Since 2022, Russia has conducted a broad sabotage campaign across Europe targeting critical infrastructure, including a November 2025 train attack in eastern Poland, deploying proxies with criminal backgrounds to exhaust European security resources.

Military & Paramilitary OperationsUnconventional / ParamilitaryCross-border raids

Aggressor

Summary

Since Russia’s invasion of Ukraine in 2022, Moscow has orchestrated a widespread sabotage campaign across Europe intended to drain investigative and security resources, disrupt support for Kyiv, and exploit security weaknesses. This campaign includes at least 145 documented incidents such as arson, explosives detonations, vandalism, cyberattacks, and damage to critical infrastructure, including a notable November 2025 attack on a passenger train in eastern Poland where overhead power lines were deliberately damaged causing the train to halt abruptly. The perpetrators, linked to Russian intelligence, often include foreign nationals with criminal records recruited or outsourced by Russia’s GRU and intelligence services to limit risk to operatives. Countries bordering Russia, especially Poland and Estonia, have faced repeated attacks, with coordinated cross-border plots exhausting law enforcement across several nations. Poland responded to the train sabotage by deploying 10,000 troops to protect vital infrastructure. Western officials confirm the campaign intensifies geopolitical pressure with minimal direct cost to Russia, and intelligence cooperation among European states has increased to counteract it. Russian official denials persist. The campaign paused briefly in late 2024 but resumed fully in 2025. This ongoing hybrid warfare strategy tests European security resilience and fosters greater multinational law enforcement collaboration.

Classification

Confidence: High

The source primarily reports on a hostile Russian hybrid warfare sabotage campaign targeting European infrastructure, including a specific November 2025 train sabotage in Poland attributed to Russian intelligence proxies. These details confirm aggressor activity. Although defensive responses (troop deployments, law enforcement cooperation) are mentioned, the main focus is the sabotage incidents themselves, making HYBRID_SIGNAL the appropriate classification.

Source URL

https://apnews.com/projects/russian-europe-sabotage

Open source

Provenance

Publisher: extension
Submitted: Feb 1, 2026, 00:14 UTC
Last updated: Nov 8, 2026, 21:55 UTC
Event time: Nov 1, 2025, 00:00 UTC

Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "c9460386-422a-4658-b72c-d030551badc3",
  "url": "https://apnews.com/projects/russian-europe-sabotage",
  "source": "extension",
  "status": "approved",
  "category": "Military & Paramilitary Operations",
  "subcategory": "Unconventional / Paramilitary",
  "incident_type": "Cross-border raids",
  "country": "Poland",
  "source_reliability": "C",
  "info_credibility": "3",
  "tags": [
    "Russia",
    "sabotage",
    "hybrid warfare",
    "Poland",
    "Estonia",
    "russian intelligence operations",
    "GRU",
    "critical infrastructure",
    "cross-border operations",
    "criminal proxies",
    "Eastern Europe",
    "security services",
    "arson",
    "explosives",
    "russia–ukraine war",
    "European cooperation",
    "train attack",
    "2025"
  ],
  "nodes": [
    "Node 1: Borders",
    "Node 2: 5th Column"
  ],
  "countries": [],
  "where_text": "Land",
  "headline": null,
  "description": "In November 2025, a passenger train carrying nearly 500 people stopped abruptly in eastern Poland after explosives and sabotage disabled overhead lines and damaged railway tracks. Poland attributes the attack to Russian intelligence as part of a broader hybrid warfare sabotage campaign ongoing since Russia's 2022 invasion of Ukraine. This campaign has included at least 145 incidents across Europe involving arson, explosions, vandalism, and cyberattacks aimed at draining security resources, sowing division, and exposing vulnerabilities. Moscow reportedly uses foreign proxies with criminal backgrounds to carry out attacks, reducing risks to its operatives. Poland deployed 10,000 troops to protect critical infrastructure following the Polish train incident. Other targeted countries include Estonia, Latvia, the U.K., Germany, and France. European intelligence services report these sabotage operations overload investigations to the level of terrorism response. Incidents frequently involve multi-country coordination complicating law enforcement efforts. The campaign briefly slowed in late 2024 but resumed in full in 2025, reflecting Moscow’s ongoing hybrid warfare strategy to pressure Europe and Ukraine.",
  "summary_short": "Since 2022, Russia has conducted a broad sabotage campaign across Europe targeting critical infrastructure, including a November 2025 train attack in eastern Poland, deploying proxies with criminal backgrounds to exhaust European security resources.",
  "summary_extended": "Since Russia’s invasion of Ukraine in 2022, Moscow has orchestrated a widespread sabotage campaign across Europe intended to drain investigative and security resources, disrupt support for Kyiv, and exploit security weaknesses. This campaign includes at least 145 documented incidents such as arson, explosives detonations, vandalism, cyberattacks, and damage to critical infrastructure, including a notable November 2025 attack on a passenger train in eastern Poland where overhead power lines were deliberately damaged causing the train to halt abruptly. The perpetrators, linked to Russian intelligence, often include foreign nationals with criminal records recruited or outsourced by Russia’s GRU and intelligence services to limit risk to operatives. Countries bordering Russia, especially Poland and Estonia, have faced repeated attacks, with coordinated cross-border plots exhausting law enforcement across several nations. Poland responded to the train sabotage by deploying 10,000 troops to protect vital infrastructure. Western officials confirm the campaign intensifies geopolitical pressure with minimal direct cost to Russia, and intelligence cooperation among European states has increased to counteract it. Russian official denials persist. The campaign paused briefly in late 2024 but resumed fully in 2025. This ongoing hybrid warfare strategy tests European security resilience and fosters greater multinational law enforcement collaboration.",
  "actor_primary": "Yevgeny Ivanov",
  "target_primary": null,
  "location_text": "Eastern Poland near Mika; incidents also in Poland, Estonia, Latvia, U.K., Germany, France; various European countries",
  "location_region": null,
  "location_coordinates_lat": null,
  "location_coordinates_lon": null,
  "location_precision": "Regional",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The source primarily reports on a hostile Russian hybrid warfare sabotage campaign targeting European infrastructure, including a specific November 2025 train sabotage in Poland attributed to Russian intelligence proxies. These details confirm aggressor activity. Although defensive responses (troop deployments, law enforcement cooperation) are mentioned, the main focus is the sabotage incidents themselves, making HYBRID_SIGNAL the appropriate classification.",
  "event_time_utc": "2025-11-01T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "unknown",
  "created_at": "2026-02-01T00:14:46.746Z",
  "updated_at": "2026-11-08T21:55:44.083Z",
  "reliability_band": "strong",
  "location_precision_band": "regional",
  "time_precision_band": "unknown",
  "severity_band": "moderate",
  "attribution_confidence_band": "high",
  "attribution_basis": "single_source"
}

Public assessmentReliability: StrongSeverity: ModerateAttribution: HighSingle sourceTime: UnknownLocation: Regional

Source reliability

Info credibility

Event time

Nov 1, 2025, 00:00 UTC

Event time confidence

unknown

Location

Eastern Poland near Mika; incidents also in Poland, Estonia, Latvia, U.K., Germany, France; various European countries

Primary actor

Yevgeny Ivanov

Country

Poland

Tags

Russia, sabotage, hybrid warfare, Poland, Estonia, russian intelligence operations, GRU, critical infrastructure, cross-border operations, criminal proxies, Eastern Europe, security services, arson, explosives, russia–ukraine war, European cooperation, train attack, 2025

Nodes

Node 1: Borders, Node 2: 5th Column

Loading signal...

{ "id": "c9460386-422a-4658-b72c-d030551badc3", "url": "https://apnews.com/projects/russian-europe-sabotage", "source": "extension", "status": "approved", "category": "Military & Paramilitary Operations", "subcategory": "Unconventional / Paramilitary", "incident_type": "Cross-border raids", "country": "Poland", "source_reliability": "C", "info_credibility": "3", "tags": [ "Russia", "sabotage", "hybrid warfare", "Poland", "Estonia", "russian intelligence operations", "GRU", "critical infrastructure", "cross-border operations", "criminal proxies", "Eastern Europe", "security services", "arson", "explosives", "russia–ukraine war", "European cooperation", "train attack", "2025" ], "nodes": [ "Node 1: Borders", "Node 2: 5th Column" ], "countries": [], "where_text": "Land", "headline": null, "description": "In November 2025, a passenger train carrying nearly 500 people stopped abruptly in eastern Poland after explosives and sabotage disabled overhead lines and damaged railway tracks. Poland attributes the attack to Russian intelligence as part of a broader hybrid warfare sabotage campaign ongoing since Russia's 2022 invasion of Ukraine. This campaign has included at least 145 incidents across Europe involving arson, explosions, vandalism, and cyberattacks aimed at draining security resources, sowing division, and exposing vulnerabilities. Moscow reportedly uses foreign proxies with criminal backgrounds to carry out attacks, reducing risks to its operatives. Poland deployed 10,000 troops to protect critical infrastructure following the Polish train incident. Other targeted countries include Estonia, Latvia, the U.K., Germany, and France. European intelligence services report these sabotage operations overload investigations to the level of terrorism response. Incidents frequently involve multi-country coordination complicating law enforcement efforts. The campaign briefly slowed in late 2024 but resumed in full in 2025, reflecting Moscow’s ongoing hybrid warfare strategy to pressure Europe and Ukraine.", "summary_short": "Since 2022, Russia has conducted a broad sabotage campaign across Europe targeting critical infrastructure, including a November 2025 train attack in eastern Poland, deploying proxies with criminal backgrounds to exhaust European security resources.", "summary_extended": "Since Russia’s invasion of Ukraine in 2022, Moscow has orchestrated a widespread sabotage campaign across Europe intended to drain investigative and security resources, disrupt support for Kyiv, and exploit security weaknesses. This campaign includes at least 145 documented incidents such as arson, explosives detonations, vandalism, cyberattacks, and damage to critical infrastructure, including a notable November 2025 attack on a passenger train in eastern Poland where overhead power lines were deliberately damaged causing the train to halt abruptly. The perpetrators, linked to Russian intelligence, often include foreign nationals with criminal records recruited or outsourced by Russia’s GRU and intelligence services to limit risk to operatives. Countries bordering Russia, especially Poland and Estonia, have faced repeated attacks, with coordinated cross-border plots exhausting law enforcement across several nations. Poland responded to the train sabotage by deploying 10,000 troops to protect vital infrastructure. Western officials confirm the campaign intensifies geopolitical pressure with minimal direct cost to Russia, and intelligence cooperation among European states has increased to counteract it. Russian official denials persist. The campaign paused briefly in late 2024 but resumed fully in 2025. This ongoing hybrid warfare strategy tests European security resilience and fosters greater multinational law enforcement collaboration.", "actor_primary": "Yevgeny Ivanov", "target_primary": null, "location_text": "Eastern Poland near Mika; incidents also in Poland, Estonia, Latvia, U.K., Germany, France; various European countries", "location_region": null, "location_coordinates_lat": null, "location_coordinates_lon": null, "location_precision": "Regional", "is_aggressor_signal": true, "signal_type": "HYBRID_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "The source primarily reports on a hostile Russian hybrid warfare sabotage campaign targeting European infrastructure, including a specific November 2025 train sabotage in Poland attributed to Russian intelligence proxies. These details confirm aggressor activity. Although defensive responses (troop deployments, law enforcement cooperation) are mentioned, the main focus is the sabotage incidents themselves, making HYBRID_SIGNAL the appropriate classification.", "event_time_utc": "2025-11-01T00:00:00.000Z", "end_time_utc": null, "event_time_confidence": "unknown", "created_at": "2026-02-01T00:14:46.746Z", "updated_at": "2026-11-08T21:55:44.083Z", "reliability_band": "strong", "location_precision_band": "regional", "time_precision_band": "unknown", "severity_band": "moderate", "attribution_confidence_band": "high", "attribution_basis": "single_source" }