An investigation reveals that Russian intelligence is recruiting marginalised individuals online to carry out a sabotage campaign across Europe.
A Guardian investigation highlights how Russia has launched a clandestine sabotage campaign across Europe, using marginalized individuals—often recruited online and paid in cryptocurrency—as disposable operatives to carry out arson, vandalism, and disinformation acts.
These foot soldiers, sometimes unaware of their true handlers, are directed remotely by Russian intelligence officials, particularly the GRU, without ever meeting in person. Incidents linked to this effort include arson attacks, vandalism of key figures’ property, and anti-Ukraine propaganda.
Many perpetrators are economically desperate migrants or gig workers found via Telegram, often manipulated into criminal activities under false pretences.
Cases like Serhiy, a Ukrainian refugee arrested in Poland en route to commit arson, highlight how easily individuals can be exploited. This new tactic reflects Moscow’s shift from traditional espionage—severely curtailed after mass diplomatic expulsions—to decentralised, harder-to-trace acts of sabotage.
Despite some operatives’ ideological support for Russia, most are driven by financial incentives or coercion. The campaign seeks to foster chaos, fear, and mistrust in European societies, posing legal and security challenges similar to counterterrorism efforts, with intelligence agencies warning of escalating threats as the war in Ukraine persists.
France has officially accused Russia’s GRU military intelligence agency of engaging in a covert cyberwar against it for over a decade. The French foreign ministry detailed a series of hostile actions dating back to 2015, including the hacking of President Macron’s 2017 election campaign, disinformation campaigns, attempts to sabotage broadcasters, interference in the 2024 Olympics, and cyberattacks on infrastructure and businesses.
The hacking group APT28, also known as Fancy Bear, was identified as a key player under GRU’s direction, aimed at espionage and societal destabilization. Minister Jean-Noël Barrot noted a rise in cyberattacks since 2021 targeting key sectors including defense and local authorities.
In response, France has fortified its cyber defences through the National Agency for Information System Security. Macron, particularly since the 2022 Russian invasion of Ukraine, has become a vocal critic of Russia’s disruptive actions, which allegedly aim to undermine European support for Ukraine.
The Kremlin has denied all accusations, while French opposition leaders have dismissed Macron’s claims as exaggerated. Nonetheless, France remains committed to countering cyberthreats and strengthening its digital security.
Spain has launched a judicial investigation into possible sabotage following a mass blackout on Monday that impacted large parts of Spain, Portugal, and southern France. The probe comes amid confusion and inconsistent explanations from authorities, ranging from cyberattacks to rare atmospheric events and net-zero energy complications.
Red Eléctrica de España, the national electricity board, reported a sequence of events on Monday that began with an unexplained loss of power generation at 12:33 p.m., followed by disturbances in the France-Spain power link moments later. National Court judge José Luis Calama is examining sabotage or cyber-terrorism as potential causes.
Suspicion has arisen of Russian involvement, given a recent pattern of disruptive actions across Europe attributed to Russia, including cyberattacks, arson, and sabotage. Coinciding mysterious UK grid activity is also under investigation, including anomalies at the Keadby 2 power plant and the Viking Link interconnector.
Though power has now largely been restored in Iberia, the blackout caused widespread disruption, shutting down airports, hospitals, and rail transport. European experts remain on high alert as they attempt to trace the precise cause of the continent’s largest recent power failure, with growing fears of coordinated foreign interference.
Exiled Russian oligarch Mikhail Khodorkovsky has alleged that Russia’s GRU military intelligence is compiling a “hit list” of Western politicians, journalists, and public figures critical of the Kremlin. According to Khodorkovsky, GRU agents are gathering personal information, including home and work addresses, to prepare for potential imminent attacks.
This alarming claim follows recent reports that Russian spies have been targeting European journalists, with British intelligence agencies warning about increasingly reckless Russian covert operations. MI6 head Richard Moore noted a campaign that includes arson and sabotage, citing incidents like firebombs placed on DHL cargo planes.
MI5’s Ken McCallum also reported that Russia employs criminal elements and far-right groups for such missions. Additionally, US and German intelligence revealed a foiled Russian plot to assassinate the CEO of arms manufacturer Rheinmetall. The warnings coincide with the sentencing of six Bulgarians convicted in the UK for spying on Kremlin critics, including attempts to seduce journalists like Christo Grozev.
Khodorkovsky, now based in London, emphasised that these intelligence actions typically precede violent operations, underscoring the serious and immediate nature of the threat.
The article highlights the increasing threat posed by covert Russian operations in Europe, notably Britain, following the full-scale invasion of Ukraine. It focuses on a forthcoming trial in London involving six men accused of destructive acts, including arson, linked to the Russian Wagner Group.
This and similar incidents illustrate a shift in Russian espionage tactics: outsourcing vandalism, sabotage, and propaganda to criminals or vulnerable individuals, creating widespread disruption for minimal cost and risk. A study by the Centre for Strategic and International Studies reveals a sharp rise in such attacks, often intended to disrupt support for Ukraine and stir social unrest.
Examples include staged environmentalist sabotage in Germany and sinister links to violent attacks possibly influenced by Russian operatives. The piece suggests Russia exploits the vulnerabilities in open Western societies and emphasises the urgent need for improved deterrence and security measures, as these destabilising acts could escalate amidst growing tensions with the Kremlin.
Western officials have accused Russia and its proxies of orchestrating numerous attacks and disruptions across Europe since the invasion of Ukraine three years ago. The Associated Press documented 59 incidents attributed to Russia or its allies, including cyberattacks, propaganda, arson, and sabotage.
High-profile cases involve potential mass casualties, like the plot to plant explosives on cargo planes, and targeting infrastructure in the Baltic Sea. Western officials, including NATO and European intelligence agencies, assert that these activities are intended to sow division, undermine support for Ukraine, and weaken European governments. Despite Russia’s denials, the evidence and increasing governmental attributions highlight a coordinated disruption campaign with significant security ramifications.
Poland charged a Belarusian, identified as Stepan K, with espionage and sabotage on behalf of Russia following an arson attack on a Warsaw hardware store last year, causing damages worth 3.5mn zlotys (€840,000). Stepan K faces 10 years to life imprisonment and is presently in custody while awaiting trial. The incident is part of a series of arson attacks in Poland and nearby regions, attributed to Russian influence.
Poland, in collaboration with Lithuania, formed a joint investigation team to mitigate such sabotage activities. Additionally, Poland closed the Russian consulate in Poznań due to espionage suspicions. Prime Minister Donald Tusk accused Russia of planning terrorist campaigns and cyber attacks, with Poland focusing on fortifying its borders to prevent further incidents.
Poland’s actions are part of broader tensions, with accusations against Belarus and Russia of orchestrating a “hybrid war” via migrant crises and historical support of Russian military actions. Additionally, Bosnia recently agreed to extradite a suspected Russian intelligence officer to Poland, marking significant steps in countering Russian sabotage in Europe.
German investigators believe that a wave of car vandalism across Germany, initially blamed on radical climate activists, is actually part of a Russian-orchestrated sabotage campaign, according to a Spiegel report published Wednesday. More than 270 vehicles were damaged in Berlin, Brandenburg, Bavaria and Baden-Württemberg.
Saboteurs sprayed construction foam into car exhaust pipes, rendering vehicles unusable, local police departments told Spiegel. To throw investigators off the scent, the vandals plastered cars with fake eco-stickers featuring Economy Minister Robert Habeck’s face and slogans like “be greener!” According to authorities, their goal was to stoke public outrage against Germany’s Green Party ahead of the national election on Feb. 23.
Since invading Ukraine in 2022, Russia has ramped up sabotage operations across Europe, targeting critical infrastructure like undersea cables and even plotting assassinations of defectors and European weapons-makers.
Western officials link these acts to Moscow’s hybrid warfare strategy, aiming to destabilise NATO countries, disrupt energy supplies and undermine support for Ukraine. In response, allies have intensified intelligence sharing to counter the growing threat
