Last month, a train carrying almost 500 people came to a sudden halt in eastern Poland. A broken overhead line had smashed several windows and the track ahead was damaged. Elsewhere on the line, explosives detonated under a passing freight train.
No one was hurt in either case and the damage was limited, but Poland, which blamed the attack on Russia’s intelligence services, responded forcefully: It deployed 10,000 troops to protect critical infrastructure.
The sabotage in Poland is one of 145 incidents in an Associated Press database that Western officials say are part of a campaign of disruption across Europe masterminded by Russia. Officials say the campaign — waged since Russian President Vladimir Putin’s invasion of Ukraine in 2022 — aims to deprive Kyiv of support, create divisions among Europeans and identify the continent’s security weak spots.
Illustration: Yusha
So far in this hybrid war, most known acts of sabotage have resulted in minimal damage — nothing compared with the tens of thousands of lives lost and cities decimated across Ukraine — but officials say each act, from vandalism of monuments to cyberattacks to warehouse fires, sucks up valuable security resources. The head of one large European intelligence service said that investigations into Russian interference now swallow up as much of the agency’s time as terrorism.
While the campaign places a heavy burden on European security services, it costs Russia next to nothing, officials say. That is because Moscow is carrying out cross-border operations that require European nations to cooperate extensively on investigations — while often using foreigners with criminal backgrounds as cheap proxies for Russian intelligence operatives. That means Moscow notches up a win just by tying up resources, even when the plots are not successful.
“It’s a 24/7 operation between all the services to stop it,” said a senior European intelligence official, who like the head of the European intelligence service and other officials insisted on anonymity to discuss sensitive security matters.
Over the course of the year, The Associated Press spoke to more than 40 European and NATO officials from 13 nations to document the scope of the hybrid war, including incidents on its map only when linked by Western officials to Russia, its proxies or its ally, Belarus.
Putin’s spokesman Dmitry Peskov said that Russia does not have “any connection” with the campaign.
The database shows a spike in arson and explosives plots from one in 2023 to 26 last year. Six have been documented so far this year. Three vandalism cases were recorded last year and one this year.
The data is incomplete since not all incidents are made public and it can take officials months to establish a link to Moscow, but the spike matches what officials have warned: The campaign is growing more dangerous.
The nations most frequently targeted, according to the map, border Russia: Poland and Estonia. Several incidents have also occurred in Latvia, the UK, Germany and France. All are major supporters of Ukraine.
The European official, a senior Baltic intelligence official and another intelligence official said that the campaign noticeably calmed late last year and early this year. Their analysis showed that Moscow likely paused the campaign to curry favor with US President Donald Trump’s new administration. It has since resumed at full pace.
“They are back to business,” the European official said.
The man officials say was behind the attack on the Polish railway that carries supplies to Ukraine is Yevgeny Ivanov — a Ukrainian convicted of working with Russian military intelligence to plot arson attacks at home improvement stores, a cafe and a drone factory in Ukraine, court documents show.
Ivanov, who left Poland after the attack there, worked for Yury Sizov, an officer from Russia’s GRU military intelligence service, Ukraine’s security service says.
Ivanov was convicted in absentia in Ukraine, but managed to enter Poland because Ukraine did not inform Polish officials of his conviction, Polish Minister of the Interior and dministration Marcin Kierwinski said.
Ukraine’s security service said that it closely cooperates with allies.
Staging plots that involve perpetrators from several nations or who have crossed borders drains investigatory resources from multiple authorities across Europe — one of Moscow’s key goals, Estonian State Prosecutor Triinu Olev-Aas said.
Over the past year, she said the profile of attackers in Estonia has changed from locals largely known to law enforcement to unknown foreigners. That requires increased cooperation among nations to disrupt plots or detain perpetrators.
For two attacks in January — fires set at a supermarket and a Ukrainian restaurant — the people hired had never been to Estonia before, Olev-Aas said.
At the restaurant, a Moldovan man smashed a window, threw in a can of gasoline and set it alight. Video showed his arm on fire as he ran away.
The man and his accomplice fled through Latvia, Lithuania and Poland before being caught in Italy.
While Russian intelligence officers might be the masterminds of such operations, they frequently rely on recruiters — often with convictions or criminal connections — who assign tasks to saboteurs on the ground, the Baltic official said.
Outsourcing to people with criminal backgrounds, such as Ivanov, means Russia does not have to risk highly trained intelligence operatives — agents Moscow often does not have recourse to anyway since European nations kicked out scores of spies as relations nosedived.
Russian criminal networks offer a ready-made alternative, the Baltic official said.
The European official said the man accused of coordinating a plot to put explosives in packages on cargo planes, for example, was recruited by Russian intelligence after involvement with smuggling guns and explosives. The man is linked to at least four other plots.
Other people are recruited from European prisons or soon after they are released, the Baltic official said.
In one case, the Museum of the Occupation of Latvia, dedicated to the Soviet Union’s occupation of the nation, was set on fire by someone released from prison the previous month.
Even plots that are foiled are a win for Moscow because they test defenses and waste resources.
Last year, a Ukrainian man, working on the orders of Russian military intelligence, dug up a cache of items buried in a cemetery in Lithuania, including drone parts and cans of corn filled with explosives.
Officials believe the plan was to rig the drones with the explosives. The plot was eventually foiled, but not before considerable resources were used to track down everyone involved, said Jacek Dobrzynski, the spokesperson for Poland’s minister of public security.
The sheer number of plots is overstretching some law enforcement agencies, but Moscow’s campaign has also fostered greater cooperation, the European official said.
Prosecutors in Latvia, Lithuania and Estonia have created joint investigation teams for attacks organized by foreign intelligence services, said Martins Jansons, a special prosecutor in Latvia.
In the UK, front-line police officers are being trained to spot suspicious incidents that might be state-backed, said Commander Dominic Murphy, head of the counterterrorism squad at the Metropolitan Police.
He said that a trainee detective flagged an arson attack at a warehouse in London after realizing the business was owned by Ukrainians and contained communications devices used by the military. Police determined the attack was organized by Russian intelligence.
However, officials warned that Russia is continually testing new methods.
Smugglers in Russia’s ally Belarus have sent hundreds of weather balloons carrying cigarettes into Lithuania and Poland, repeatedly forcing the Lithuanian capital’s airport to shut in what authorities called a hybrid attack.
“Nowadays they only carry cigarettes, but in future they could carry other things,” Dobrzynski said.
Associated Press writers John Leicester in Paris, Claudia Ciobanu in Warsaw and Volodymyr Yurchuk in Kyiv contributed.
In the US’ National Security Strategy (NSS) report released last month, US President Donald Trump offered his interpretation of the Monroe Doctrine. The “Trump Corollary,” presented on page 15, is a distinctly aggressive rebranding of the more than 200-year-old foreign policy position. Beyond reasserting the sovereignty of the western hemisphere against foreign intervention, the document centers on energy and strategic assets, and attempts to redraw the map of the geopolitical landscape more broadly. It is clear that Trump no longer sees the western hemisphere as a peaceful backyard, but rather as the frontier of a new Cold War. In particular,
As the Chinese People’s Liberation Army (PLA) races toward its 2027 modernization goals, most analysts fixate on ship counts, missile ranges and artificial intelligence. Those metrics matter — but they obscure a deeper vulnerability. The true future of the PLA, and by extension Taiwan’s security, might hinge less on hardware than on whether the Chinese Communist Party (CCP) can preserve ideological loyalty inside its own armed forces. Iran’s 1979 revolution demonstrated how even a technologically advanced military can collapse when the social environment surrounding it shifts. That lesson has renewed relevance as fresh unrest shakes Iran today — and it should
When it became clear that the world was entering a new era with a radical change in the US’ global stance in US President Donald Trump’s second term, many in Taiwan were concerned about what this meant for the nation’s defense against China. Instability and disruption are dangerous. Chaos introduces unknowns. There was a sense that the Chinese Nationalist Party (KMT) might have a point with its tendency not to trust the US. The world order is certainly changing, but concerns about the implications for Taiwan of this disruption left many blind to how the same forces might also weaken
On today’s page, Masahiro Matsumura, a professor of international politics and national security at St Andrew’s University in Osaka, questions the viability and advisability of the government’s proposed “T-Dome” missile defense system. Matsumura writes that Taiwan’s military budget would be better allocated elsewhere, and cautions against the temptation to allow politics to trump strategic sense. What he does not do is question whether Taiwan needs to increase its defense capabilities. “Given the accelerating pace of Beijing’s military buildup and political coercion ... [Taiwan] cannot afford inaction,” he writes. A rational, robust debate over the specifics, not the scale or the necessity,
RSS