Since the outbreak of the so-called Russia’s ‘Special Operation’, Moscow has drastically increased sabotage operations on the European continent. Since the 2014 Crimean War, sabotage operations have been a trademark of the Glavnoje upravlenije General’nogo shtaba Vooruzhonnykh sil Rossiyskoy Federatsii (GRU), namely Russia’s foreign military intelligence agency of the General Staff of the Russian Armed Forces.
Yet, following the political and diplomatic isolation caused by the 2022 invasion of Ukraine, Moscow has resumed this tactic to foster a new strategy of influence in Europe, mainly designed to destabilise the continent and erode political-diplomatic-military cohesion between the European Union (EU) and North Atlantic Treaty Organisation (NATO) countries towards Ukraine.
In May 2024, the Italian Team for Security, Terroristic Issues & Managing Emergencies (ITSTIME) conducted an analysis of Russia’s sabotage campaign in Europe. Following the identification of a Telegram bot within the PMC Wagner Telegram’s ecosystem, between February and April 2024, the authors collected several sabotage operations (mainly arson attacks and train sabotage), many of which have been intercepted by the intelligence services of the countries targeted (Figure 1).
Overall, European intelligence agencies have long been investigating Moscow’s sabotage campaign against the continent. According to a senior European diplomat, Russia may be responsible for nearly 100 “suspicious incidents” in 2024. Since the beginning of the war in Ukraine, as noted by the Center for Strategic & International Studies, the number of operations attributable to the GRU has increased threefold between 2023 and 2024. To cite a few of these incidents, in July 2024, an incendiary device was planted on a plane to Britain. It then caught fire at a DHL warehouse in Birmingham (United Kingdom). In the same month, a package exploded in a DHL station in Leipzig (Germany). In November 2024, a Chinese ship cut two underwater cables in the Baltic Sea. Even though Russia denied wrongdoing, investigators believe that Moscow’s intelligence was behind the attack. In November 2024, GPS signals have been disrupted over three Finnish airports in Joensuu, Savonlinna, and Lappeenranta. Finally, Russia is deemed to be involved in a campaign to stuff around 270 car tailpipes with expanding foam in Berlin (Germany), before the 2025 national elections.
Through Open Source Intelligence (OSINT) research since May 2024, the authors have identified fifteen other sabotage attacks, including six intercepted by law enforcement and intelligence agencies. Overall, Russia’s operations have targeted nine countries on the European continent. The following map (Figure 2) illustrates a subtle geographical shift in Moscow’s sabotage operations. Firstly, those countries that provide military support to Ukraine remained the main target of Russian sabotage. Acts of disruption have thus intensified in Germany, Poland, France, and the UK. Secondly, Nordic-Baltic countries have become new targets of Russia’s campaign for geographical and political reasons. On the one hand, the Kremlin has increased pressure on Baltic countries to destabilise those bordering countries that have assumed a sharp stance against Moscow. On the other hand, Finland and Sweden have respectively joined NATO in April 2023 and March 2024, expanding the Alliance’s borders to the Russian frontier.
Except for those completed, following the Russian Operations against Europe Dataset, Moscow organised and financed several failed sabotage attempts as well. One of these attacks was plotted against the Geilenkirchen NATO air base (Germany). Moreover, in December 2024, a Colombian citizen was arrested because he tried to stage explosions at facilities “of particular importance that could threaten national security” in Romania.
Against the background of the Kremlin’s disinformation longa manus, Moscow’s acts of sabotage have thus risen both in terms of quantity and intensity. The research conducted by ITSTIME shows that Russian sabotage has almost doubled from May 2024 to May 2025 in relation to the February-April 2024 period, focusing on the main NATO countries that provide military support to Ukraine and/or are on the edge of the Russian Federation. According to open sources, since February 2024, twenty-five sabotages have reportedly occurred on the European continent.
Being part of Russia’s gibridnaya voyna (the Kremlin’s conception of hybrid warfare), this strategy has been waging since mid-2010 as a means to expand Moscow’s influence on the European continent. Considering the remarkable asymmetrical force relationship with NATO powers, as M. Galeotti explained, the Kremlin embarked on a “guerrilla geopolitics” as a strategy “to play at its strengths and opponents’ weaknesses” since what a country wants politically must be commensurate with what it can militarily and economically. In other words, if you cannot win the game, change the rules.
In an international system whose political and military balance is currently shifting, NATO countries should therefore take a more assertive and Realist-led approach to current international dynamics. A Realist approach driven by specific political objectives would allow NATO countries to develop a counter-strategy and be able to play ‘the Kremlin’s game’, characterised by a hybrid warfare modus operandi which ranges from disinformation to sabotage operations. In the international arena, the direct or indirect use of forms of terrorism or terrorist groups as proxies has become established as the main strategy shaping the way some governments wage war to increase interference and destabilise domestic and international politics. Keenly aware of their military disadvantage, several states have resorted to non-linear and non-kinetic means, shifting the confrontation to a more suitable battleground.