Russia is waging a clandestine war in Europe using saboteurs, sleeper agents, and criminal networks. A detailed analysis of a structured hybrid strategy.
Since 2022, Russia has been stepping up a clandestine campaign against European states to disrupt military aid to Ukraine. This strategy relies on sleeper agents, recruited since the 1990s, who activate criminal networks to carry out targeted sabotage. Several major fires in Poland, Germany, and the United Kingdom have been attributed to these operations. Drones have flown over Ukrainian training camps, suspicious packages have been sent abroad, and logistics infrastructure has been targeted. The FSB, heir to the KGB, coordinates these actions with the support of the GRU, the military intelligence service. These attacks are designed to weaken European support for Kyiv, divert Western resources, and increase psychological pressure on public opinion.
A structured campaign of sabotage against Western support for Ukraine
Since early 2023, several incidents in the European Union have been linked to a Russian clandestine sabotage campaign. Arson attacks have been reported in more than a thousand businesses in Poland, a DHL warehouse in the United Kingdom, and transport companies operating in Ukraine. Investigations conducted by Germany and Switzerland have led to the arrest of three Ukrainian individuals accused of sending parcel bombs or GPS-tracked packages to Ukraine.
The operations reveal a methodical approach. Logistical tests are carried out before any action is taken in order to map supply flows. The aim is to disrupt the delivery of military equipment from NATO countries to Ukrainian forces. Russia is thus targeting not the battlefields, but the civilian and military logistics infrastructure used as relays.
Several Russian citizens living in Germany have also been arrested for using quadcopter drones over Ukrainian military training areas. Such flights are strictly prohibited in the vicinity of military zones. The repeated overflights by civilian aircraft suggest a desire for discreet visual reconnaissance in support of future direct action.
European intelligence services believe that this strategy has intensified as the Russian offensive in Ukraine has become bogged down. The use of local criminal networks, recruited by intermediaries, limits the direct exposure of Russian agents. This outsourcing of sabotage is difficult to trace, which explains the slow pace of judicial investigations. Nevertheless, several individuals who have been arrested have confirmed Russian involvement during questioning, providing significant evidence for European intelligence services.
The strategic return of sleeper agents to Europe
Russia, like the Soviet Union before it, has always maintained sleeper networks abroad. These undercover agents, often integrated into local society, lead ordinary lives until they are activated. Since the collapse of the USSR in 1991, some of these networks have survived, particularly in Germany, France, and Eastern Europe. In 2022, military failures in Ukraine prompted the FSB and GRU to reactivate these networks.
These cells are activated in waves, with instructions to never act directly, but to recruit criminal groups to carry out acts of sabotage. This method limits the risk of Russian agents being arrested directly. If compromised, the agents retreat and wait for a new signal. Europeans questioned in the wake of criminal acts—arson, attempted explosions, intrusions—are often unaware of the true identity of those who ordered them.
The German, Polish, and French intelligence services have established a link between these acts of sabotage and Soviet asymmetric warfare techniques. The method of “plausible deniability” is systematically sought. Sabotage of railway lines, industrial fires, or cyber interference are designed to look like accidents.
For example, railway accidents in Poland and Lithuania, initially classified as technical incidents, are currently being re-examined in light of new information. Investigators are looking for anomalies in signaling systems or physical alterations to the rails. The presence of GPS jamming in these areas, simultaneous with other incidents, reinforces the theory of coordinated action.
The reactivation of these sleeper cells has led to a review of European security protocols, particularly in ports, airports, logistics centers, and train stations. Video surveillance systems, access controls, and behavioral analysis have been strengthened since 2023. These measures aim to identify suspicious behavior in sensitive environments, while strengthening cooperation with foreign intelligence services.
A comprehensive strategy combining sabotage, destabilization, and cognitive warfare
Russia’s overall objective is not simply to damage infrastructure. It is to wage a hybrid war, combining physical sabotage, information warfare, and psychological influence. These actions create latent insecurity, raise political questions about the reliability of supply chains, and aim to weaken Western cohesion around support for Ukraine.
Disinformation campaigns, coordinated by digital cells in Russia or third countries, spread narratives hostile to European military support policies. At the same time, GPS jamming, active in Scandinavia, the Baltic Sea, and the Black Sea, disrupts civil and military navigation systems. These acts, although unclaimed, pose risks to air transport and commercial flights, as has been documented on several occasions on flights departing from Helsinki and Warsaw.
Added to this are actions outside Europe. Russia is seeking to mobilize its diplomatic, paramilitary, and media resources in Africa, the Middle East, and Central Asia to divert attention from operations in Ukraine. The role of private military companies, such as Wagner or its successors, is part of this dynamic of expanding points of tension, with the aim of wearing down Western diplomatic and military capabilities.
This principle of strategic saturation, inherited from Soviet doctrine, can also be seen in attempts to create internal disorder in target countries. The example of the failed coup in Montenegro in 2016, where Russian agents recruited gangs to prevent the country from joining NATO, remains a precedent. This attempt failed, but it illustrates a persistent method.
Russia is still trying to revive this method, as shown by the events of February 2022, when Russian agents sought to organize pro-Russian social movements in several Ukrainian cities to justify armed intervention. This action was unsuccessful because Moscow had overestimated local support.
A declining but still dangerous capability
While the Russian method is well known, its implementation today suffers from structural limitations. The FSB, successor to the KGB, has suffered a loss of expertise accumulated since the 1990s. The current generation of agents lacks the experience and ideological training of their predecessors. Several networks have been exposed, particularly following the temporary opening of Soviet archives in the 1990s, which enabled Western services to identify hundreds of infiltrated agents.
Faced with the effectiveness of Western countermeasures, Russia has had to call on retired Soviet agents to reactivate or rebuild networks. This lack of renewal weakens Moscow’s operational capacity to coordinate long-term campaigns. However, the occasional effects of sabotage remain a concern.
The arrests of Westerners taken hostage in Russia in exchange for Russian agents captured in Europe show that Moscow remains committed to indirect confrontation. The use of criminal intermediaries rather than official agents reflects a pragmatic but fragile adaptation of the Russian system.
Over the past two years, Western intelligence services have changed their analysis framework: any incident of unknown origin, any logistical or IT disruption is now investigated with a view to counter-sabotage. This increased vigilance has reduced the effectiveness of Russian campaigns, but has not eliminated them.
Russia’s clandestine war in Europe is a constant variable in the global conflict that began with the invasion of Ukraine. It requires permanent mobilization of civilian and military capabilities and underscores that deterrence relies not only on visible military force, but also on resistance to invisible operations.
War Wings Daily is an independant magazine.