In November, a train carrying nearly 500 people suddenly stopped in eastern Poland. A broken overhead power line shattered several windows and front tracks were damaged. Elsewhere on the line, explosives detonated under a passing freight train.
There were no casualties in either incident and damage was limited, but Poland blamed the attack on Russian intelligence and responded forcefully: deploying 10,000 troops to protect critical infrastructure.
The sabotage in Poland was one of 145 incidents in an AP database that Western officials say are part of a Russian-orchestrated campaign of sabotage across Europe. Officials say the campaign, launched since Russian President Vladimir Putin invaded Ukraine in 2022, is aimed at stripping Kyiv of support, sowing divisions among Europeans and identifying security weaknesses on the continent.
Most known acts of sabotage so far in this hybrid war have caused minimal damage – nothing compared to the tens of thousands of lives lost and cities destroyed across Ukraine.
But officials say everything from vandalizing monuments to cyberattacks to warehouse fires drains valuable security resources. The head of a major European intelligence agency says investigations into Russian interference now take up as much of the agency’s time as terrorism.
Officials say that while the operation has placed a heavy burden on European security services, it has cost Russia almost nothing. That’s because Moscow is conducting cross-border operations that require extensive cooperation from European countries in investigations, while often using foreigners with criminal backgrounds as cheap proxies for Russian intelligence agents. This means Moscow can prevail simply by taking up resources—even if the plot fails.
“All services are taking 24/7 action to stop this behavior,” said a senior European intelligence official, who, like the European intelligence chief and others who spoke to The Associated Press, insisted on anonymity to discuss sensitive security issues.
Over the course of the year, the AP spoke with more than 40 European and NATO officials from 13 countries, documenting the scope of the hybrid war, including incidents that were only on Western officials’ maps when they linked it to Russia, its proxies or its ally Belarus.
Putin’s spokesman Dmitry Peskov told The Associated Press that Russia had “no links” to the campaign.
AP maps tracking Russian damage and destruction
The Associated Press database shows that arson and bombing plots surged from one in 2023 to 26 in 2024. Six cases have been recorded so far in 2025. Meanwhile, three cases of vandalism were recorded last year and one more this year.
The data is incomplete because not all incidents are made public and it can take months for officials to establish links to Moscow. But the surge is consistent with warnings from officials that the sport is becoming increasingly dangerous.
According to the map, the most frequently targeted countries border Russia: Poland and Estonia. Several incidents also occurred in Latvia, the United Kingdom, Germany and France. They are both major supporters of Ukraine.
The European official, a senior Baltic intelligence official and another intelligence official said the campaign calmed down significantly in late 2024 and early this year. Their analysis suggests Moscow may have suspended the campaign to curry favor with the new administration of U.S. President Donald Trump. It has since resumed at full speed.
“They are back to normal,” the European official said.
Many countries have exhausted their resources
Officials said the man behind the attack on a Polish railway carrying supplies to Ukraine was Yevgeny Ivanov, a Ukrainian convicted of working with Russian military intelligence in planning arson attacks on home goods stores, a cafe and a drone factory in Ukraine, court documents show.
According to Ukrainian security services, Ivanov left Poland after the attack to work for Yuri Sizov, a Russian GRU military intelligence official.
Polish Interior Minister Marcin Kierwinski said Ivanov was convicted in absentia in Ukraine but managed to enter Poland because Ukraine failed to notify Polish officials of his conviction. Ukraine’s security service says it works closely with its allies.
Estonian state prosecutor Triinu Olev-Aas said plots involving criminals from multiple countries or across borders would drain the investigative resources of multiple European authorities and was one of Moscow’s main goals.
Over the past year, she said, the image of Estonia’s attackers has changed from locals well-known to law enforcement to unknown foreigners. This requires increased cooperation between states to foil plots or detain perpetrators.
Olev-As said that in two attacks in January – a supermarket and a Ukrainian restaurant set on fire – people employed had never been to Estonia before.
In the restaurant, a Moldovan man smashed a window, threw a can of gasoline and set it on fire. Video shows his arm on fire as he ran away.
The man and his accomplices fled Latvia, Lithuania and Poland before being arrested in Italy.
Turn to criminals
The Baltic official said that while Russian intelligence officers may be the masterminds of such operations, they often rely on recruiters – often with convictions or criminal connections – who assign tasks to local saboteurs.
Outsourcing to someone with a criminal background like Ivanov means Russia doesn’t have to risk its highly trained intelligence personnel – Moscow often has no recourse to turn to any agents since European countries expelled dozens of spies in recent years as relations between the two countries soured.
Baltic officials say Russian criminal networks offer a ready alternative.
The European official said the man accused of plotting to load explosives onto cargo planes was recruited by Russian intelligence after being involved in smuggling guns and explosives. The man has been linked to at least four other plots.
Others were recruited from European prisons or shortly after their release, Baltic officials said.
In one case, the Latvian Occupation Museum, dedicated to the Soviet occupation of Latvia, was set on fire by people released from prison last month.
More pressure, more cooperation
Even if the plot is foiled, it would be a victory for Moscow, as they would test defenses and waste resources.
In 2024, a Ukrainian man, acting on orders from Russian military intelligence, dug up a cache of items buried in a Lithuanian cemetery that included drone parts and corn cans filled with explosives.
Officials believe the plan was to attach explosives to the drone. Jacek Dobrzyński, spokesman for Poland’s security minister, said the plot was ultimately foiled, but not before extensive resources were used to track down all those involved.
The European official said the number of plots has overwhelmed some law enforcement agencies, but Moscow’s actions have also fostered greater cooperation.
Latvian special prosecutor Matisse Jansons said prosecutors from Latvia, Lithuania and Estonia have set up a joint investigation team to investigate the attack organized by foreign intelligence agencies.
In the UK, frontline police are being trained to detect suspicious incidents that may be state-sponsored, the lieutenant colonel said. Dominic Murphy, head of the Metropolitan Police’s counter-terrorism team.
He noted that a trainee detective reported an arson attack after realizing that a London warehouse was owned by Ukrainians and contained communications equipment used by the military. Police determined the attack was organized by Russian intelligence services.
But officials warn that Russia is constantly testing new methods.
Smugglers from Russia’s ally Belarus have launched hundreds of cigarette-laden weather balloons into Lithuania and Poland, repeatedly forcing the closure of the Lithuanian capital’s airport in what authorities said was a hybrid attack.
“Right now they only carry cigarettes,” Dobzinski warned, “but in the future they can carry other things.”
___
Associated Press writers John Leicester in Paris, Claudia Ciobanu in Warsaw, Poland, and Volodymyr Yurchuk in Kiev, Ukraine, contributed.
