Companies that produced, transported, or stored materiel destined for Ukraine were a common target of Russian activity. In May 2024, for example, Russian intelligence was likely behind a massive fire at a Diehl Group factory in Berlin, which manufactured IRIS-T surface-to-air missiles used in Ukraine.4 The attackers used electric massagers implanted with a magnesium-based flammable substance to explode bombs at DHL logistics hubs in 2024 near Leipzig, Germany; Birmingham, England; and Jablonow, Poland. These plots may have been a test run to figure out how to get such incendiary devices aboard planes.5 Indeed, Polish prosecutor Katarzyna Calow-Jaszewska concluded that Russia’s goal was to “test the transfer channel for such parcels, which were ultimately to be sent to the United States of America and Canada.”6
Russian intelligence was likely behind other infrastructure attacks in Europe. There was an explosion linked to Russian intelligence at a warehouse in Spain that stored communications equipment bound for Ukraine.7 There was also an explosion in Kazanluk, Bulgaria that killed three people at the plant of Bulgarian defense company Arsenal, which manufactured small arms, artillery pieces, and ammunition. In 2023, explosions went off in the ammunition warehouses of the Bulgarian arms manufacturer and trader EMCO, only days after Bulgaria announced it would officially join the coalition to supply shells to Ukraine.8
Russian security services allegedly targeted specific individuals, including executives from companies involved in aiding Ukraine, journalists that investigated Russian activity, Russian defectors to the West, and government (including Ukrainian) officials. Russian operatives in Spain likely assassinated Maksim Kuzminov, a Russian helicopter pilot who defected to Ukraine from Russia in August 2023. Several months before the attack, Russian state television reported that the GRU had “been given the order” to assassinate Kuzminov.9 Shortly after the assassination, the head of Russia’s foreign intelligence service, Sergei Naryshkin, called Kuzminov a “traitor and criminal” who was a “moral corpse at the very moment when he planned his dirty and terrible crime.”10 In 2024 in Lithuania, Russian intelligence services likely targeted Leonid Volkov, a Russian citizen and former close aide of now-deceased Russian opposition leader Alexei Navalny.11 Another incident involved the vandalization of a car belonging to Estonian Minister of the Interior Lauri Läänemets, who had repeatedly been critical of the Russian war in Ukraine.12 Lithuania’s internal security service assessed that “the Russian special service had coordinated a hybrid operation against the security of [Estonia]” with the goal of spreading fear in the country.13
Russia was also involved in several plots that failed: one in Poland targeting Ukrainian President Volodymyr Zelensky; one in Austria against Bulgarian investigative journalist and director of the Bellingcat investigative reporting group Christo Grozev; one in Germany targeting Armin Papperger, the chief executive officer of Rheinmetall; one in the UK against Russian dissident Evgeny Chichvarkin who was allegedly delivering supplies to Ukraine; and one in France against Vladimir Osechkin, a Russian defector who was involved in exposing human rights abuses in Russian prisons.14
In addition, Russia targeted military bases and other government facilities tied to Ukraine, including locations where NATO military personnel and contractors trained Ukrainian forces. German prosecutors charged three Russian-German nationals—Dieter Schmidt and two accomplices—for acting as secret agents for Russia and plotting bombing and arson attacks against U.S. military bases in Germany. Schmidt allegedly participated in other sabotage plots, including taking pictures of military installations with an aim to endanger national security.15 At the U.S. base in Grafenwoehr, for example, NATO trained Ukrainian troops to operate M1 Abrams main battle tanks.
Maritime, land, and air transportation hubs were a focus of Russian sabotage, including those connected to Ukraine. Germany experienced a series of railway cable-cutting attacks, while Sweden experienced three separate train derailments on its “Iron Ore Line” attributed to Russian actions.16 In addition, Russia conducted multiple attacks against Poland’s rail system, particularly rail lines that transported materiel to Ukraine.17 Russia also targeted airplanes through electronic attack.
Russia conducted attacks against targets in and around two countries—Finland and Sweden—that joined NATO following Russia’s full-scale invasion of Ukraine. Finnish investigators assessed that a Chinese-registered ship operated by a Russian crew damaged two undersea data cables and a gas pipeline in the Baltic Sea with its anchor. The ship was trailed by the Sevmorput, a Russian nuclear-powered cargo ship.18 In addition, an oil tanker likely dragged its anchor and damaged a cable in the Gulf of Finland.19 The Vezhen, a Maltese-flagged ship, damaged an undersea fiber-optic cable linking Latvia and Sweden. Armed police parachutists from Sweden promptly boarded the ship.20 Yet another ship, which had a Russian captain, cut undersea cables in the Baltic Sea off the coast of Sweden and Finland.21
Russia and Belarus weaponized illegal immigrants against several border countries, such as Finland, Poland, Latvia, Lithuania, and Norway. In November 2023, for instance, Finland closed its border with Russia following a surge of border crossings instigated by Russia. In the summer of 2024, Poland experienced a surge of nearly 400 illegal border crossings per day. These border crises were likely orchestrated to pressure state institutions, drain resources, and fuel anti-migrant rhetoric exploited by far-right parties across Europe.22
Finally, Russian services aggressively collected intelligence about potential future targets. Russia flew drones over numerous European countries, including critical infrastructure, defense production facilities, and airports in Germany; airports and other areas in Denmark and Norway; and critical infrastructure in Poland, Romania, Latvia, Lithuania, and Estonia. In Germany, for example, security authorities reported significant intelligence, surveillance, and reconnaissance by drones—some of which they assessed were Russian—over critical infrastructure and military installations, including transit routes and naval, air force, and army bases.23 Some of this activity may have been routine espionage, though some of it was likely intelligence collection for potential future sabotage operations.
Offense and Defense
Russia has engaged in nuclear saber rattling during the Ukraine war as a coercive tool, conducted conventional military operations in Ukraine, and orchestrated sabotage and subversion in Europe. Moving forward, the threat from Russian sabotage in Europe is serious and likely to persist. In response, the United States and Europe should conduct a mix of defensive and offensive measures to strengthen deterrence, mitigate the impact of Russian actions, and impose costs on Russia for a continuing campaign.
Strengthening defenses includes several components. The first is increasing intelligence sharing, reconnaissance, and surveillance between military, intelligence, and law enforcement agencies against Russian sabotage and subversion. Some of this has already occurred. NATO created a Maritime Centre for the Security of Critical Undersea Infrastructure to enhance intelligence collection across member states.24 In addition, Europe and the United States have heightened patrols and surveillance efforts in the Baltic, North, and Mediterranean Seas. NATO established Baltic Sentry and then Eastern Sentry to increase intelligence collection in the air, land, surface, and subsurface domains.25 While useful, NATO countries will need to adapt to Russian changes in strategies and tactics. Russia is developing new uncrewed and autonomous systems, electronic warfare technology, and cyber and space-based capabilities. It is also recruiting using evolving methods, such as using online gaming platforms.
Second, Europe and the United States need to expand capabilities to counter and deter Russian sabotage. Examples include increasing integrated air and missile defense, deploying additional armed drones along Russia’s borders with NATO countries, and expanding counter-drone capabilities for uncrewed and autonomous air, surface, subsurface, and ground systems. The European Union should significantly expedite its efforts to implement several efforts designed to defend against Russian and other external threats: the Eastern Flank Watch, the European Drone Defence Initiative, the European Air Shield, and the European Space Shield.
With help from such countries as China and Iran, the Russian industrial base will likely produce uncrewed systems with longer range, higher payloads, greater autonomy, and more sophisticated capabilities for conducting electronic attack. In some cases, countries may need to conduct kinetic responses to Russian attacks. In September 2025, NATO scrambled Polish F-16 and Dutch F-35 fighter jets over Polish territory and shot down several Russian drones, including armed drones that resembled Shahed attack drones and lightweight Gerbera drones made with foam and plywood.26 Companies in Israel, Europe, the United States, Australia, and other locations have also made progress in developing directed energy systems, which will be helpful to defend against Russian incursions.27 NATO countries should also ease rules on the ability of pilots to shoot down Russian drones.
Third, the United States needs a long-term military presence in Europe focused on NATO’s eastern flank to deter Russian aggression. The United States should establish 4+2 force posture with four brigade combat teams (BCTs) and two regional headquarters. Russia will likely remain a serious threat to the United States and Europe in the foreseeable future. Russian president Vladimir Putin retains the political will and intentions to expand Russian power, and Russia is reconstituting its military capabilities with help from China, Iran, and North Korea. A substantial downsizing of U.S. forces in Europe could significantly weaken deterrence and embolden Russia.28
Along these lines, European militaries need to continuing strengthening their own capabilities to deter Russia and—if deterrence fails—to help fight and win a major power war, particularly because of U.S. interests in the Indo-Pacific. Today, European militaries would likely have difficulty conducting operations at the high end of the conflict continuum without substantial assistance from the United States. European states still lack sufficient capabilities such as: combat support, including short-range air defense and long-range indirect fires; quantity, quality, and capabilities of ground forces, especially heavy maneuver forces; and sufficient quantities of long-range precision strike munitions.
While these defensive measures are necessary, they are not sufficient. Europe and the United States should complement defensive measures with an offensive campaign designed to raise the costs on Moscow. A successful campaign needs to be coercive, and the pain has to appear contingent on Russian behavior. A strategy that does not include raising the costs on Moscow is likely to fail. There are several components of an offensive campaign.
First is imposing additional primary and secondary economic sanctions against Russia and countries that import Russian goods, as well as sanctioning additional entities and individuals involved in sabotage and subversion. Europe has already conducted some useful steps. For example, the European Union sanctioned Nikolay Alexandrovich Korchagin, Vitaly Shevchenko, and Yuriy Fedorovich Denisov—operatives in GRU Unit 29155—for their alleged involvement in cyberattacks targeting Estonia.29 Sanctions should be connected to Russia’s broader war in Ukraine. Russia is grappling with inflation, labor shortages, brain drain and limited paths to economic growth. The country’s economy is exposed in oil and gas, and increased sanctions against Russia’s energy sector would likely cause additional pain. Energy sanctions could be combined with sanctions against other Russian exports, such as minerals, metals, agricultural goods, and fertilizers.
Second is increasing U.S. and European proactive efforts against such targets as Russia’s shadow fleet, which is illegally shipping oil and gas to overseas markets. With U.S. assistance, including intelligence assistance, European governments should board and inspect tankers and other vessels linked to Russia’s shadow fleet. In addition, the United States and Europe should reach out to priority flag states that provide or enable logistical support to the shadow fleet and increase pressure on them to deregister sanctioned vessels. There are likely other useful steps, such as listing and sanctioning insurers and other parts of the shadow fleet ecosystem.
Third, Europe and the United States should expand broader military aid and economic assistance to Ukraine. Taking these steps are important for many reasons. But if one of Russia’s goals in using sabotage is to coerce the United States and Europe from aiding Ukraine, then increasing aid to Ukraine shows that Russia is failing to achieve some of its main goals. Examples of aid include exporting German Taurus missiles, supplying components to help Ukraine’s domestic industry develop and produce long-range missiles (such as Ukraine’s Flamingo ground-launched cruise missile) for deep strike into Russia, and using frozen Russian assets to aid Ukraine. Russia should know that the United States and Europe are willing to raise the costs if Russia continues to wage its conventional and unconventional campaigns.
It would be naive to expect that increased defensive and offensive measures will eliminate Russian aggression. They won’t. But these types of offensive and defensive measures can raise the costs on Russia, minimize the benefits for Moscow, and strengthen deterrence. In the end, that may be good enough.
Please consult the PDF for references.