u2014 aims to\u00a0deprive Kyiv of support, create divisions among Europeans and identify the continent’s security weak spots.<\/p>\n
So far in this\u00a0hybrid war, most known acts of sabotage have resulted in minimal damage \u2014 nothing compared to the tens of thousands of lives lost and cities decimated\u00a0across Ukraine.<\/p>\n
But officials say each act \u2014 from vandalism of monuments to cyberattacks to warehouse fires \u2014 sucks up valuable security resources. The head of one large European intelligence service said investigations into Russian interference now swallow up as much of the agency\u2019s time as terrorism.<\/p>\n
While the campaign places a heavy burden on European security services, it costs Russia next to nothing, officials say. That\u2019s because Moscow is carrying out cross-border operations that\u00a0require European countries to cooperate extensively\u00a0on investigations \u2014 while often using foreigners with criminal backgrounds as cheap proxies for Russian intelligence operatives. That means Moscow notches up a win just by tying up resources \u2014 even when plots aren\u2019t successful.<\/p>\n
\u201cIt\u2019s a 24\/7 operation between all the services to stop it,\u201d said a senior European intelligence official, who like the head of the European intelligence service and other officials who spoke to AP insisted on anonymity to discuss sensitive security matters.<\/p>\n
Over the course of the year, AP spoke to more than 40 European and NATO officials from 13 countries to document the scope of this hybrid war, including incidents on its map only when linked by Western officials to Russia, its proxies or its ally Belarus.<\/p>\n
Putin’s spokesman Dmitry Peskov told AP that Russia doesn’t have \u201cany connection\u201d with the campaign.<\/p>\n
AP\u2019s map tracking Russian sabotage and disruption<\/p>\n
AP\u2019s database shows a spike in arson and explosives plots from one in 2023 to 26 in 2024. Six have been documented so far in 2025. Three vandalism cases were recorded last year, meanwhile, and one this year.<\/p>\n
The data is incomplete since not all incidents are made public, and it can take officials months to establish a link to Moscow. But the spike matches what officials have warned: The\u00a0campaign is growing more dangerous.<\/p>\n
The countries most frequently targeted, according to the map, border Russia: Poland and Estonia. Several incidents have also occurred in Latvia, the U.K., Germany and France. All are major supporters of Ukraine.<\/p>\n
The European official, a senior Baltic intelligence official and another intelligence official said the campaign noticeably calmed in late 2024 and early this year. Their analysis showed Moscow likely paused the campaign to curry favor with U.S. President Donald Trump’s new administration. It has since resumed at full pace.<\/p>\n
\u201cThey are back to business,\u201d the European official said.<\/p>\n
Multicountry plots drain resources<\/p>\n
The man officials say was behind the attack on\u00a0the Polish railway\u00a0that carries supplies to Ukraine is Yevgeny Ivanov \u2014 a Ukrainian convicted of working with Russian military intelligence to plot arson attacks at home improvement stores, a cafe and a drone factory in Ukraine, according to court documents.<\/p>\n
Ivanov, who left Poland after the attack there, worked for Yury Sizov, an officer from Russia’s GRU military intelligence service, according to Ukraine\u2019s security service.<\/p>\n
Ivanov was convicted in absentia in Ukraine but managed to enter Poland because Ukraine did not inform Polish officials of his conviction, Polish Interior Minister Marcin Kierwi\u0144ski said. Ukraine\u2019s security service said it closely cooperates with allies.<\/p>\n
Staging plots that involve perpetrators from several countries or who have crossed borders drains investigatory resources from multiple authorities across Europe \u2014 one of Moscow\u2019s key goals, according to Estonian State Prosecutor Triinu Olev-Aas.<\/p>\n
Over the last year, she said the profile of attackers in Estonia has changed from locals largely known to law enforcement to unknown foreigners. That requires increased cooperation among countries to disrupt plots or detain perpetrators.<\/p>\n
For two attacks in January \u2014\u00a0fires set at a supermarket and a Ukrainian restaurant\u00a0\u2014 the people hired had never been to Estonia before, Olev-Aas said.<\/p>\n
At the restaurant, a Moldovan man smashed a window, threw in a can of gasoline and set it alight. Video showed his arm on fire as he ran away.<\/p>\n
The man and his accomplice fled through Latvia, Lithuania and Poland before being caught in Italy.<\/p>\n
Turning to criminals<\/p>\n
While Russian intelligence officers might be the masterminds of such operations, they frequently rely on recruiters \u2014 often with convictions or criminal connections \u2014 who assign tasks to saboteurs on the ground, the Baltic official said.<\/p>\n
Outsourcing to people with criminal backgrounds, like Ivanov, means Russia doesn\u2019t have to risk highly trained intelligence operatives \u2014 agents Moscow often doesn\u2019t have recourse to anyway since European countries kicked out scores of spies as relations nosedived in recent years.<\/p>\n
Russian criminal networks offer a ready-made alternative, the Baltic official said.<\/p>\n
The European official said the man accused of coordinating a plot to put\u00a0explosives in packages on cargo planes, for example, was recruited by Russian intelligence after involvement with smuggling guns and explosives. The man is linked to\u00a0at leastfour other plots.<\/p>\n
Other people are recruited from European prisons or soon after they’re released, the Baltic official said.<\/p>\n
In one case, the Museum of the Occupation of Latvia, dedicated to the Soviet Union\u2019s occupation of the country, was set on fire by someone released from prison the previous month.<\/p>\n
Greater strain, greater cooperation<\/p>\n
Even plots that are foiled are a win for Moscow because they test defenses and waste resources.<\/p>\n
In 2024, a Ukrainian man, working on the orders of Russian military intelligence, dug up a cache of items buried in a cemetery in Lithuania, including drone parts and cans of corn filled with explosives.<\/p>\n
Officials believe the plan was to rig the drones with the explosives. The plot was eventually foiled \u2014 but not before considerable resources were used to track down everyone involved, said Jacek Dobrzy\u0144ski, the spokesperson for Poland\u2019s security minister.<\/p>\n
The sheer number of plots is overstretching some law enforcement agencies, but Moscow\u2019s campaign has also fostered greater cooperation, the European official said.<\/p>\n
Prosecutors in Latvia, Lithuania and Estonia have created joint investigation teams for attacks organized by foreign intelligence services, said M\u0101rti\u0146\u0161 Jansons, a special prosecutor in Latvia.<\/p>\n
In the U.K., front-line police officers are being trained to spot suspicious incidents that may be state-backed, said Cmdr. Dominic Murphy, head of the counterterrorism squad at the Metropolitan Police.<\/p>\n
He noted a trainee detective flagged an arson attack at a warehouse in London after realizing the business was owned by Ukrainians and contained communications devices used by the military. Police determined the attack was\u00a0organized by Russian intelligence.<\/p>\n
But officials warn Russia is continually testing new methods.<\/p>\n
Smugglers in Russia\u2019s ally Belarus have sent\u00a0hundreds of weather balloons\u00a0carrying cigarettes into Lithuania and Poland, repeatedly forcing the Lithuanian capital\u2019s airport to shut in what authorities called a hybrid attack.<\/p>\n
\u201cNowadays they only carry cigarettes,” Dobrzy\u0144ski warned, “but in future they could carry other things.”<\/p>\n
___<\/p>\n
Associated Press writers John Leicester in Paris, Claudia Ciobanu in Warsaw, Poland, and Volodymyr Yurchuk in Kyiv, Ukraine, contributed.<\/p>\n","protected":false},"excerpt":{"rendered":"
In November, a train carrying almost 500 people came to\u00a0a sudden halt in eastern Poland. A broken overhead<\/p>\n","protected":false},"author":6,"featured_media":2431,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[80,7,51],"tags":[],"class_list":["post-2430","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-europe","category-news","category-russia"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/blog.cedritech.com\/index.php?rest_route=\/wp\/v2\/posts\/2430","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.cedritech.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.cedritech.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.cedritech.com\/index.php?rest_route=\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.cedritech.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2430"}],"version-history":[{"count":1,"href":"https:\/\/blog.cedritech.com\/index.php?rest_route=\/wp\/v2\/posts\/2430\/revisions"}],"predecessor-version":[{"id":2432,"href":"https:\/\/blog.cedritech.com\/index.php?rest_route=\/wp\/v2\/posts\/2430\/revisions\/2432"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.cedritech.com\/index.php?rest_route=\/wp\/v2\/media\/2431"}],"wp:attachment":[{"href":"https:\/\/blog.cedritech.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2430"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.cedritech.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2430"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.cedritech.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2430"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}