Russian intelligence is running a covert sabotage campaign in Europe using remotely recruited operatives hired online to conduct arson and propaganda to destabilize Western support for Ukraine and sow insecurity.

This article reveals an ongoing campaign by Russian intelligence services to conduct sabotage, arson, and disinformation operations across multiple European countries. The operations are conducted through online recruitment of operatives, often hired via Telegram and paid in cryptocurrency, to carry out violent but piecemeal actions such as arson attacks on civilian infrastructure and distribution of propaganda. The campaign targets various European states including Poland, Lithuania, Estonia, Britain, and France, with incidents ranging from shopping mall fires in Warsaw and Vilnius, arson attacks on Ukraine-linked businesses in London, to symbolic acts like placing coffins under the Eiffel Tower in Paris. Recruits are frequently marginalized individuals or refugees who may be unaware that they serve Moscow's interests, motivated primarily by money or blackmail rather than ideology. The operations are directed remotely by GRU officers using fake identities; operatives are disposable, left to face consequences alone if caught. The sabotage wave reflects an evolution from earlier GRU Unit 29155 operations which were more targeted and brazen; now the aim is broader psychological impact to sow discord and insecurity. A notable thwarted plot involved mailing explosive parcels to the US. The campaign exhibits challenges in attribution due to its indirect and covert nature, but Western intelligence maintains strong suspicions of Moscow’s involvement.