Espionage without borders and rules: chronicle of a large-scale repulse of Russian secret operations in Europe
In recent years, the landscape of European security, primarily due to the ongoing Russian-Ukrainian war that has already lasted five years, has undergone fundamental and irreversible changes.
In this conflict, Europe has unequivocally sided with Ukraine, which was subjected to unjustified, unprovoked military aggression from its eastern neighbor. Moscow, facing stiff international resistance and an inability to achieve lightning successes on the traditional front, has finally bet on asymmetric methods of influence.
The term “hybrid war” has ceased to be a theoretical concept from political science reports — today it describes the harsh reality in which the European continent lives. Arson, recruitment of marginals via messengers, reconnaissance drones launched over secret NATO facilities, cyberattacks, and damage to critical infrastructure at the bottom of the seas have become elements of a single, coordinated Kremlin strategy to destabilize the West.
Spy revelations in recent days clearly demonstrate that the geography of this secret war knows no borders. From the Baltic to the Mediterranean, Russian intelligence services are deploying their entire available arsenal, finally erasing the lines between classical diplomacy, agent work, and outright international terrorism.
Diplomatic cover and “sleeper cells”: Chronicle of recent failures
The latest in a series of espionage scandals is the trial in Poland. According to Reuters, a court in the city of Sosnowiec recently handed down a verdict against a married couple of Russian citizens — Igor R. and his wife Irina. The couple, who had refugee status and were receiving Polish state scholarships, turned out to be a deeply covert FSB cell. The district court found them guilty not only of collecting data on representatives of the Russian opposition based in Poland and the diplomats assisting them, but also of a far more dangerous crime. Igor R. was convicted of complicity in a large-scale conspiracy to send parcels with explosives through civilian courier services. The result: seven years of imprisonment for the husband and three years for the wife, as well as the destruction of the legend of “regime escapees” political emigrants.
Almost simultaneously, a powerful blow was dealt to the agent network in southern Europe. The Italian government officially announced the expulsion of two military attachés from the Russian embassy in Rome. Foreign Minister Antonio Tajani directly called their activities unacceptable interference threatening national security and emphasized that Moscow continues to actively use hybrid tools against the West. This deportation continues the consistent pan-European line aimed at harshly suppressing the illegal activities of Russian intelligence services under diplomatic status.
These cases are only part of a continuous series of high-profile revelations. In recent years, European counterintelligence services have recorded a sharp shift by Russian intelligence from classic information gathering to direct terrorist activity on European territory. One of the most resonant events of this period was the joint exposure by American and German intelligence services of a large-scale GRU conspiracy to eliminate leaders of the European defense sector. The main target of the saboteurs was to be Armin Papperger, head of the largest German concern Rheinmetall, which supplies armored vehicles and artillery systems to the front line.
At the same time, in Bavaria, German counterintelligence detained two more agents with dual Russian and German citizenship who were conducting detailed photo and video surveillance of American military facilities, including the Grafenwoehr training area where Ukrainian tank crews were being trained, and were preparing a series of explosions on military logistics routes.
Similar aggressive actions were recorded across the continent. The counterintelligence agencies of Romania and Bulgaria, in a joint operation, dismantled a cross-border sabotage network whose members, on direct instructions from Moscow, were preparing explosions at railway junctions and near the Black Sea port of Constanta in an attempt to completely paralyze logistics routes.
France dealt no less severe a blow to technological espionage when its counterintelligence liquidated a covert network of shadow logisticians consisting of French specialists who, through front companies in Paris and Hong Kong, purchased and shipped scarce microelectronics to Russia for the production of cruise missiles in circumvention of sanctions.
In the United Kingdom and Norway during the same period, a series of detentions took place of so-called active operators — local criminal elements recruited via Telegram who, for small sums in cryptocurrency, set fire to commercial warehouses belonging to firms linked to support for Kyiv.
In Estonia, an investigation was completed into a group of more than ten people recruited by Russian intelligence services to commit acts of vandalism and attacks on the cars of the interior minister and journalists in order to create internal panic and a sense of insecurity in the Baltic countries. All of this proves that Moscow has completely erased the boundaries between espionage and sabotage.
Toolbox of hybrid aggression: Pillars of destabilization
Analysis of incidents over the past two years allows us to clearly classify the methods used by Moscow as comprehensive sabotage and reconnaissance activity divided into several key directions.
The first direction was the creation of a new type of agent network that experts call “cheap espionage.” Classic networks with career officers under diplomatic cover have been largely paralyzed by mass expulsions, so the GRU and FSB have switched to outsourcing. In Poland, Moldova, and the Baltic states, counterintelligence uncovered networks consisting of citizens of Ukraine, Belarus, and local marginals who were coordinated remotely through anonymous channels. The task of these individuals was simple observation of railways, ports, and airfields using hidden web cameras.
The second, most dangerous element was explosive parcels in civilian logistics networks. In the summer of 2024, European air carriers and courier services faced a deadly threat when spontaneous combustions and micro-explosions of parcels occurred at DHL warehouses in Birmingham, UK, Leipzig, Germany, and facilities in Poland. The investigation showed that incendiary devices disguised as electric massagers with a magnesium-based flammable composition were being tested for shipment on transatlantic passenger and cargo flights to the United States and Canada with the aim of causing aircraft to crash in midair. The Polish investigation by 2026 directly proved Russian intelligence involvement in this operation.
At the same time, a sharp increase in the activity of unidentified drones was recorded in the airspace of NATO countries. Coordinated drone launches occurred over critical facilities, including British air bases, nuclear sites in France, bases in the Netherlands and Belgium where American tactical nuclear weapons are stored, and German training grounds. International analytical centers concluded that these devices were not launched by local hobbyists but were coordinated from civilian commercial vessels of the so-called Russian shadow fleet cruising off the coasts of Europe.
Another strategic direction was the war on the seabed against Western communications infrastructure. Damage to underwater data transmission cables in the Baltic, North, and Mediterranean seas has become systemic. Incidents involving cables between Finland and Germany, Sweden and Lithuania, and in the Arctic zone of Norway strangely coincided in time and coordinates with the passage of Russian research vessels Yantar and Akademik Karpinsky, equipped with deep-sea autonomous vehicles.
Finally, attempts at direct sabotage and diversion at European defense enterprises producing shells and equipment for Ukraine were recorded. Explosions at an ammunition plant in Poland, a major fire at a defense-industrial complex enterprise in Berlin, and incidents at plants in the Czech Republic and the United Kingdom — the counterintelligence services of these countries stated a high probability of coordinated actions by Russian saboteurs aimed at creating an artificial shortage of weapons.
Humanitarian camouflage: Collapse of “Russian houses” in Europe and Baku
In addition to the force and espionage components, hybrid warfare includes soft power, which in the Kremlin’s execution has long turned into an instrument of propaganda, recruitment, and legalization of intelligence officers. The main operator of this activity was the federal agency Rossotrudnichestvo, which manages the network of Russian information and cultural centers, better known as “Russian houses.” Over the past two years, a wave of closures of these institutions has swept across Europe as European governments realized that under the guise of studying the Russian language and holding exhibitions and classical music concerts lay classic support points for espionage operations and financing of radical pro-Russian movements. In Moldova, the “Russian house” in Chisinau officially ceased operations recently at the request of the government, which declared the need for strict limitation of Moscow’s toxic influence on the country’s internal politics. Similar measures had previously been taken in Romania, Slovenia, Croatia, and a number of other European Union states.
In February 2025, the “Russian house” in Baku also ceased operations. The official explanation from the Azerbaijani authorities at the time stated that the organization had been operating without proper legal registration, grossly violating the country’s national legislation.
However, far more serious grounds lay behind the legal formulations, which were actively voiced in the expert community and media space of Azerbaijan. Sources indicated that Azerbaijan had fully outgrown the status of a recipient of external assistance and did not need the activities of dubious foreign structures, especially those operating under opaque financial schemes and openly involved in intelligence gathering. Shortly before the closure, Azerbaijani television channels released detailed investigations proving that career Russian intelligence officers coordinated their actions under the roof of the “Russian house” in Baku. Attempts by then-head of Rossotrudnichestvo Yevgeny Primakov to justify himself and file lawsuits against local media came to nothing, as Baku made it clear that it would not tolerate elements of hybrid influence on its territory.
Information cleanup: Ban on broadcasting of Kremlin mouthpieces
The most important victory of the West and its partners in this hybrid duel was the systematic destruction of the Russian propaganda machine abroad. Channels such as Russia Today, the Sputnik agency, and their subsidiaries and bureaus were recognized not as mass media but as full-fledged subdivisions of psychological operations of the Russian Ministry of Defense. As part of successive packages of European Union sanctions, as well as tough decisions by national regulators in the United Kingdom, Canada, and the United States, broadcasting of these channels was completely blocked on all satellite, cable, and internet platforms. Major state broadcasters including Rossiya 24, Channel One, NTV Mir, and TV Center, as well as bureaus of RIA Novosti and Rossiyskaya Gazeta in several European capitals, were also banned.
The grounds for closing bureaus and deporting so-called journalists included conducting coordinated disinformation campaigns, inciting interethnic hatred within European societies, manipulating public opinion during elections, and broadcasting aggressive Kremlin narratives. Counterintelligence services established that the press credentials of employees of these structures were systematically used as a legal way to conduct visual reconnaissance on the ground and establish contacts with potential agents of influence.
Counteroffensive strategy: European shield against the Russian sword
The large-scale destabilization campaign launched by Moscow clearly demonstrates that modern intelligence services are ready to cross any legal and ethical boundaries, not limiting themselves in the choice of means and methods. But if strategists in Moscow calculated that this wave of chaos would paralyze the pan-European will, reality proved the opposite. Russia’s subversive actions not only failed to achieve their goal but also produced the reverse, consolidating effect.
What Moscow considered a demonstration of strength turned into a large-scale geopolitical rollback for it. The countermeasures being taken in the West testify to a profound reset of security systems. States’ protective mechanisms have adapted to hybrid pressure, and counterintelligence agencies are successfully learning to work preemptively.
Based on today’s results of this hidden duel, it is obvious that states that respect their sovereignty have built a strong shield that will become increasingly difficult for Moscow to pierce with mere blackmail and sabotage.
