Moscow’s intelligence services have launched a diffuse campaign of sabotage and arson in Europe since 2023, recruiting mainly through Telegram and paying in cryptocurrency. Operatives like Serhiy S, a Ukrainian refugee arrested in Wrocław in January 2024 before executing an arson attack, illustrate the modus operandi whereby GRU controllers remain in Russia while directing these foot soldiers. Targets vary from shopping centers and warehouses to Ukraine-supporting businesses, and activities include posting anti-NATO propaganda and installing surveillance cameras on military supply routes. This tactic follows older sabotage doctrines of Soviet-era agencies and the more focused operations by GRU unit 29155, now hampered by diplomatic expulsions. The campaign aims to sow insecurity and discord by targeting soft civilian infrastructure rather than high-value assets. Recent suspicious fires and sabotage incidents in Lithuania, Poland, Estonia, France, and the UK are attributed to this offensive. Western intelligence fears escalation amid uncertain Kremlin oversight and warns of continued risks as the Ukraine war persists.

Moscow’s intelligence services have launched a diffuse campaign of sabotage and arson in Europe since 2023, recruiting mainly through Telegram and paying in cryptocurrency. Operatives like Serhiy S, a Ukrainian refugee arrested in Wrocław in January 2024 before executing an arson attack, illustrate the modus operandi whereby GRU controllers remain in Russia while directing these foot soldiers. Targets vary from shopping centers and warehouses to Ukraine-supporting businesses, and activities include posting anti-NATO propaganda and installing surveillance cameras on military supply routes. This tactic follows older sabotage doctrines of Soviet-era agencies and the more focused operations by GRU unit 29155, now hampered by diplomatic expulsions. The campaign aims to sow insecurity and discord by targeting soft civilian infrastructure rather than high-value assets. Recent suspicious fires and sabotage incidents in Lithuania, Poland, Estonia, France, and the UK are attributed to this offensive. Western intelligence fears escalation amid uncertain Kremlin oversight and warns of continued risks as the Ukraine war persists.