Russia wants to drain Europe’s investigative resources with its sabotage campaign, officials say

A train carrying about 500 people arrived in November a sudden halt in eastern Poland. A broken overhead line broke several windows and the track ahead was damaged. Elsewhere on the line, explosives detonated under a passing freight train.

In both cases, no one was injured and damage was limited, but Poland, which blamed the attack on Russia’s intelligence services, hit back hard: It deployed 10,000 troops to protect critical infrastructure.

Sabotage in Poland is one of 145 incidents in history Associated Press database Western officials say these attacks are part of a Europe-wide campaign of disruption led by Russia. Officials say the campaign since President Vladimir Putin invaded Ukraine in 2022 aims to: depriving Kiev of supportIt creates divisions among Europeans and identifies the continent’s security vulnerabilities.

So far on this subject hybrid warfareMost known acts of sabotage resulted in minimal damage; It’s nothing compared to the tens of thousands of casualties and cities destroyed. throughout Ukraine.

But officials say every action, from damaging monuments to cyberattacks to warehouse fires, drains valuable security resources. The head of one of Europe’s major intelligence agencies said investigations into Russian interference were now taking up as much of the agency’s time as terrorism.

Officials say the campaign has placed a heavy burden on European security services but has cost Russia almost nothing. This is because Moscow conducts cross-border operations that require extensive cooperation from European countries in investigations, while often using foreigners with criminal backgrounds as cheap proxies for Russian intelligence officers. This means that even if the conspiracies are not successful, Moscow achieves victory simply by tying up resources.

“It’s a 24/7 operation across all services to stop this,” said a senior European intelligence official, as the head of the European intelligence service and other officials who spoke to the AP insisted on anonymity to discuss sensitive security issues.

Throughout the year, the AP interviewed more than 40 European and NATO officials from 13 countries to document the scope of this hybrid warfare; it was only included on its map, including events associated by Western officials with Russia, its proxies, or its ally Belarus.

Putin spokesman Dmitry Peskov told the AP that Russia had “no connection” with the campaign.

AP’s map tracks Russia’s sabotage and disruption

The AP’s database shows an increase in arson and explosives incidents, from one in 2023 to 26 in 2024. Six have been documented so far in 2025. Meanwhile, three cases of vandalism were recorded last year and one this year.

Because not all incidents are made public, data is incomplete and it can take months for authorities to contact Moscow. But the sudden rise matches what officials warned: The campaign is becoming increasingly dangerous.

According to the map, the most targeted countries on the Russian border are: Poland and Estonia. Various incidents also occurred in Latvia, England, Germany and France. They are all big supporters of Ukraine.

The campaign will calm down noticeably in late 2024 and early this year, the European official, a senior Baltic intelligence official and another intelligence official said. Their analysis showed that Moscow likely paused the campaign to curry favor with the new administration of US President Donald Trump. It has continued at full speed ever since.

“They are back to work,” the European official said.

Multi-country landscapes consume resources

The man authorities say was behind the attack polish railway According to court documents, the person transporting the supplies to Ukraine is Yevgeny Ivanov, a Ukrainian convicted of working with Russian military intelligence to plan arson attacks on Ukrainian home improvement stores, a cafe and a drone factory.

Ivanov, who left Poland after the attack there, was working for Yury Sizov, an officer in Russia’s GRU military intelligence agency, according to Ukrainian security services.

Polish Interior Minister Marcin Kierwiński said Ivanov was convicted in absentia in Ukraine but managed to enter Poland because Ukraine did not notify Polish authorities of his conviction. Ukraine’s security service said it was cooperating closely with its allies.

According to Estonian State Prosecutor Triinu Olev-Aas, conspiracies involving perpetrators from various countries or crossing borders are draining the investigative resources of many authorities across Europe. This is one of Moscow’s main goals.

Over the past year, the profile of attackers in Estonia has changed from local figures largely known to law enforcement to unknown foreigners, he said. This requires greater cooperation between countries to disrupt conspiracies or arrest perpetrators.

For two attacks in January — A fire broke out in a supermarket and a Ukrainian restaurant Olev-Aas said the people hired had never been to Estonia before.

A Moldovan man broke the window of the restaurant, threw a can of gasoline into it and set it on fire. In the video, it can be seen that his arm was burned while he was running away.

The man and his accomplice fled through Latvia, Lithuania and Poland before being captured in Italy.

Turning on criminals

Russian intelligence officers may be the planners of such operations, but they rely on recruiters who are often convicted or have criminal connections, assigning tasks to saboteurs in the field, the Baltic official said.

Outsourcing to people with criminal backgrounds like Ivanov means Russia does not have to put highly trained intelligence agents at risk – agents that Moscow often does not need to employ since European countries have expelled scores of spies as relations have deteriorated in recent years.

Russian criminal networks offer a ready alternative, the Baltic official said.

The European official said the man was accused of coordinating a plot. Explosives in packages on cargo planesFor example, he was recruited by Russian intelligence after being involved in arms and explosives smuggling. The man depends on him at leastother four plots.

Others were recruited from European prisons or immediately after their release, the Baltic official said.

In one case, the Latvian Occupation Museum, dedicated to the Soviet Union’s occupation of the country, was set on fire by someone released from prison last month.

More tension, more cooperation

Even foiled plots are a gain for Moscow because they test defenses and waste resources.

In 2024, a Ukrainian man working on orders from Russian military intelligence excavated a cache of buried items in a Lithuanian cemetery, including drone parts and corn cans filled with explosives.

Authorities believe the plan was to plant explosives on the drones. Jacek Dobrzyński, a spokesman for Poland’s security minister, said the plan was eventually foiled but significant resources were used to track down everyone involved.

The European official said the numerous plots had gone beyond the limits of some law enforcement agencies, but Moscow’s campaign had also encouraged greater cooperation.

Special prosecutor in Latvia, Mārtiņš Jansons, said that prosecutors in Latvia, Lithuania and Estonia have formed joint investigation teams for attacks carried out by foreign intelligence services.

In the UK, frontline police officers are trained to spot suspicious incidents that may be state-sponsored, the commander said. Dominic Murphy is the head of the Metropolitan Police Service’s counterterrorism unit.

He said a trainee detective reported an arson attack on a warehouse in London after realizing the business was Ukrainian-owned and contained communications devices used by the military. Police determined that the attack took place Organized by Russian intelligence.

But officials warn that Russia is constantly trying new methods.

Smugglers sent to Russia’s ally Belarus hundreds of air balloons They transported cigarettes to Lithuania and Poland and repeatedly forced the airport in the Lithuanian capital to close in what authorities called a hybrid attack.

“These days they only carry cigarettes,” Dobrzyński warned, “but in the future they may carry other things.”

___

Associated Press writers John Leicester in Paris, Claudia Ciobanu in Warsaw, Poland, and Volodymyr Yurchuk in Kiev, Ukraine, contributed.