Russia has escalated sabotage targeting NATO civilian infrastructure and logistics since 2022, probing vulnerabilities in European transport and supply chains as part of a covert hybrid war. The paper calls for NATO to strengthen rail networks, diversify transport, improve intelligence security, enhance coordination, and prepare for further escalation.

Military & Paramilitary OperationsUnconventional / ParamilitaryProxy forces, militias, mercenaries (e.g. Wagner-type groups)

Aggressor

Summary

This insight paper by Emily Ferris from the Royal United Services Institute analyzes Russia's escalating sabotage operations targeting civilian infrastructure and logistics in European NATO countries since the 2022 invasion of Ukraine. The paper discusses strategic aims behind these attacks, their evolution, and vulnerabilities exposed in NATO's transport and supply chains. It highlights the need for NATO to address weaknesses in rail networks, diversify transport modes, enhance human intelligence security, improve cross-border logistics coordination, and prepare for potential escalation of covert sabotage activities by Russia. The sabotage is part of a broader 'shadow war' aimed at increasing costs and discord within NATO, probing NATO's red lines without provoking military response. The paper underscores the strategic importance of addressing these NATO vulnerabilities to ensure Alliance readiness for future conflicts, especially on the Eastern flank.

Classification

Confidence: High

The paper explicitly attributes sabotage activities disrupting NATO allied infrastructure and logistics to Russia as part of an escalating covert campaign aligned with hybrid warfare tactics. The use of proxies, cyber and physical sabotage, and strategic targeting of military supply chains supports classification as an aggressive hybrid warfare signal.

Source URL

https://rusi.org/explore-our-research/publications/insights-papers/russian-sabotage-nato-infrastructure-identifying-alliance-vulnerabilities

Open source

Provenance

Publisher: extension
Submitted: Sep 28, 2026, 07:04 UTC
Last updated: Nov 15, 2026, 02:40 UTC
Event time: Feb 24, 2022, 00:00 UTC

Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "a58489df-73b2-46a8-b8a3-7c3f10b985e0",
  "url": "https://rusi.org/explore-our-research/publications/insights-papers/russian-sabotage-nato-infrastructure-identifying-alliance-vulnerabilities",
  "source": "extension",
  "status": "processed",
  "category": "Military & Paramilitary Operations",
  "subcategory": "Unconventional / Paramilitary",
  "incident_type": "Proxy forces, militias, mercenaries (e.g. Wagner-type groups)",
  "country": "Unknown",
  "source_reliability": "F",
  "info_credibility": "6",
  "tags": [
    "Russia",
    "NATO",
    "Sabotage",
    "Hybrid Warfare",
    "Civilian Infrastructure",
    "Military Logistics",
    "Eastern Europe",
    "Transport Networks"
  ],
  "nodes": [],
  "countries": [],
  "where_text": "Land",
  "headline": null,
  "description": "This insight paper by Emily Ferris from the Royal United Services Institute analyzes Russia's escalating sabotage operations targeting civilian infrastructure and logistics in European NATO countries since the 2022 invasion of Ukraine. The paper discusses strategic aims behind these attacks, their evolution, and vulnerabilities exposed in NATO's transport and supply chains. It highlights the need for NATO to address weaknesses in rail networks, diversify transport modes, enhance human intelligence security, improve cross-border logistics coordination, and prepare for potential escalation of covert sabotage activities by Russia. The sabotage is part of a broader 'shadow war' aimed at increasing costs and discord within NATO, probing NATO's red lines without provoking military response. The paper underscores the strategic importance of addressing these NATO vulnerabilities to ensure Alliance readiness for future conflicts, especially on the Eastern flank.",
  "summary_short": "Russia has escalated sabotage targeting NATO civilian infrastructure and logistics since 2022, probing vulnerabilities in European transport and supply chains as part of a covert hybrid war. The paper calls for NATO to strengthen rail networks, diversify transport, improve intelligence security, enhance coordination, and prepare for further escalation.",
  "summary_extended": null,
  "actor_primary": "Russian proxies and third parties",
  "target_primary": null,
  "location_text": "European NATO countries",
  "location_region": null,
  "location_coordinates_lat": 54.526,
  "location_coordinates_lon": 15.2551,
  "location_precision": "Regional",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The paper explicitly attributes sabotage activities disrupting NATO allied infrastructure and logistics to Russia as part of an escalating covert campaign aligned with hybrid warfare tactics. The use of proxies, cyber and physical sabotage, and strategic targeting of military supply chains supports classification as an aggressive hybrid warfare signal.",
  "event_time_utc": "2022-02-24T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "pm24h",
  "created_at": "2026-09-28T07:04:04.131Z",
  "updated_at": "2026-11-15T02:40:15.742Z",
  "reliability_band": "pattern",
  "location_precision_band": "regional",
  "time_precision_band": "within_24h",
  "severity_band": "moderate",
  "attribution_confidence_band": "high",
  "attribution_basis": "single_source"
}

Public assessmentReliability: Pattern fitSeverity: ModerateAttribution: HighSingle sourceTime: Same dayLocation: Regional

Source reliability

Info credibility

Event time

Feb 24, 2022, 00:00 UTC

Event time confidence

pm24h

Location

European NATO countries

Primary actor

Russian proxies and third parties

Country

Unknown

Tags

Russia, NATO, Sabotage, Hybrid Warfare, Civilian Infrastructure, Military Logistics, Eastern Europe, Transport Networks

Loading signal...

{ "id": "a58489df-73b2-46a8-b8a3-7c3f10b985e0", "url": "https://rusi.org/explore-our-research/publications/insights-papers/russian-sabotage-nato-infrastructure-identifying-alliance-vulnerabilities", "source": "extension", "status": "processed", "category": "Military & Paramilitary Operations", "subcategory": "Unconventional / Paramilitary", "incident_type": "Proxy forces, militias, mercenaries (e.g. Wagner-type groups)", "country": "Unknown", "source_reliability": "F", "info_credibility": "6", "tags": [ "Russia", "NATO", "Sabotage", "Hybrid Warfare", "Civilian Infrastructure", "Military Logistics", "Eastern Europe", "Transport Networks" ], "nodes": [], "countries": [], "where_text": "Land", "headline": null, "description": "This insight paper by Emily Ferris from the Royal United Services Institute analyzes Russia's escalating sabotage operations targeting civilian infrastructure and logistics in European NATO countries since the 2022 invasion of Ukraine. The paper discusses strategic aims behind these attacks, their evolution, and vulnerabilities exposed in NATO's transport and supply chains. It highlights the need for NATO to address weaknesses in rail networks, diversify transport modes, enhance human intelligence security, improve cross-border logistics coordination, and prepare for potential escalation of covert sabotage activities by Russia. The sabotage is part of a broader 'shadow war' aimed at increasing costs and discord within NATO, probing NATO's red lines without provoking military response. The paper underscores the strategic importance of addressing these NATO vulnerabilities to ensure Alliance readiness for future conflicts, especially on the Eastern flank.", "summary_short": "Russia has escalated sabotage targeting NATO civilian infrastructure and logistics since 2022, probing vulnerabilities in European transport and supply chains as part of a covert hybrid war. The paper calls for NATO to strengthen rail networks, diversify transport, improve intelligence security, enhance coordination, and prepare for further escalation.", "summary_extended": null, "actor_primary": "Russian proxies and third parties", "target_primary": null, "location_text": "European NATO countries", "location_region": null, "location_coordinates_lat": 54.526, "location_coordinates_lon": 15.2551, "location_precision": "Regional", "is_aggressor_signal": true, "signal_type": "HYBRID_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "The paper explicitly attributes sabotage activities disrupting NATO allied infrastructure and logistics to Russia as part of an escalating covert campaign aligned with hybrid warfare tactics. The use of proxies, cyber and physical sabotage, and strategic targeting of military supply chains supports classification as an aggressive hybrid warfare signal.", "event_time_utc": "2022-02-24T00:00:00.000Z", "end_time_utc": null, "event_time_confidence": "pm24h", "created_at": "2026-09-28T07:04:04.131Z", "updated_at": "2026-11-15T02:40:15.742Z", "reliability_band": "pattern", "location_precision_band": "regional", "time_precision_band": "within_24h", "severity_band": "moderate", "attribution_confidence_band": "high", "attribution_basis": "single_source" }