In November, a train carrying almost 500 people stopped suddenly in eastern Poland. A broken overhead line broke several windows and the front path was damaged. Elsewhere on the line, explosives detonated under a passing freight train.
No one was injured in either case and damage was limited, but Poland, which blamed the attack on Russian intelligence, responded forcefully, deploying 10,000 troops to protect critical infrastructure.
The sabotage in Poland is one of 145 incidents in an Associated Press database that Western officials say are part of a campaign of disruption across Europe by Russia. Officials say the campaign – carried out since President Vladimir Putin’s invasion of Ukraine in 2022 – aims to deprive Kiev of support, create divisions among Europeans and identify the continent’s security weaknesses.
So far in this hybrid war, the most notorious acts of sabotage have resulted in minimal damage – nothing compared to the tens of thousands of lives lost and cities decimated across Ukraine.
But officials say each act — from monument vandalism to cyber attacks to warehouse fires — consumes valuable security resources. The head of a major European intelligence service has said that investigations into Russian interference are now consuming as much of the agency’s time as terrorism.
While the campaign places a heavy burden on European security services, it costs Russia next to nothing, officials say. That’s because Moscow conducts cross-border operations that require European countries to cooperate heavily in investigations — while often using foreigners with criminal records as cheap proxies for Russian intelligence agencies. This means that Moscow only gains by tying up resources – even when the plots are unsuccessful.
“It’s a 24/7 operation between all services to stop it,” said a senior European intelligence official, who, like the European intelligence chief and other officials who spoke to the AP, insisted on anonymity to discuss sensitive security matters.
Over the course of the year, the AP spoke with more than 40 European and NATO officials from 13 countries to document the extent of this hybrid war, including incidents on its map only when Western officials are linked to Russia, its proxies or its ally Belarus.
Putin’s spokesman, Dmitry Peskov, told the AP that Russia had “nothing to do” with the campaign.
AP map tracking Russian sabotage and disruption
The AP database shows an increase in fires and explosives from one in 2023 to 26 in 2024. Six have been documented so far in 2025. Three cases of vandalism were recorded last year, meanwhile, and one this year.
The data is sketchy because not all incidents are made public, and it can take months for officials to establish a link with Moscow. But the spike matches what officials have warned: The campaign is becoming increasingly dangerous.
The most frequently targeted countries, according to the map, border Russia: Poland and Estonia. Several incidents also occurred in Latvia, Great Britain, Germany and France. All of them are great supporters of Ukraine.
The European official, a senior Baltic intelligence official and another intelligence official said the campaign noticeably calmed down in late 2024 and early this year. Their analysis showed that Moscow likely interrupted the campaign to curry favor with the new administration of US President Donald Trump. Since then it has resumed at full speed.
“They are back to business,” the European official said.
Batches from multiple countries consume resources
The man officials say was behind the attack on the Polish railway carrying supplies to Ukraine is Yevgeny Ivanov — a Ukrainian convicted of working with Russian military intelligence to plot arson attacks on home improvement stores, a coffee shop and a drone factory in Ukraine, according to court documents.
Ivanov, who left Poland after the attack there, worked for Yuri Sizov, an officer in Russia’s GRU military intelligence service, according to Ukraine’s security service.
Ivanov was convicted in absentia in Ukraine, but was able to enter Poland because Ukraine did not inform Polish officials of his conviction, Polish Interior Minister Marcin Kierwiński said. Ukraine’s security service said it was cooperating closely with allies.
Organizing plots involving perpetrators from multiple countries or who crossed borders consumes the investigative resources of several authorities in Europe – one of Moscow’s key objectives, according to Estonian state prosecutor Triinu Olev-Aas.
Over the past year, she said, the profile of Estonian attackers has changed from mostly known locals from law enforcement to unknown foreigners. This requires increased cooperation between countries to disrupt plots or apprehend perpetrators.
For two attacks in January — fires at a supermarket and a Ukrainian restaurant — the people employed had never been to Estonia before, Olev-Aas said.
At the restaurant, a Moldovan broke a window, threw a can of gasoline and set it on fire. The video shows his arm on fire as he ran away.
The man and his accomplice fled through Latvia, Lithuania and Poland before being caught in Italy.
Back to criminals
While Russian intelligence officers may mastermind such operations, they frequently rely on recruiters — often with criminal convictions or connections — who assign tasks to saboteurs on the ground, the Baltic official said.
Outsourcing to people with criminal records like Ivanov means Russia doesn’t have to risk highly trained intelligence agents — agents Moscow often doesn’t resort to anyway, as European countries have expelled dozens of spies as relations have soured in recent years.
Russian criminal networks offer a ready-made alternative, the Baltic official said.
The European official said the man accused of coordinating a plot to slip explosives into packages on cargo planes, for example, was recruited by Russian intelligence after involvement in arms and explosives smuggling. The man is linked to at least four other plots.
Others are recruited from European prisons or shortly after they are released, the Baltic official said.
In one case, the Museum of Occupation in Latvia, dedicated to the occupation of the country by the Soviet Union, was set on fire by someone released from prison the previous month.
More tension, more cooperation
Even foiled plots are a win for Moscow as they test defenses and waste resources.
In 2024, a Ukrainian man working for Russian military intelligence unearthed a cache of items buried in a Lithuanian cemetery, including drone parts and corn boxes filled with explosives.
Officials believe the plan was to rig the drones with explosives. The plot was eventually foiled – but not before considerable resources were used to find everyone involved, said Jacek Dobrzyński, a spokesman for Poland’s security minister.
The sheer number of plots overwhelms some law enforcement agencies, but the campaign in Moscow has also encouraged greater cooperation, the European official said.
Prosecutors in Latvia, Lithuania and Estonia have created joint investigation teams into attacks organized by foreign intelligence services, said Mārtiņš Jansons, a Latvian special prosecutor.
In Britain, frontline police officers are trained to identify suspicious incidents that could be state-sponsored, said Cmdr. Dominic Murphy, head of the Metropolitan Police’s counter-terrorism team.
He noted that a trainee detective reported a fire at a warehouse in London after realizing the business was owned by Ukrainians and contained communications equipment used by the military. The police determined that the attack was organized by the Russian secret services.
But officials warn that Russia is continually testing new methods.
Smugglers from Russia’s ally Belarus sent hundreds of weather balloons containing cigarettes into Lithuania and Poland, repeatedly forcing the Lithuanian capital’s airport to close in what authorities called a hybrid attack.
“Today they only carry cigarettes,” Dobrzyński warned, “but in the future they might carry other things.”
___
Associated Press writers John Leicester in Paris, Claudia Ciobanu in Warsaw, Poland and Volodymyr Yurchuk in Kiev, Ukraine contributed.