The Kremlin is waging a campaign of sabotage and subversion against Ukraine’s allies in the West.
What is Russia doing?
Since invading Ukraine in 2022, Russian President Vladimir Putin has sharply increased his hybrid war on the Western nations that support Kyiv. These hostile actions—which are too minor to justify a full-scale military response and are always denied by Russia— have included blowing up rail lines in Poland, setting fire to a warehouse in London, severing communication and power cables under the Baltic Sea, cyberattacks on critical infrastructure, the jamming of civilian flights, and the deployment of drone swarms in Western airspace. Over the past four years, European officials have blamed at least 145 acts of sabotage and disruption on Russia; that number doesn’t include Moscow’s many disinformation campaigns or its funding of farright parties in Europe. America has also been targeted: In 2024, intelligence agencies foiled a suspected Russian plot to plant incendiary devices on cargo and passenger planes flying from Europe to the U.S. and Canada. “The new front line,” said Blaise Metreweli, head of the U.K.’s MI6 intelligence agency, “is everywhere.”
Is this a new strategy?
The Soviet Union used what it called “active measures” during the Cold War: covert and deniable overseas operations that included assassinations, disinformation campaigns, and funding for friendly political movements. Putin, a former KGB agent, has embraced these tactics since taking power in 2000: Ukrainian politician Viktor Yushchenko was poisoned while challenging a pro-Kremlin presidential candidate in 2004, and in 2014 so-called little green men—masked Russian soldiers who Putin initially claimed were concerned locals—took control of the Ukrainian territory of Crimea. The start of the Ukraine war saw a dramatic escalation in hybrid operations: Sabotage and subversion attacks in Europe quadrupled from 2022 to 2023 and then tripled the following year. Russia’s military intelligence service, the GRU, was likely behind many of the attacks, some of which hit targets directly linked to military support for Kyiv. Others, such as the planting of incendiary devices in the bedding section of a Lithuanian Ikea in 2024, were aimed squarely at terrorizing civilians.
What is the goal?
Partly it’s to drain target countries’ intelligence and security resources. After an attack that may have cost only a few thousand dollars to arrange, “we in Europe follow up with an investigation that takes months,” said Bart Schuurman, a political violence researcher in the Netherlands. “Meanwhile, they’re long on to the next one.” Definitively proving Russian culpability can be difficult, because it has built a gig economy of saboteurs, recruiting young men online and paying them in hard-to-trace cryptocurrency (see box). Moscow has also used foreignregistered ships to damage undersea cables and pipelines by dragging their anchors across the seabed. The overarching objective of these operations is to sway public opinion against supporting Ukraine. “Such incidents are meant to spread uncertainty, fear, distrust,” said Paulina Piasecka, a Polish expert on hybrid threats. “People begin to wonder, ‘Look what’s happening all around us because we’re engaged in this war, which actually, maybe, isn’t—or shouldn’t be—our war.’”
Are the attacks getting worse?
In 2024, Russia began to attack bigger and higher-profile targets. That March, a warehouse in East London that stored Ukrainebound Starlink satellite terminals and other equipment went up in flames, causing $1.4 million in damage. Six British men were later convicted of national security and arson offenses; ringleader Dylan Earl, 21, had been recruited by the Russian mercenary outfit Wagner and was paid about $12,000 for the attack. In May, arsonists incinerated an 860,000-square-foot megamall in Warsaw; an investigation found the blaze was ordered by the GRU. That same month, there was a fire at a Berlin factory owned by a German arms firm; online investigations revealed Russian agents had researched fire protocols at the factory shortly before the blaze. “Russians are not as stupid as to leave that breadcrumb trail,” a European security source told The Telegraph (U.K.). “Sometimes they simply want us to find out they have flexed their muscles. It’s part of the hybrid warfare.”
Has Russia kept up the pace of operations?
Its campaign quietened in early 2025, as Putin sought to woo a newly inaugurated President Trump. But its offensive soon intensified. In September, a plane carrying European Union Commission leader Ursula von der Leyen had its GPS signals jammed as it approached an airport in Bulgaria. Throughout fall, swarms of suspected Russian drones appeared over European airports as well as military bases in France, Denmark, and Germany; up to four were shot down over Poland. And in November, two Russia-backed saboteurs used military-grade C4 explosives to blow up a stretch of rail line outside Warsaw, forcing a passenger train to screech to a halt. With each escalation, Moscow risks causing a high-casualty event that could trigger NATO’s Article 5 mutual-defense clause, which states that an attack on one member is an attack on all.
How is the West responding?
By beefing up its defenses. After September’s drone incursion, NATO said it would boost drone and air defenses on the alliance’s eastern flank. But a growing number of voices want Europe to fight fire with fire. A more “proactive response is needed,” said Latvian foreign minister Baiba Braze. “And it’s not talking that sends a signal— it’s doing.” Some defense experts have suggested cyberattacks on Russian drone factories and power plants; other EU officials have considered information campaigns aimed at ordinary Russians. Europe will likely have to respond alone: Trump pulled the U.S. out of the NATO-affiliated European Centre of Excellence for Countering Hybrid Threats in January. But doing nothing is not an option, Italian defense minister Guido Crosetto said in November. “We are under attack, and the hybrid bombs continue to fall. The time to act is now.”
