Western officials and AP data say Russia has used a network of cross-border sabotage operations since 2022 to strain European security, disrupt support for Ukraine and probe weak points. AP has linked 145 incidents — ranging from arson and explosives to cyberattacks and vandalism — to Russian-directed campaigns or proxies. While most events caused limited physical damage, they have consumed major investigative resources, prompted troop deployments such as Poland’s 10,000-strong response, and driven closer cooperation among European law enforcement and intelligence agencies.
Russia’s Cross-Border Sabotage Campaign Strains European Security, Officials Say
FILE - This 2024 handout photo provided by the Metropolitan Police shows damage to a warehouse in east London that was storing goods for Ukraine, after a fire that prosecutors said was organized on behalf of Russia's intelligence services. (London Metropolitan Police via AP, File)(ASSOCIATED PRESS)
Western officials say a coordinated campaign of sabotage and disruption linked to Russia has been stretching Europe’s security services since Moscow’s 2022 invasion of Ukraine. The Associated Press has catalogued 145 incidents that Western agencies associate with Russian intelligence, proxies or allied networks — from arson and vandalism to explosives, cyberattacks and other hybrid tactics.
Most attacks have caused limited physical damage, but they consume disproportionate investigative resources, force extensive cross-border cooperation and reveal vulnerable points in European infrastructure and law enforcement. Poland’s dramatic response to a November railway incident — deploying 10,000 troops to protect critical infrastructure after a passenger train carrying nearly 500 people was halted by a damaged overhead line and nearby explosives detonated — illustrates the disruptive effect.
FILE - In this 2024 handout photo provided by the Metropolitan Police, two people can be seen shortly before authorities say they set fire to a warehouse in east London. (London Metropolitan Police via AP, File)(ASSOCIATED PRESS)
Pattern And Purpose
Officials say the campaign aims to undermine support for Kyiv, sow political divisions, test defenses and identify weak spots in European security networks. AP’s mapping shows a sharp rise in arson and explosives incidents: one in 2023, 26 in 2024 and six recorded so far in 2025. The dataset is incomplete because some incidents remain undisclosed and investigators can take months to establish links to Moscow.
Countries bordering Russia — notably Poland and Estonia — appear most frequently on the list of targets, with additional incidents in Latvia, the U.K., Germany and France. Putin’s spokesman Dmitry Peskov denied any Russian connection to the campaign.
FILE - Polish Prime Minister Donald Tusk, second right, visits the sabotaged rail line near Mika, Poland, Nov. 17, 2025. (AP Photo/KPRM, File)(ASSOCIATED PRESS)
Modus Operandi: Cross-Border Plots And Criminal Proxies
Western officials describe a model in which Russian services orchestrate operations while relying on foreign operatives, criminal networks and recruits from prisons or marginalized communities to carry out attacks. That approach lowers the political and operational risk for Russian intelligence while forcing multiple national agencies to spend time and resources on lengthy, multinational investigations.
For example, Polish authorities identified a man they say was behind the railway attack as Yevgeny Ivanov, a Ukrainian convicted in absentia in Ukraine for collaborating with Russia’s GRU to plan arson attacks. Investigators say he worked under a GRU officer, and that failures in cross-border information-sharing allowed him to travel into Poland.
FILE - Polish Prime Minister Donald Tusk, right, visits the sabotaged rail line near Mika, Poland, Nov. 17, 2025. (AP Photo/KPRM, File)(ASSOCIATED PRESS)
Operational Impact And Response
Even thwarted plots have strategic value for the perpetrators: they test defenses and consume manpower. Agencies across Europe report investigations into suspected Russian interference now rival counterterrorism workloads in scale and urgency. At the same time, European prosecutors and police are deepening cooperation — forming joint investigation teams in the Baltics and expanding frontline training in the U.K. to spot possible state-backed incidents.
Authorities also warn that tactics evolve. Smugglers based in Belarus have repeatedly sent weather balloons carrying cigarettes into Lithuanian and Polish airspace, forcing airport closures — an action officials have called a hybrid attack and say could be repurposed for more dangerous payloads.
FILE - Russian President Vladimir Putin, left, leads a meeting with top security and defense officials at the Novo-Ogaryovo state residence outside of Moscow, Aug. 12, 2024. (Gavriil Grigorov, Sputnik, Kremlin Pool Photo via AP, File)(ASSOCIATED PRESS)
"It’s a 24/7 operation between all the services to stop it," a senior European intelligence official said, speaking on condition of anonymity because of the sensitivity of the issue.
The campaign’s asymmetric cost — low for the perpetrators but high for defenders — means that even low-casualty incidents can have outsized political and operational effects across Europe.
Associated Press reporting and interviews with more than 40 European and NATO officials informed this account. Officials added incidents to AP’s map only when they were linked to Russia or allied proxies by Western authorities.
