Executive Summary

• Research suggests Russia has conducted over 100 sabotage incidents in Europe since 2022, targeting defence and energy sectors to disrupt support for Ukraine.
• It is likely that the GRU, particularly Unit 29155 and the Department of Special Tasks (SSD), leads these operations, with possible involvement from FSB and SVR.
• It is highly likely that Russia’s goals are to weaken NATO cohesion, disrupt arms supplies, and create instability, with tactics including arson, cyberattacks, and assassinations.
• Future threats may include targeting new sectors like food supply and finance, with increased operations around key political events in 2025.

What’s happening?

Russia’s expanding sabotage operations

Since Russia’s full-scale invasion of Ukraine, acts of sabotage in Europe have surged – with Czech Foreign Minister attributing up to 100 suspicious incidents to Russia in the last three years.[1]

Incidents range from sabotage of critical infrastructure, targeted arson and bombing attacks against civilian cities, disruption of transportation and communication systems, electoral interference, and assassination attempts on defence executives.

With at least 44 suspected incidents reported in 2024, compared to 13 in 2023 and six in 2022, Russia has intensified its hybrid attacks both in scale and intensity following Western approval for Ukraine to use US and British long-range missiles in strikes within Russia (see Figure 1).[2] This geographical expansion reflects Russia’s intent to target key supporters of Ukraine.[3]

Owing to the difficulty in attribution, the data used for the below figures only includes incidents where Russia was publicly identified by the authorities or members of government as the likely perpetrators – whereas the figure “up to 100” in the Guardian article includes suspected but not officially attributed attacks.

Figure 1. Number of Russian Operations in Europe (since the Invasion of Ukraine in 2022)

Who’s behind it?

Western intelligence sources reported that Russia created a new cover unit in charge of its ‘shadow war’ across Europe, known as the Special Tasks Department (SSD). The SSD is based in the Russian military intelligence headquarters (known as the Aquarium), located in Moscow.

The unit was reportedly created in 2023 in direct response to Western military aid to Ukraine and has taken over key operations previously handled by the GRU Unit 29155.

The SSD has been tasked with three main objectives: organising assassinations and sabotage abroad, infiltrating Western companies and institutions, and recruiting foreign agents. The unit is reportedly led by Colonel General Andrey Averyanov and Lieutenant General Ivan Kasianenko, both seasoned figures in Russia’s intelligence and military operations.[4]

The FSB likely contributes through cyber operations and SVR through foreign intelligence collection.[5]

The SSD HQ building, also known as the Aquarium, in Moscow, Russia. Source: https://www.wsj.com/world/europe/russia-spy-covert-attacks-8199e376

How do they operate?

While Russia employs a range of actors to conduct its operations in Europe, it is increasingly relying on low-level proxy operatives. These are not Russian-trained spies, but often amateurs from petty criminal backgrounds, willing to do Russia’s bidding for a quick payout via platforms like telegram.[6]

These individuals are hard to trace back to the Kremlin, which increases the difficulty of attributing blame to Russia.[7] Russia-linked private military companies have also been implicated in covert operations abroad.

While Russia initially focused on disinformation and cyberattack operations, recent activities demonstrate a shift towards more physical/kinetic methods, including sabotage and political assassinations.

Operations have grown more severe over time, with the use of more disruptive tactics including (attempted) assassinations (see Figure 2). There has also been a geographical shift in the targeting, with Russia expanding its activities to additional countries in the European Union (EU).

While initial operations largely focused on Eastern European countries, particularly the Baltic states, Germany and France have become new priorities.

Download Article

Figure 2. Type of Russian Operations Against Europe

Objective and target selection

Russia’s hybrid activity, by deliberately operating covertly and below the threshold of traditional warfare, has complicated the West’s ability to recognise, attribute and define the conflict, thus affecting its ability to respond. These asymmetric tactics have allowed Russia to wage a war away from the Ukrainian frontline aimed at sowing doubts and division within NATO and destabilising Ukraine’s allies.[8]

These are calculated and low-cost efforts that are highly likely to be part of a deliberate and highly disruptive campaign to challenge the West’s unity and stability.

When looking at each incident’s apparent outcomes, these vary from disrupting daily life, inflicting economic damage, disrupting aid to Ukraine, or disrupting energy supply and critical communications infrastructure. However, two overarching objectives stand out: undermining European support for Ukraine and demonstrating the extent to which Russia is willing to go to achieve this.[9]

In the past year, Russia has extended its targets to increasingly include civil aviation, public spaces and transport infrastructure (see Figure 3). Similarly, every year has seen an extension westwards, with Germany and France emerging as priority targets in 2024 (see Figures 4 and 5).

Germany has been particularly targeted by Russia. Some Russian strategists may view Germany as a weak link in NATO, partially due to its reliance on Russian energy and the current internal political division.[10]

The recent geographical expansion of Russian operations also demonstrates Russia’s willingness to target most European countries. Russia is likely to continue moving away from Eastern European and Baltic countries and focus on Western European countries, mainly Germany, France, the UK and Poland, owing to the key role they play in supporting Ukraine with arms and logistics.

Figure 3. Specific Targets of Russian Operations Against Europe

Trend and seasonal patterns

When looking at the data regarding Russian operations across Europe in 2024, some trends were identified with regard to Russia’s selection of targets and increase in operations. Analysis of sabotage incidents suggests that Russia strategically times its operations around key NATO summits, major military aid announcements, and elections in European countries.

These attacks often peak ahead of critical decisions on Ukraine aid, aiming to instil uncertainty and weaken European support. In 2024, the operations spiked in the summer 2024, coinciding with NATO July 2024 summit.

There is also a notable seasonal pattern, with most cyber and kinetic attacks taking place during winter, targeting energy infrastructure when Europe is most vulnerable and disruption would have the greatest impact on the general population.

In 2024, Russia has undergone particular efforts to target key elections in EU countries in order to influence the opinion and support for Ukraine. Russia has conducted several influence campaigns supporting anti-establishment and anti-EU candidates in several elections including the June 2024 European Parliament election.

The Czech intelligence agency uncovered a Russian-organised network that attempted to influence the EU elections in various European countries including Germany, Belgium, Czechia and France, which have historically been largely pro-EU nations.[11]

From funding anti-EU candidates’ campaigns to investing in pro-Russian media, this trend seems to have continued in 2025 with Russian operations targeting Germany ahead of the national election in February. [12] This can be explained by the EU’s increased financial support for Ukraine in 2024, notably through the establishment of the Ukraine Facility, which committed up to €50 billion in support of Ukraine’s recovery from 2024 until 2027.[13]

Figure 4. Countries Targeted by Russian Operations per Year

Figure 5. Number of Russian Operations per Country per Year

Download Article

Significant incidents

Assassination Attempt

US and German intelligence services foiled a Russian plot to assassinate the chief executive (CEO) of Germany’s leading arms manufacturer, Rheinmetall’s Armin Papperger. The company plays a large role in providing armaments for Ukraine, and Papperger had announced plans to build a Panther tank factory in Ukraine, making him a key target.

US officials stated the plans were in ‘advanced stages’ and part of a series of Russian plans to assassinate defence industry executives across Europe.[14]

Election Interference

Romanian intelligence authorities uncovered Russia’s sophisticated social media campaign to bolster the candidacy of far-right, pro-Russian politician Calin Georgescu in the Nov 24 presidential election. While this led to the Constitutional Court’s annulment of the first round on grounds of Russian interference, this is an example of Russia’s strategy of undermining European elections and influencing opinion in the West.

Similar interference campaigns were reported in Georgia and Moldova during recent elections in 2024.[15]

Critical Cable Sabotage

Several undersea telecom and power cables have been severed in the Baltic Sea since 2023, with three incidents reported in Nov and Dec 24. Experts and politicians have blamed Russia as part of its hybrid war against Western countries supporting Ukraine.[16]

NATO launched the ‘Baltic Sentry’ mission to protect critical undersea cables from sabotage operations.[17] Since 2014, more than 160 Russian civilian vessels have engaged in espionage activities in the North Sea, lingering near key infrastructure, such as cables and pipelines.[18]

While the incidents have not been critical, it is likely intended to disrupt energy and communications and raise costs.

Explosion and Arson

Multiple fires and blasts at ammunition depots, defence companies, and logistics hubs have been traced back to Russian operatives in recent months. In July 24, explosions took place at DHL courier depots in the United Kingdom, Germany and Poland, that were reportedly part of a Russian test run to target US cargo flights.[19]

So what?

The increasing campaign of Russian operations in Europe demonstrates Russia’s intent to destabilise the West through hybrid/sub-threshold warfare tactics. The growing threat of Russian sabotage in Europe has significant implications for regional stability and security.

These operations disrupt critical supply chains, weaken defence cooperation, and instil a climate of fear in political and business circles.

The economic consequences are significant, as industries essential to military and energy infrastructure face repeated attacks. Russia also uses these attacks to shape public perception, spreading disinformation to undermine trust in governments and support for Ukraine.

Additionally, the campaign is testing Europe’s and NATO’s resilience and ability to respond. Despite growing awareness of the Russian operations in Europe, the hybrid nature of these operations makes them particularly difficult to counter.

Unlike conventional military aggression, sabotage operations often occur in legal and political grey zones, making direct responses challenging.

Russia’s use of proxies, false-flag operations, or cyber mechanisms for their operations complicates attribution, making it difficult to prove direct Kremlin involvement. European intelligence is likely struggling to identify and disrupt decentralised proxy networks, especially in less obvious sectors like food supply.

While awareness of the problem has significantly improved in recent months, there is a lack of analysis into Russia’s operations to better understand it, identify Europe and NATO’s vulnerabilities and allow the formulation of effective response to deny Russia’s interference.

To enhance deterrence and disrupt Russian sabotage efforts, Europe and NATO have to establish a real-time intelligence-sharing framework to improve the detection of Russia’s operations.

Similarly, Europe must invest in dedicated, specialised task forces which look into Russian methods and recruitment, and take more aggressive targeting of Russian proxies operating across the region.

Pro-Ukraine rallies across Europe on third-anniversary of the invasion, Source: https://kyivindependent.com/the-world-rallies-in-support-of-ukraine/

Outlook

Looking ahead, as European military aid grows, Russia is expected to escalate its sabotage operations across Europe. Russia will continue to use hybrid warfare tactics in order to maintain plausible deniability and continue causing disruption to Ukraine’s Western allies.

Russia is highly likely to continue its pivot toward high-impact, low-traceability attacks using proxy actors (e.g. cyber-attacks, financial warfare) rather than direct infrastructure sabotage.

Russia will continue to leverage regional and local criminal organisations to conduct its operations, using social media platforms such as Telegram to easily recruit operators. As recent trends indicate, Russia is likely to continue its diversification of targets beyond the typical energy and defence sectors.

In 2025, it is anticipated that Russia will increasingly target food supply chains, finance and telecommunications for maximum economic damage.

Russia could temporarily cut back on its sabotage operations as indicated by the recent decline in Europe, which is possibly linked to the prospect of increased cooperation between Russia and Donald Trump’s new administration.

However, Russia will likely further increase its hybrid war against Europe in the event that Europe is forced to step up its military aid to Ukraine. This would be particularly the case if the US reduces its aid to Ukraine and/or increases its cooperation with Russia.

In the coming months, Russia is liable to escalate its operations to discourage European countries from boosting their support for Ukraine. Any related announcements are likely to be followed by an increase in the targeting of involved countries.

If patterns hold, there will be increased risks of proxy attacks on European defence executives and supply chains in Q2-Q3 2025, likely timed around NATO’s summer 2025 summit.

While Europe has started ramping up its response and defensive efforts, the nature of Russia’s hybrid operations and adaptability means that it will continue proving a challenge to counter.

Download Article

[1] https://www.theguardian.com/world/2024/dec/04/up-to-100-suspicious-incidents-in-europe-can-be-attributed-to-russia-czech-minister-says

[2] https://www.theparliamentmagazine.eu/news/article/hybrid-threats-russias-shadow-war-escalates-across-europe

[3] Research: Europe increasingly targeted by Russian sabotage – Leiden University

[4] https://www.wsj.com/world/europe/russia-spy-covert-attacks-8199e376?_ga=2.248598343.1969133939.1739615131-1231151024.1739615131%D1%81

[5] Russia’s FSB malign activity: factsheet – GOV.UK

[6] https://www.politico.eu/article/germany-hit-by-suspected-russia-backed-sabotage-campaign/

[7] https://www.theparliamentmagazine.eu/news/article/hybrid-threats-russias-shadow-war-escalates-across-europe

[8] https://cepa.org/programs/democratic-resilience/countering-russias-shadow-war/

[9] https://www.universiteitleiden.nl/binaries/content/assets/governance-and-global-affairs/isga/infographic-russian-operations-against-europe.pdf

[10] https://www.firstpost.com/world/meet-ssd-russias-spy-unit-leading-bombing-assassination-bids-and-shadow-war-in-the-west-13863740.html

[11] https://denikn.cz/1388809/european-politicians-on-putins-payroll-russians-attempted-to-influence-european-elections-from-prague/

[12] https://www.politico.eu/article/germany-hit-by-suspected-russia-backed-sabotage-campaign/

[13] https://www.eeas.europa.eu/delegations/united-states-america/eu-assistance-ukraine-us-dollars_en

[14] https://www.politico.eu/article/nato-official-confirms-russian-plot-kill-european-weapons-chief-armin-papperger/

[15] https://carnegieendowment.org/europe/strategic-europe/2025/02/russian-interference-coming-soon-to-an-election-near-you?lang=en

[16] https://www.politico.eu/article/nato-warns-russia-could-target-undersea-pipelines-and-cables/

[17] https://www.bbc.com/news/articles/c4gx74d06ywo

[18] https://www.ftm.eu/articles/north-sea-1-suspicious-russian-ships-in-european-waters-and-havens

[19] https://www.reuters.com/world/europe/lithuania-says-russia-responsible-exploding-parcels-that-caused-fires-2024-11-05/