From spy rings to arson — Russia's sabotage across Europe continues unpunished

Alongside Russia launching its full-scale invasion of Ukraine, Moscow has also ramped up its hybrid attacks across Europe.

In 2024 alone, Russia could be behind around 100 "suspicious incidents" in Europe, Czech Foreign Minister Jan Lipavsky claimed. Last month, the Dutch intelligence said that Moscow keeps stepping up its attacks amid reports that the U.S. had scaled down efforts in countering Russian sabotage.

The events had heightened tension between Russia and Europe, as Russian activities have been linked to intensifying cyberattacks, espionage, and election interference. For such attacks, Russia usually recruits foreigners, including Ukrainians living abroad.

"We shouldn't really see these events in isolation, but as part of a bigger picture," EU's top diplomat Kaja Kallas said in an interview with Deutsche Welle in January.

"And understand that Russia has intentions towards Europe and European security architecture that haven't changed."

The Kyiv Independent has compiled a list of suspected sabotage incidents across Europe since February 2022, possibly involving Russia.

Baltic Sea: suspected cable sabotage

Since 2022, the Baltic Sea has seen a series of undersea cable disruptions, many of which are suspected to be acts of sabotage.

These incidents have affected critical infrastructure, such as power and telecommunications cables, raising concerns among Baltic nations and NATO countries.

While some incidents are considered accidental, others are still under investigation amid suspicions of deliberate sabotage, possibly linked to Russia's use of "shadow fleet" vessels to evade sanctions.

In January, a Finnish court upheld the seizure of the Eagle S tanker carrying Russian oil, which is suspected of damaging a cable connecting Estonia and Finland in late December, potentially as an act of sabotage.

Multiple incidents have been reported involving damaged undersea cables between Estonia and Finland, Finland and Germany, and Latvia and Sweden.

No suspects have been prosecuted so far.

Poland: Arson attack on a shopping center

A massive fire destroyed the Marywilska shopping center in Warsaw, which houses approximately 1,400 stores, on May 12 in 2024.

A year later, Polish Prime Minister Donald Tusk said that Russian intelligence services were behind the sabotage.

"We have in-depth knowledge of the order and course of the arson and the way in which the perpetrators documented it," Polish Justice Minister Adam Bodnar and Interior Minister Tomasz Siemoniak said. "Their actions were organized and directed by an identified person staying in the Russian Federation."

Among those involved in the group acting on behalf of Russia are two Ukrainians. They were detained.

Lithuania: Arson attack on the IKEA warehouse

Lithuanian authorities suspect Russia's intelligence services of orchestrating arson attacks on an IKEA warehouse in Vilnius on May 9 last year, which is also linked to the Warsaw shopping center incident.

The attack on the IKEA warehouse caused an estimated damage of 500,000 euros ($545,000).

Officials did not provide additional details about the suspects detained.

The Lithuanian prosecutor's office alleges that Russia's military intelligence (GRU) formed a special group to carry out arson attacks across Lithuania, Poland, and Latvia.

Czech Republic: Bus depot arson attempt

Russia is suspected of organizing and funding a failed arson attack on Prague buses in June 2024.

"It is part of a hybrid war waged against us by Russia, against which we have to defend ourselves and which we must stop," Czech Prime Minister Petr Fiala said.

He described Russia's involvement as "not only possible, but very likely."

Czech police arrested a man of South American origin after he tried to ignite a fire in a garage belonging to Prague's transport company.

He has been taken into custody and charged with terrorism.

Germany: Assassination plot against Rheinmetall CEO

In July 2024, intelligence agencies from the U.S. and Germany foiled a Russian-backed plot to assassinate Armin Papperger, CEO of German arms manufacturer Rheinmetall.

Papperger has been a vocal supporter of Ukraine, and his company plays a key role in supplying Kyiv with weapons and equipment throughout Russia's full-scale invasion.

The Rheinmetall chief said that Russia targeted him due to its dissatisfaction with Western arms support.

In response to the incident, Germany provided Papperger with the same top-level security as then-Chancellor Olaf Scholz.

United Kingdom: Wagner-linked arsons and Bulgarian spies

Several U.K. citizens have been charged with an arson plot against a Ukrainian-linked business in London in March 2024 after being recruited by Russian intelligence.

The attackers targeted two sites at an industrial estate in Leyton, East London, owned by British-Ukrainian Mykhailo Boikov and his wife, Jelena Boikova. Their delivery services, Odyssey and Meest UK, have been active in sending aid to Ukraine since the start of Russia's all-out invasion in 2022.

Twenty-year-old U.K. man Dylan Earl is accused of orchestrating the attack on behalf of the Wagner mercenary group, and allegedly recruited and paid others to carry out the attacks.

The case marked the first time the U.K. has brought charges under the National Security Act, a new legislation passed in 2023 to address hostile activity orchestrated by foreign states.

In another instance, a London court earlier sentenced six Bulgarian nationals to prison terms for operating a Russian espionage network in Britain.

Orlin Roussev, 47, identified as the ringleader, was sentenced to 10 years and 8 months for conducting six espionage operations that threatened U.K. national security. Judge Nicholas Hilliard described Roussev's actions as posing a serious threat to the country.

Prosecutors said the network acted not directly as part of the Russian intelligence network but rather for financial gain.

Police uncovered thousands of communications linking Roussev to fugitive Jan Marsalek, a former executive at Wirecard, accused of coordinating the Bulgarian network from abroad.

Marsalek, suspected of being an agent of Russian intelligence, fled to Belarus and reportedly remains in Russia under Federal Security Service (FSB) protection.

International: Parcel fires

In July 2024, a fire broke out at a DHL-operated airport hub in Leipzig, Germany. A parcel went aflame.

German intelligence officials stated that if the parcel had ignited mid-flight, it could have caused a catastrophic crash.

The package, which came from Vilnius, Lithuania, was disguised as an electric massager containing a magnesium-based incendiary device.

Later that month, a similar parcel caught fire at a DHL warehouse near Birmingham in the U.K. The package had also arrived from Lithuania and was disguised in the same way.

Media reported, citing Western officials, that Russia may be behind the dispatches of flammable packages via cargo planes in Europe in preparations for similar operations in North America.

Almost a year later, in May 2025, German authorities accused three Ukrainian nationals of participating in a separate, allegedly Russian-backed plot to send out parcels with explosives across Europe.