Russia wants to drain Europe’s research resources with its sabotage campaign, officials said

In November, a train carrying about 500 people came to an abrupt halt in eastern Poland. A collapsed overhead line shattered several windows, and damaged the front track. Elsewhere on the line, explosives were detonated under a passing freight train.

In both cases no one was injured and damage was limited, but Poland, which blamed the attack on Russia’s intelligence services, responded forcefully: it deployed 10,000 troops to protect critical infrastructure.

The sabotage in Poland is one of 145 incidents in an Associated Press database that Western officials say are part of a campaign of disruption across Europe masterminded by Russia. Officials say the campaign – after President Vladimir Putin invades Ukraine in 2022 – is aimed at depriving Kiev of support, creating divisions among Europeans and identifying the continent’s security vulnerabilities.

So far in this hybrid war, the many known acts of sabotage have caused minimal damage — nothing compared to the thousands of lives lost and cities destroyed across Ukraine.

But officials say every act — from vandalizing monuments to cyber attacks to warehouse fires — eats up precious security resources. The head of a major European intelligence service said the investigation into Russian interference now swallowed up as much of the agency’s time as terrorism.

While the campaign will put a heavy burden on European security services, it will cost Russia nothing, officials say. That’s because Moscow is conducting cross-border operations that require European countries to cooperate extensively with investigations — while often using foreigners with criminal backgrounds as cheap proxies for Russian intelligence operatives. This means Moscow wins by simply tying up resources — even if the plots don’t succeed.

“It’s a 24/7 operation between all the services to stop it,” said a senior European intelligence official, who insisted that the head of the European intelligence service and other officials who spoke to the AP spoke on the condition of anonymity to discuss sensitive security matters.

Over the course of the year, the AP spoke with more than 40 European and NATO officials from 13 countries to document the scope of this hybrid war, including incidents that Western officials have linked to Russia, its proxies or its ally Belarus.

Putin’s spokesman, Dmitry Peskov, told the AP that Russia had “no connection” to the campaign.

AP’s map tracking Russian sabotage and disruption

AP’s database shows a spike in arson and explosive plots from one in 2023 to 26 in 2024. Six have been documented so far in 2025. Three cases of vandalism were recorded last year, meanwhile, and one this year.

The data is incomplete because not all cases have been made public, and it could take months for authorities to establish a link to Moscow. But the spike coincides with what officials have warned: The campaign is becoming more dangerous.

According to the map, the most frequently targeted countries border Russia: Poland and Estonia. Several cases have also occurred in Latvia, the UK, Germany and France. All are major supporters of Ukraine.

A European official, a senior Baltic intelligence official and another intelligence official said the campaign had quieted down in late 2024 and early this year. Their analysis showed that Moscow has stopped campaigning to support the new administration of US President Donald Trump. It has since resumed full speed.

“They are back in business,” the European official said.

Multinational plots drain resources

Ukrainian officials say Yevgeny Ivanov, who was convicted of working with Russian military intelligence to plan arson attacks at home improvement stores, cafes and a Ukrainian drone factory, was behind the attack on a Polish railway supplying Ukraine.

According to Ukraine’s security services, Ivanov, who fled Poland after the attack there, worked for Yuri Syzov, an officer of Russia’s GRU military intelligence service.

Ivanov was convicted in absentia in Ukraine but was able to enter Poland because Ukraine did not inform Polish authorities of his conviction, Polish Interior Minister Marcin Kirwinski said. Ukraine’s security services said they would cooperate closely with allies.

Staging plots involving criminals from multiple countries or people crossing borders drains investigative resources from many authorities across Europe, according to Estonian state prosecutor Trinu Olev-Aas.

Since last year, she said the profile of attackers in Estonia has largely changed from locals known to law enforcement to unknown foreigners. That requires increased cooperation between countries to stop plots or apprehend criminals.

The men hired for the two attacks in January — a supermarket and a fire at a Ukrainian restaurant — had never been to Estonia before, Olev-Aas said.

At the restaurant, a Moldovan man broke a window, threw in a can of gasoline and set it on fire. The video shows his arm on fire.

The man and his friend fled through Latvia, Lithuania and Poland before being caught in Italy.

towards the criminal

While Russian intelligence officials may mastermind such operations, they often rely on recruiters — often with trust or criminal connections — who assign jobs to saboteurs on the ground, the Baltic official said.

Outsourcing people with criminal backgrounds like Ivanov means Russia doesn’t have to risk highly trained intelligence operatives — agents Moscow doesn’t often resort to anyway because European countries have expelled so many spies in recent years due to sanctions.

Russian criminal networks offer a ready alternative, the Baltic official said.

The European official said the man accused of coordinating a plot to plant explosives in packages on cargo planes, for example, was recruited by Russian intelligence after being involved in smuggling guns and explosives. The man is connected to at least four other plots.

Other people are recruited from European prisons or as soon as they are released, the Baltic official said.

In one incident, Latvia’s Occupation Museum, dedicated to the country’s occupation by the Soviet Union, was set on fire by a man released from prison the previous month.

Great stress, great support

Even the failed plots are a win for Moscow as they test defenses and waste resources.

In 2024, a Ukrainian man, acting on orders from Russian military intelligence, unearths a cache of buried items in a cemetery in Lithuania, including drone parts and corn cans filled with explosives.

Officials believe the plan was to use explosives on drones. The plot was eventually foiled — but not before considerable resources were used to track down everyone involved, said Jacek Dobrzynski, a spokesman for Poland’s security minister.

The sheer number of plots is overwhelming some law enforcement agencies, but Moscow’s campaign has also fostered greater cooperation, the European official said.

Prosecutors from Latvia, Lithuania and Estonia have formed joint investigation teams into attacks organized by foreign intelligence services, Latvian special prosecutor Martinus Janssons said.

In the UK, front-line police officers are trained to detect suspicious incidents that may be state-backed, said Cmdr. Dominic Murphy, Head of the Counter Terrorism Squad at the Metropolitan Police.

He noted that a trainee spy flagged an arson attack on a London warehouse after the business was owned by Ukrainians and contained communications equipment used by the military. Police said the attack was carried out by Russian intelligence agencies.

But officials warned that Russia is constantly testing new methods.

Smugglers from Russia’s ally Belarus have sent hundreds of weather balloons carrying cigarettes to Lithuania and Poland, repeatedly forcing the closure of the Lithuanian capital’s airport in what authorities have called a hybrid attack.

“Nowadays they only carry cigarettes,” warns Dobrzynski, “but in the future they may carry other things.”

___

Associated Press writers John Leicester in Paris, Claudia Ciobanu in Warsaw, Poland and Volodymyr Yurchuk in Kiev, Ukraine contributed.