From $7 graffiti to arson and a bomb plot: How Russia’s ‘shadow war’ on NATO members has evolved

Arson at warehouses linked to arms for Ukraine. Surveillance cameras where NATO trains Ukrainian troops. Blunt vandalism of ministerial cars. Even an apparent, failed bomb plot.

Russia has been engaged in a “bold” sabotage operation across NATO’s member states for more than six months, targeting the supply lines of weapons for Ukraine and the decision-makers behind it, according to a senior NATO official.

Multiple security officials across Europe describe a threat that is metastasizing as Russian agents, increasingly under scrutiny by security services and frustrated in their own operations, hire local amateurs to undertake high-risk, and often deniable, crimes on their behalf.

The NATO official said they had observed “an unprecedented escalation and spread of Russia’s hybrid warfare” over the past six months, which included “physical sabotage” on the supply line of NATO weapons intended for Ukraine. “It is everything from point of production and origin, to storage, to those who are making decisions, to the actual delivery,” the senior NATO official said. “It is bold. Russia is attempting to intimidate (our) allies.”

Russia has dismissed the claims as unfounded but Russian sabotage and hybrid warfare will be on the agenda of the NATO 75th anniversary meeting in Washington, DC, which began Tuesday. Yet it is unclear how publicly member states will express their outrage at what analysts have called the Kremlin’s new “shadow war,” as they may be reluctant to provide Moscow with a propaganda win, or foment alarm at a series of security breaches across Europe.

Recent high-profile arrests have revealed the ad-hoc, clumsy nature of how the Kremlin’s intelligence operations have evolved since the start of the war in Ukraine. Last year, 14 Ukrainians and two Belarusians were arrested in Poland in one case on suspicion of working for Russian intelligence. A Ukrainian, who under Polish privacy law can be identified only as Maxim L., 24, was sentenced to six years after weeks of receiving tasks from a Russian handler, Andrzej, whom he had never physically met but encountered on the Telegram messaging app in February 2023.

Andrzej at first paid him $7 in digital currencies for spraying anti-war graffiti around Poland, Maxim said. Yet the tasks soon became darker.

‘Easy money… it seemed so insignificant’

He said he did not feel an obligation to fight for Ukraine after the Russian invasion in February 2022. “That country has never done anything for me,” he said. “I don’t believe that just because you are born in a certain country, you have to go to war for it. Don’t get me wrong: I am not pro-Russian, I am not pro-Ukraine. I am not pro-anything.”

Andrzej soon started sending Maxim location pins where he should plant surveillance cameras along the railway tracks near the border town of Medyka, through which military and humanitarian aid would flow to Ukraine. “I didn’t think any of it could cause any actual harm. It seemed so insignificant,” he said.

Andrzej later asked him to burn down the fence of a Ukrainian-owned transportation company in the eastern Polish town of Biala Podlaska, he said, which Maxim says he faked, taking a photograph of the fence with lumps of coal he had placed to mimic fire damage.

Yet Maxim’s slow realization that Andrzej was a Russian agent became complete, he said, when he was told to put cameras outside a base where Poland was training Ukrainian soldiers. “That’s when I knew it could be serious,” he said. “It made me feel uneasy. That was when I decided I’d quit. But I never got a chance. I got arrested the next day.”

Polish internal security agents arrested Maxim on March 3, 2023, after weeks of surveillance, sparked partially by the discovery of a gas station receipt Maxim had accidentally dropped on one of his operations, according to a Polish official. Multiple other arrests followed this, making it the largest known Russian espionage operation in Poland of recent times, raising concerns in Warsaw about the extent of Moscow’s infiltration. Two Russian citizens were detained last August on suspicion of recruiting to Wagner and a Polish man and two Belarusians this May for alleged arson.

Another Polish man was arrested in April 2024 for possessing ammunition, and surveilling Rzeszow Jasionka airport, a hub for moving NATO arms to Kyiv, in a suspected plot to assassinate Ukraine’s President Volodymyr Zelensky, who also frequently uses the facility.

The Polish plots join a series of incidents across Europe which, when viewed together, portray the widescale ambition of Moscow’s operations. Russia was “likely” behind an arson attack that hit Poland’s largest shopping center in May, Prime Minister Donald Tusk said, and suspicions have been voiced about another fire at an ammunition factory, south of the capital, in June. Czech officials have voiced concerns at Russian involvement in the hacking and disruption of its railways last year.

Last month, a suspicious fire hit a metals factory for a defense manufacturer outside Berlin, and a 26-year-old pro-Russian Ukrainian was arrested after blowing himself up with a homemade bomb near Paris Charles de Gaulle airport. A warehouse fire in East London in March led to two men being charged by London’s Metropolitan Police Service with arson and assisting a foreign intelligence service, namely Russia.

While the incidents have not all been definitively linked to Russian intelligence, they have been unified by the apparent involvement of amateurs, or petty criminality aimed at spreading fear or disruption.

A ‘pretty dangerous game’

The senior NATO official said Russian sabotage on NATO states amounted to a “pretty dangerous game, if (Russia believes) these things are always below the threshold of armed conflict,” that would not trigger the NATO Article 5 stipulation that an attack on one member state is an attack on the entire alliance. “Finding where that line is, is a difficult and dangerous calculation to make,” the official said, adding that Russian President Vladimir Putin’s beleaguered invasion of Ukraine shows the Kremlin head was not always getting good military advice.

Russia is using the “full gamut” of hybrid operations, the official added. “We see everything from high-end operations in Europe, where we have seen as much as 400,000 euros ($433,000) paid for some type of intelligence activity, to some places where thugs are being hired for a couple of thousand euros.”

A similar threat has grown on Russia’s border with NATO, in Estonia, where 10 suspected Russian agents were arrested in February after the interior minister’s car was vandalized. The incident was a high-profile peak in what Estonian officials have said is a years-long campaign by Moscow to destabilize its tiny NATO neighbor, about a fifth of whose population of 1.3 million is Russian-speaking, according to a 2021 analysis by the EU.

Recent months have seen GPS jamming impede civilian aircraft landings, and even the buoys that demark part of Russia’s border with Estonia disappear, amid a short-lived call from Moscow for the maritime frontiers to be reassessed.

He said the operations were moving “towards physical attacks” and suggested the war in Ukraine might lead to more aggressive Russian tactics in the months ahead, if operatives were redeployed to the Baltic areas from the war.

“We have to face the facts. Russia is big enough to have resources to fight a war against Ukraine and also maintain its security operations against European countries… against us. There are people who take part in the war against Ukraine, and then they are rotated to some other region or area. They have more experience. Their mindset is more violent. They are perhaps not so patient anymore trying to get results.”