Russia’s suspected sabotage campaign across Europe appears to be gathering pace again, confronting governments with a problem they have struggled to solve since the start of the war in Ukraine: how to impose a meaningful cost on Moscow for attacks that remain deliberately below the threshold of conventional war.
Over the past month alone, an explosives-laden drone was discovered next to a Ukrainian cargo plane at Germany’s Leipzig airport, Poland has faced suspected acts of sabotage, and a string of unexplained explosions and fires have hit defence facilities supplying Ukraine across Europe.
The attacks, aimed at sowing chaos and undermining support for Ukraine, vary widely in their ambition and sophistication, but share a common feature: they are often difficult to trace conclusively back to Moscow.
That ambiguity is built into the way the operations are organised. Russian intelligence services have shifted away from relying primarily on professional operatives dispatched across Europe. Instead, suspected saboteurs are increasingly recruited remotely, including through Telegram channels, and paid in cryptocurrency to carry out individual tasks – allowing the Russian intelligence officers directing them to remain safely at home.
The pattern was evident in Denmark this week, where authorities warned that Moscow was recruiting Danish citizens to carry out sabotage against defence companies with ties to Ukraine.
But the growing scale of the attacks, and the speed with which European governments are now prepared to point the finger at Moscow, suggest the mood may be changing.
When an incendiary parcel burst into flames at DHL’s Leipzig hub in July ۲۰۲۴, it took about nine months before German investigators reported a concrete link to the GRU, Russia’s military intelligence agency.
This time, Berlin moved far faster. Within days of the second incident at Leipzig airport, German officials publicly blamed Moscow – a sign both of growing confidence in identifying Russian operations and diminishing patience with what officials see as an increasingly brazen campaign of sabotage.
Yet while Berlin has become quicker to point the finger at Moscow, its punishment for now has followed a more cautious path.
Germany’s response to the failed Leipzig drone attack appeared calibrated to keep tensions in check, underscoring the harder question of what Europe can actually do beyond sanctions and diplomatic expulsions without risking a direct military confrontation.
Berlin announced the closure of a Russian cultural centre and a Russian consulate, prompting Moscow to shut down the already gutted Goethe-Institut – a measured retaliation rather than a real escalation.
Europe’s room for retaliation is also constrained by the powers given to its intelligence agencies. Unlike the CIA, many European services are primarily tasked with collecting intelligence and have far less latitude to conduct covert operations abroad. That leaves governments with relatively few tools between diplomatic and economic punishment on one end of the spectrum and overt military action on the other. To counter the shortcoming, several EU states, including the Netherlands, have recently put forward bills that would greatly expand the surveillance powers of the country’s intelligence agencies
One area where Europe can point to more tangible action is its growing willingness to detain vessels linked to Russia’s shadow fleet. On Wednesday, Norwegian authorities seized a Russian vessel in the Arctic archipelago of Svalbard at Ukraine’s request.
But critics argue that such measures are still not enough to deter Moscow.
“Every time we do nothing, we invite Putin to continue,” said one EU lawmaker, speaking on condition of anonymity.
That argument has been made most forcefully by Poland and the Baltic states, which have consistently pushed their western European allies to take a harder line against Moscow.
“Hybrid war is not just a nuisance on the internet,” the Polish foreign minister, Radosław Sikorski, said on Thursday. “Hybrid war means assassination squads, it means arsonists, it means blowing up moving trains, like in Poland, it means breaches of airspace with drones and cruise missiles.”
“We need to convince Putin that such actions are not for free,” he added.
At the same time, Sikorski also appeared to acknowledge, somewhat jokingly, the limits of Europe’s existing toolkit. Recalling Poland’s response to previous suspected Russian operations, he said: “Every time Russia committed arson or tried to blow up a moving train … I closed one Russian consulate, but I ran out of consulates to close.”
Jakub Krupa contributed reporting
