In November, a train carrying nearly 500 passengers came to a sudden stop in eastern Poland. A broken catenary shattered several windows and damaged the track in front of the train. On another section of the track, explosives were detonated under a passing freight train.
In both cases, no one was injured and material damage was limited, but Poland, which blamed the attack on Russian intelligence services, reacted decisively: it deployed 10.000 troops to protect key infrastructure.
The sabotage in Poland is one of 145 incidents recorded in an Associated Press database that Western officials say are part of a Russia-backed campaign of destabilization across Europe. The campaign, which they say has been ongoing since President Vladimir Putin's invasion of Ukraine in 2022, is aimed at depriving Kiev of support, deepening divisions among Europeans and identifying weaknesses in the continent's security system.
The AP states that, so far, most known sabotage actions in this hybrid war have had limited consequences - incomparable to the tens of thousands of lives lost and cities destroyed across Ukraine.
But officials say each act, from vandalizing monuments to cyberattacks to warehouse fires, drains precious security resources. The director of a major European intelligence agency said investigations into Russian meddling now take up almost as much of the agency's time as the fight against terrorism.
While the campaign is a huge burden on European security services, it costs Russia, officials say, almost nothing. The reason is that Moscow conducts cross-border operations that require intensive cooperation from European states in investigations - often using foreigners with criminal records as cheap intermediaries for Russian intelligence operatives. This means that Moscow benefits from the very fact that resources are tied up, even when the plans fail.
“This is a 24/7 operation involving all services to stop this,” said a senior European intelligence official, who, like the head of a major European intelligence agency and other officials who spoke to the AP, insisted on anonymity because of the sensitivity of the security issues.
Over the course of the year, the AP spoke with more than 40 European and NATO officials from 13 countries to document the extent of this hybrid war, including incidents on its map only when Western officials linked them to Russia, its proxies or its ally, Belarus.
Putin's spokesman Dmitry Peskov told the AP that Russia had "nothing to do" with the campaign.
AP map tracking Russian sabotage and destabilization
Data from the AP database shows a sharp increase in cases of arson and planned explosions, from one incident in 2023 to 26 in 2024. So far in 2025, six such cases have been documented. At the same time, three cases of vandalism were recorded last year and one this year.
The data is incomplete, as not all incidents are made public and it often takes months for officials to establish contact with Moscow. However, the increase is consistent with warnings from officials that the campaign is becoming increasingly dangerous.
The director of a major European intelligence agency said that investigations into Russian interference now take up almost as much of the agency's time as the fight against terrorism.
According to the map, the countries most frequently targeted are located along the Russian border: Poland and Estonia. Multiple incidents have also been recorded in Latvia, the United Kingdom, Germany and France. All of these countries are among Ukraine's most important allies.
A European official, a senior Baltic intelligence official and another intelligence source said the campaign had noticeably slowed down in late 2024 and early this year. Their analysis suggests Moscow likely paused its activities temporarily to curry favor with the new administration of U.S. President Donald Trump. In the meantime, the campaign has resumed at full intensity, according to the AP.
“They are back to work,” said a European official.
Multi-state conspiracies drain resources
The man officials say is behind the attack on a Polish railway carrying aid to Ukraine is Yevgeny Ivanov, a Ukrainian convicted of collaborating with Russian military intelligence in planning arson attacks on home improvement stores, a cafe and a drone factory in Ukraine, court documents show.
Ivanov, who left Poland after the attack, worked for Yuri Sizov, an officer in Russia's GRU military intelligence service, Ukraine's security service said.
Ivanov was convicted in absentia in Ukraine but managed to enter Poland because Ukrainian authorities failed to inform Polish officials of the verdict, Polish Interior Minister Marcin Kierwinski said. Ukraine's security service said it was working closely with allies.
Organizing conspiracies involving perpetrators from multiple countries or those who crossed state borders exhausts the investigative capacities of multiple institutions across Europe - which is one of Moscow's key goals, said Estonian Prosecutor General Triinu Olev-Aas.
She said that the profile of attackers in Estonia has changed over the past year, with unknown foreigners now appearing more frequently instead of local actors who were mostly already known to law enforcement. This requires increased cooperation between states to thwart plots or bring perpetrators to justice.
For two attacks in January - setting fire to a supermarket and a Ukrainian restaurant - the people involved had never previously visited Estonia, Olev-Aas said.
A Moldovan man broke a window in a restaurant, threw a can of gasoline into it, and set it on fire. The video shows his hand engulfed in flames as he flees the scene.
He and his accomplice fled through Latvia, Lithuania and Poland before being arrested in Italy.
Turning to criminals
While Russian intelligence officers may be the masterminds behind such operations, they often rely on intermediaries - often already convicted individuals or those with criminal connections - who assign tasks to saboteurs on the ground, the Baltic official said.
Leaving jobs to people with criminal backgrounds, like Ivanov, means Russia doesn't have to risk highly trained intelligence operatives - agents that Moscow often doesn't have at its disposal anyway, as European countries have expelled dozens of spies in recent years as relations have sharply deteriorated.
Russian criminal networks represent a ready-made alternative, the Baltic official said.
The European official said, for example, that a man accused of coordinating a plot to plant explosives in cargo plane shipments was recruited by Russian intelligence after being involved in arms and explosives smuggling. The man has been linked to at least four other plots.
Other people are recruited in European prisons or shortly after they are released, the Baltic official said.
In one case, the Museum of the Occupation of Latvia, dedicated to the Soviet occupation of the country, was set on fire by a person who had been released from prison only a month earlier.
More pressure, more cooperation
Even plots that are thwarted represent a gain for Moscow, as they test defense capabilities and consume resources.
AP writes that in 2024, a Ukrainian, acting on orders from Russian military intelligence, dug up a hidden cache of items buried in a cemetery in Lithuania, including drone parts and cans of corn filled with explosives.
Officials believe the plan was to plant explosives in the drones. The plot was eventually foiled — but only after extensive resources were spent identifying everyone involved, said Jacek Dobżyński, a spokesman for the Polish security minister.
The sheer number of conspiracies is seriously burdening some police services, but, as a European official stated, the Russian campaign has also encouraged stronger cooperation between countries.
Prosecutors' offices in Latvia, Lithuania and Estonia have formed joint investigation teams for attacks organized by foreign intelligence services, said Martinš Jansons, a special prosecutor in Latvia.
In the United Kingdom, frontline police officers are being trained to spot suspicious incidents that may have state support, said Commander Dominic Murphy, head of the Metropolitan Police's counter-terrorism department in London.
He said a detective in training had tipped off a London warehouse arson attack after realising the company was Ukrainian-owned and that the facility contained communications equipment used by the military. Police have determined that the attack was organised by Russian intelligence.
However, officials warn that Russia is constantly testing new methods.
Smugglers from Belarus have been sending hundreds of weather balloons loaded with cigarettes to Lithuania and Poland, forcing the airport in the Lithuanian capital to be closed multiple times, in what authorities have described as a hybrid attack.
"Today they only carry cigarettes," Dobžinjski warned, "but in the future they could carry other things."
Bonus video:
