Russia is waging a hybrid sabotage campaign across Europe targeting infrastructure and security, using proxies with criminal backgrounds to strain European law enforcement and intelligence resources.

Military & Paramilitary OperationsUnconventional / ParamilitaryUnknown

Aggressor

Summary

Since 2022, Russia has conducted a widespread sabotage campaign across Europe involving at least 145 documented incidents, including attacks on railway infrastructure in Poland, arson, vandalism, explosives plots, and cyberattacks. The campaign aims to destabilize European support for Ukraine, produce divisions, and strain security resources. Russia uses proxies with criminal backgrounds to execute these operations, outsourcing to reduce risk to trained intelligence officers. Countries most targeted are those bordering Russia such as Poland, Estonia, Latvia, as well as the U.K., Germany, and France. Poland deployed 10,000 troops to protect infrastructure after a November 2025 rail attack. Notably, six explosions and 26 arson incidents were recorded in 2024, with continued activity into 2025. Incidents frequently involve cross-border perpetrators, complicating investigations and requiring multinational cooperation. Russia’s ally Belarus has engaged in hybrid tactics including smuggling disruptive weather balloons carrying cigarettes into Lithuania and Poland. Despite many plots being foiled or causing limited physical damage, the campaign imposes a heavy resource burden across European intelligence and security services, while costing Russia very little.

Classification

Confidence: High

The article provides multiple confirmed cases of sabotage and subversion linked by Western officials to Russian state intelligence (GRU), with a clear motive to destabilize European support for Ukraine and strain security services at minimal cost to Russia. The pattern of multifaceted covert operations combined with proxy use fits authoritative definitions of hostile hybrid warfare.

Source URL

https://insurancejournal.com/news/international/2025/12/19/851745.htm

Open source

Provenance

Publisher: extension
Submitted: Feb 13, 2026, 19:25 UTC
Last updated: Nov 8, 2026, 20:49 UTC
Event time: Nov 1, 2025, 00:00 UTC

Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "615bdf8a-8d8b-4385-82bc-bdb8b2b1b54c",
  "url": "https://insurancejournal.com/news/international/2025/12/19/851745.htm",
  "source": "extension",
  "status": "approved",
  "category": "Military & Paramilitary Operations",
  "subcategory": "Unconventional / Paramilitary",
  "incident_type": "Unknown",
  "country": "Poland",
  "source_reliability": "C",
  "info_credibility": "3",
  "tags": [
    "Russia",
    "Sabotage",
    "Hybrid Warfare",
    "GRU",
    "Cross-border Attacks",
    "Poland",
    "Estonia",
    "Latvia",
    "Ukraine Support",
    "European Security",
    "Arson",
    "Explosives",
    "Criminal Proxies",
    "Belarus",
    "Weather Balloons"
  ],
  "nodes": [],
  "countries": [
    "Poland"
  ],
  "where_text": "Land",
  "headline": null,
  "description": "Since 2022, Russia has conducted a widespread sabotage campaign across Europe involving at least 145 documented incidents, including attacks on railway infrastructure in Poland, arson, vandalism, explosives plots, and cyberattacks. The campaign aims to destabilize European support for Ukraine, produce divisions, and strain security resources. Russia uses proxies with criminal backgrounds to execute these operations, outsourcing to reduce risk to trained intelligence officers. Countries most targeted are those bordering Russia such as Poland, Estonia, Latvia, as well as the U.K., Germany, and France. Poland deployed 10,000 troops to protect infrastructure after a November 2025 rail attack. Notably, six explosions and 26 arson incidents were recorded in 2024, with continued activity into 2025. Incidents frequently involve cross-border perpetrators, complicating investigations and requiring multinational cooperation. Russia’s ally Belarus has engaged in hybrid tactics including smuggling disruptive weather balloons carrying cigarettes into Lithuania and Poland. Despite many plots being foiled or causing limited physical damage, the campaign imposes a heavy resource burden across European intelligence and security services, while costing Russia very little.",
  "summary_short": "Russia is waging a hybrid sabotage campaign across Europe targeting infrastructure and security, using proxies with criminal backgrounds to strain European law enforcement and intelligence resources.",
  "summary_extended": null,
  "actor_primary": "Russian military intelligence (GRU)",
  "target_primary": null,
  "location_text": "Eastern Poland",
  "location_region": null,
  "location_coordinates_lat": 51.3,
  "location_coordinates_lon": 22,
  "location_precision": "Approximate",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The article provides multiple confirmed cases of sabotage and subversion linked by Western officials to Russian state intelligence (GRU), with a clear motive to destabilize European support for Ukraine and strain security services at minimal cost to Russia. The pattern of multifaceted covert operations combined with proxy use fits authoritative definitions of hostile hybrid warfare.",
  "event_time_utc": "2025-11-01T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "unknown",
  "created_at": "2026-02-13T19:25:08.516Z",
  "updated_at": "2026-11-08T20:49:02.070Z",
  "reliability_band": "strong",
  "location_precision_band": "approximate",
  "time_precision_band": "unknown",
  "severity_band": "moderate",
  "attribution_confidence_band": "high",
  "attribution_basis": "single_source"
}

Public assessmentReliability: StrongSeverity: ModerateAttribution: HighSingle sourceTime: UnknownLocation: Approximate

Source reliability

Info credibility

Event time

Nov 1, 2025, 00:00 UTC

Event time confidence

unknown

Location

Eastern Poland

Primary actor

Russian military intelligence (GRU)

Country

Poland

Countries

Poland

Tags

Russia, Sabotage, Hybrid Warfare, GRU, Cross-border Attacks, Poland, Estonia, Latvia, Ukraine Support, European Security, Arson, Explosives, Criminal Proxies, Belarus, Weather Balloons

Loading signal...

{ "id": "615bdf8a-8d8b-4385-82bc-bdb8b2b1b54c", "url": "https://insurancejournal.com/news/international/2025/12/19/851745.htm", "source": "extension", "status": "approved", "category": "Military & Paramilitary Operations", "subcategory": "Unconventional / Paramilitary", "incident_type": "Unknown", "country": "Poland", "source_reliability": "C", "info_credibility": "3", "tags": [ "Russia", "Sabotage", "Hybrid Warfare", "GRU", "Cross-border Attacks", "Poland", "Estonia", "Latvia", "Ukraine Support", "European Security", "Arson", "Explosives", "Criminal Proxies", "Belarus", "Weather Balloons" ], "nodes": [], "countries": [ "Poland" ], "where_text": "Land", "headline": null, "description": "Since 2022, Russia has conducted a widespread sabotage campaign across Europe involving at least 145 documented incidents, including attacks on railway infrastructure in Poland, arson, vandalism, explosives plots, and cyberattacks. The campaign aims to destabilize European support for Ukraine, produce divisions, and strain security resources. Russia uses proxies with criminal backgrounds to execute these operations, outsourcing to reduce risk to trained intelligence officers. Countries most targeted are those bordering Russia such as Poland, Estonia, Latvia, as well as the U.K., Germany, and France. Poland deployed 10,000 troops to protect infrastructure after a November 2025 rail attack. Notably, six explosions and 26 arson incidents were recorded in 2024, with continued activity into 2025. Incidents frequently involve cross-border perpetrators, complicating investigations and requiring multinational cooperation. Russia’s ally Belarus has engaged in hybrid tactics including smuggling disruptive weather balloons carrying cigarettes into Lithuania and Poland. Despite many plots being foiled or causing limited physical damage, the campaign imposes a heavy resource burden across European intelligence and security services, while costing Russia very little.", "summary_short": "Russia is waging a hybrid sabotage campaign across Europe targeting infrastructure and security, using proxies with criminal backgrounds to strain European law enforcement and intelligence resources.", "summary_extended": null, "actor_primary": "Russian military intelligence (GRU)", "target_primary": null, "location_text": "Eastern Poland", "location_region": null, "location_coordinates_lat": 51.3, "location_coordinates_lon": 22, "location_precision": "Approximate", "is_aggressor_signal": true, "signal_type": "HYBRID_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "The article provides multiple confirmed cases of sabotage and subversion linked by Western officials to Russian state intelligence (GRU), with a clear motive to destabilize European support for Ukraine and strain security services at minimal cost to Russia. The pattern of multifaceted covert operations combined with proxy use fits authoritative definitions of hostile hybrid warfare.", "event_time_utc": "2025-11-01T00:00:00.000Z", "end_time_utc": null, "event_time_confidence": "unknown", "created_at": "2026-02-13T19:25:08.516Z", "updated_at": "2026-11-08T20:49:02.070Z", "reliability_band": "strong", "location_precision_band": "approximate", "time_precision_band": "unknown", "severity_band": "moderate", "attribution_confidence_band": "high", "attribution_basis": "single_source" }