In November, a train carrying nearly 500 people came to an abrupt halt in eastern Poland. A broken overhead line had broken several windows, and the front track was damaged. Elsewhere on the line, explosives detonated under a moving freight train.
No one was hurt in either case and the damage was limited, but Poland, which blamed the attack on Russia’s intelligence services, responded forcefully: It deployed 10,000 troops to protect critical infrastructure.
The sabotage in Poland is one of 145 incidents in an Associated Press database that Western officials say are part of a campaign of disruption across Europe led by Russia. Officials say the campaign — which has been carried out since the invasion of Ukraine by President Vladimir Putin in 2022 — aims to deprive Kyiv of support, create divisions among Europeans and identify the continent’s security weaknesses.
So far in this hybrid war, most known acts of sabotage have resulted in minimal damage — nothing compared to the tens of thousands of lives lost and cities decimated across Ukraine.
But officials say each act — from monument vandalism to cyber attacks to warehouse fires — draws valuable security resources. The head of a major European intelligence service said investigations into Russian interference now consume as much of the agency’s time as terrorism.
While the campaign puts a heavy burden on European security services, it costs Russia next to nothing, officials say. That’s because Moscow is conducting cross-border operations that require European countries to cooperate extensively on investigations — while often using foreigners with criminal backgrounds as cheap proxies for Russian intelligence operatives. This means that Moscow achieves victory simply by tying up resources — even when plots fail.
“It’s a 24/7 operation between all services to stop it,” said a senior European intelligence official, who like the head of the European intelligence service and other officials who spoke to AP insisted on anonymity to discuss sensitive security issues.
During the year, AP spoke with more than 40 European and NATO officials from 13 countries to document the scope of this hybrid war, including incidents on its map only when linked by Western officials to Russia, its proxies or its ally Belarus.
Putin’s spokesman, Dmitry Peskov, told AP that Russia has “no connection” to the campaign.
The AP map is tracking Russian sabotage and disruption
The AP database shows an increase in arson and explosive plots from one in 2023 to 26 in 2024. Six have been documented so far in 2025. Meanwhile three cases of vandalism were recorded last year, and one this year.
The data is incomplete as not all incidents are made public, and officials may take months to establish a link with Moscow. But the increase agrees with what officials have warned: The countryside is growing more dangerous.
According to the map, the most frequently targeted countries border Russia: Poland and Estonia. There have also been several incidents in Latvia, the United Kingdom, Germany and France. All are major supporters of Ukraine.
The European official, a senior Baltic intelligence official and another intelligence official said the campaign calmed down markedly towards the end of 2024 and the beginning of this year. Their analysis showed that Moscow probably stopped the campaign to gain favor with the new administration of US President Donald Trump. Since then it has resumed at full speed.
“They are back to business,” the European official said.
Multi-country plots drain resources
The man officials say was behind the attack on the Polish train carrying supplies to Ukraine is Yevgeny Ivanov — a Ukrainian convicted of working with Russian military intelligence to plan arson attacks at home improvement stores, a cafe and a drone factory in Ukraine, according to court documents.
Ivanov, who left Poland after the attack there, worked for Yury Sizov, an officer from Russia’s GRU military intelligence service, according to Ukraine’s security service.
Ivanov was convicted in absentia in Ukraine but managed to enter Poland because Ukraine did not inform Polish officials of his conviction, said Polish Interior Minister Marcin Kierwiński. Ukraine’s security service said it cooperates closely with allies.
Busting plots involving perpetrators from multiple countries or who crossed borders drains investigative resources from various authorities across Europe — one of Moscow’s main goals, according to Estonian State Prosecutor Triinu Olev-Aas.
Over the past year, she said the profile of attackers in Estonia has changed from locals known to most law enforcement to unknown foreigners. This requires greater cooperation among countries to disrupt the plots or apprehend the perpetrators.
For two attacks in January — a supermarket fire and a Ukrainian restaurant — the people hired had never been to Estonia before, Olev-Aas said.
In the restaurant, a man from Moldova cracked a window, threw a can of gasoline and grabbed it. A video showed his arm on fire as he fled.
The man and his accomplice fled through Latvia, Lithuania and Poland before being caught in Italy.
They turn to criminals
While Russian intelligence officers may be the brains of such operations, they often rely on recruiters – often with convictions or criminal connections – who assign tasks to saboteurs on the ground, the Baltic official said.
Outsourcing to people with criminal backgrounds, such as Ivanov, means Russia does not have to risk highly trained intelligence operatives – agents Moscow does not often turn to since European countries have expelled dozens of spies as relations have soured in recent years.
Russian criminal networks offer a ready alternative, the Baltic official said.
The European official said the man accused of coordinating a plan to plant explosives in packages on cargo planes, for example, was recruited by Russian intelligence after involvement in gun and explosives smuggling. The man is linked to at least four other plots.
Other people are recruited from European prisons or soon after they are released, the Baltic official said.
In one case, the Museum of the Occupation of Latvia, dedicated to the occupation of the country by the Soviet Union, was set on fire by someone released from prison the previous month.
Greater stress, greater cooperation
Even foiled plots are a win for Moscow because they test defenses and waste resources.
In 2024, a Ukrainian man, working on orders from Russian military intelligence, dug up a cache of items buried in a cemetery in Lithuania, including drone parts and grain cans filled with explosives.
Officials believe the plan was to arm the drones with explosives. The plot was eventually foiled — but not before considerable resources were used to track down all those involved, said Jacek Dobrzyński, the spokesman for Poland’s security minister.
The sheer number of plots is overwhelming some law enforcement agencies, but Moscow’s campaign has also fostered greater cooperation, the European official said.
Prosecutors in Latvia, Lithuania and Estonia have created joint investigation teams for attacks organized by foreign intelligence services, said Mārtiņš Jansons, a special prosecutor in Latvia.
In the United Kingdom, frontline police officers are being trained to identify suspicious incidents that may be state-sponsored, said Cmdr. Dominic Murphy, head of the counter-terrorism squad at the Metropolitan Police.
He noted that a trainee detective signaled an arson attack on a warehouse in London after realizing the business was owned by Ukrainians and contained communications equipment used by the military. The police determined that the attack was organized by Russian intelligence.
But officials warn that Russia is constantly testing new methods.
Smugglers in Russia’s ally Belarus sent hundreds of weather balloons carrying cigarettes into Lithuania and Poland, repeatedly forcing the Lithuanian capital’s airport to close in what authorities called a hybrid attack.
“Nowadays they only carry cigarettes,” warned Dobrzyński, “but in the future they may carry other things.”
___
Associated Press writers John Leicester in Paris, Claudia Ciobanu in Warsaw, Poland, and Volodymyr Yurchuk in Kyiv, Ukraine, contributed.