{
  "id": "5401b18b-23af-4383-89f1-32fe45be495b",
  "url": "https://sapo.se/ovriga-sidor/other-languages/english-engelska/press-room/news/news/2024-05-30-iran-is-using-criminal-networks-in-sweden.html?amp%3Bsv.12.310a187117da376c66041.route=%2Fapi-search&sv.target=12.310a187117da376c66041",
  "source": "extension",
  "status": "approved",
  "category": "Intelligence & Espionage",
  "subcategory": "Human Intelligence (HUMINT)",
  "incident_type": "Recruitment of locals",
  "country": "Sweden",
  "source_reliability": "A",
  "info_credibility": "2",
  "tags": [
    "Russia",
    "Sweden",
    "SÄPO",
    "sabotage",
    "hybrid tactics",
    "cyberattacks",
    "intelligence operations",
    "disinformation",
    "threats",
    "NATO",
    "security"
  ],
  "nodes": [
    "Node 2: 5th Column"
  ],
  "countries": [
    "Sweden"
  ],
  "where_text": "Land",
  "headline": "Sweden's SÄPO Reports that Russia is Evolving Sabotage Tactics",
  "description": "Sweden's Security Service (SÄPO) reports that Russia is increasingly evolving its sabotage tactics against Sweden and Europe, combining illegal intelligence activities, cyberattacks, threats, and disinformation campaigns. The SÄPO report indicates the use of hybrid threats by Russia involving illegal intelligence, influence operations, cyberattacks, theft of technology and knowledge, mapping, and threats against opponents. There is also noted an increased Russian risk appetite including threats of sabotage on Swedish soil. This shift follows previously documented covert Russian sabotage attempts against Nordic countries and reflects a growing Russian hybrid war approach. SÄPO highlights that since Sweden's entry into NATO, Russian hostile activities have been more focused on threat assessments against Swedish national security and political sovereignty. Russia's hybrid tactics now target destabilization, misinformation, unrest creation, and a shifting focus against the West. The reporting also underscores cooperation challenges with Russian intelligence, including shadow operations and so-called 'plausible deniability' approaches.",
  "summary_short": "Sweden's SÄPO reports Russian sabotage tactics evolving to include hybrid threats involving cyberattacks, illegal intelligence operations, influence campaigns, and increased sabotage risk within Sweden.",
  "summary_extended": "In its April 2025 report, Sweden's Security Service (SÄPO) highlights a marked evolution in Russian sabotage tactics targeting Sweden and Europe. The tactics combine network espionage, cyberattacks, influence operations, and disinformation campaigns. SÄPO notes an increased Russian appetite for sabotage activities on Swedish soil, including threats and attempts to steal technology and knowledge. These activities are part of a larger hybrid war strategy aiming to destabilize Sweden and its allies. Since Sweden joined NATO, Russian activities have intensified in scope and focus, assessing Sweden as a significant threat to Russian interests. Russian security-threatening activities now blend traditional espionage with hybrid tactics aimed at undermining political sovereignty and creating unrest. The report also details challenges in countering these covert operations due to Russia's use of deniability and shadow networks. SÄPO emphasizes that these developments demonstrate Russia’s ongoing commitment to hybrid warfare against the West.",
  "actor_primary": "Russian intelligence",
  "target_primary": null,
  "location_text": "Stockholm",
  "location_region": null,
  "location_coordinates_lat": 59.3293,
  "location_coordinates_lon": 18.0686,
  "location_precision": "Approximate",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The report is an official public threat assessment from Sweden’s primary security agency, SÄPO, citing specific evolving Russian sabotage tactics involving hybrid and cyber warfare methods observed in and against Sweden with precise dates and detailed disclosures.",
  "event_time_utc": "2025-04-09T21:08:54.000Z",
  "end_time_utc": null,
  "event_time_confidence": "unknown",
  "created_at": "2026-02-17T11:45:00.091Z",
  "updated_at": "2026-11-04T08:35:32.139Z",
  "reliability_band": "strong",
  "location_precision_band": "approximate",
  "time_precision_band": "unknown",
  "severity_band": "significant",
  "attribution_confidence_band": "high",
  "attribution_basis": "independent_sources"
}

{
  "id": "5401b18b-23af-4383-89f1-32fe45be495b",
  "url": "https://sapo.se/ovriga-sidor/other-languages/english-engelska/press-room/news/news/2024-05-30-iran-is-using-criminal-networks-in-sweden.html?amp%3Bsv.12.310a187117da376c66041.route=%2Fapi-search&sv.target=12.310a187117da376c66041",
  "source": "extension",
  "status": "approved",
  "category": "Intelligence & Espionage",
  "subcategory": "Human Intelligence (HUMINT)",
  "incident_type": "Recruitment of locals",
  "country": "Sweden",
  "source_reliability": "A",
  "info_credibility": "2",
  "tags": [
    "Russia",
    "Sweden",
    "SÄPO",
    "sabotage",
    "hybrid tactics",
    "cyberattacks",
    "intelligence operations",
    "disinformation",
    "threats",
    "NATO",
    "security"
  ],
  "nodes": [
    "Node 2: 5th Column"
  ],
  "countries": [
    "Sweden"
  ],
  "where_text": "Land",
  "headline": "Sweden's SÄPO Reports that Russia is Evolving Sabotage Tactics",
  "description": "Sweden's Security Service (SÄPO) reports that Russia is increasingly evolving its sabotage tactics against Sweden and Europe, combining illegal intelligence activities, cyberattacks, threats, and disinformation campaigns. The SÄPO report indicates the use of hybrid threats by Russia involving illegal intelligence, influence operations, cyberattacks, theft of technology and knowledge, mapping, and threats against opponents. There is also noted an increased Russian risk appetite including threats of sabotage on Swedish soil. This shift follows previously documented covert Russian sabotage attempts against Nordic countries and reflects a growing Russian hybrid war approach. SÄPO highlights that since Sweden's entry into NATO, Russian hostile activities have been more focused on threat assessments against Swedish national security and political sovereignty. Russia's hybrid tactics now target destabilization, misinformation, unrest creation, and a shifting focus against the West. The reporting also underscores cooperation challenges with Russian intelligence, including shadow operations and so-called 'plausible deniability' approaches.",
  "summary_short": "Sweden's SÄPO reports Russian sabotage tactics evolving to include hybrid threats involving cyberattacks, illegal intelligence operations, influence campaigns, and increased sabotage risk within Sweden.",
  "summary_extended": "In its April 2025 report, Sweden's Security Service (SÄPO) highlights a marked evolution in Russian sabotage tactics targeting Sweden and Europe. The tactics combine network espionage, cyberattacks, influence operations, and disinformation campaigns. SÄPO notes an increased Russian appetite for sabotage activities on Swedish soil, including threats and attempts to steal technology and knowledge. These activities are part of a larger hybrid war strategy aiming to destabilize Sweden and its allies. Since Sweden joined NATO, Russian activities have intensified in scope and focus, assessing Sweden as a significant threat to Russian interests. Russian security-threatening activities now blend traditional espionage with hybrid tactics aimed at undermining political sovereignty and creating unrest. The report also details challenges in countering these covert operations due to Russia's use of deniability and shadow networks. SÄPO emphasizes that these developments demonstrate Russia’s ongoing commitment to hybrid warfare against the West.",
  "actor_primary": "Russian intelligence",
  "target_primary": null,
  "location_text": "Stockholm",
  "location_region": null,
  "location_coordinates_lat": 59.3293,
  "location_coordinates_lon": 18.0686,
  "location_precision": "Approximate",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The report is an official public threat assessment from Sweden’s primary security agency, SÄPO, citing specific evolving Russian sabotage tactics involving hybrid and cyber warfare methods observed in and against Sweden with precise dates and detailed disclosures.",
  "event_time_utc": "2025-04-09T21:08:54.000Z",
  "end_time_utc": null,
  "event_time_confidence": "unknown",
  "created_at": "2026-02-17T11:45:00.091Z",
  "updated_at": "2026-11-04T08:35:32.139Z",
  "reliability_band": "strong",
  "location_precision_band": "approximate",
  "time_precision_band": "unknown",
  "severity_band": "significant",
  "attribution_confidence_band": "high",
  "attribution_basis": "independent_sources"
}