How Russia is waging a shadow war against the West. Data analysis
Russia has significantly intensified its campaign of sabotage, subversion, and other hybrid attacks against European countries. These actions aim to destabilize European governments, undermine public support for Ukraine, and weaken NATO's and the European Union's collective ability to respond to Russian aggression. These findings are presented in a new report by the British think tank IISS (International Institute for Strategic Studies), titled "The Scale of Russian Sabotage Operations Against Europe's Critical Infrastructure."
IISS experts have compiled the most comprehensive open-source database on confirmed and suspected Russian sabotage. Using this data, Texty.org.ua created an interactive map that illustrates the geographical distribution and dynamics of these activities.
Russian Hybrid Warfare Operations in Europe (2022–2024)
Each point represents a documented incident of sabotage, influence, or other hybrid activities.
Data: IISS
Hover over a point to see the event type and location.
The number of incidents is growing every year. While in 2022 there were 6 significant episodes, in 2023 this number increased to 13, and in 2024 to 44.
Gig-economy for saboteurs
A key change in Russian intelligence services' tactics occurred after 2022, when European countries expelled hundreds of Russian intelligence officers who had been working under diplomatic cover. This significantly weakened Russia's agent networks.
In response, the Kremlin has adopted a new model that IISS researchers describe as a "giant sabotage economy." Instead of relying on professional GRU or FSB operatives, Russia now actively recruits third-country nationals online, particularly through Telegram, including migrants, criminals, and people just looking for quick cash.
These recruiters are often poorly trained and equipped, making their activities relatively easy to detect. However, their "disposability" and lack of direct ties to Russia allow the Kremlin to avoid responsibility. Their tasks range from minor vandalism to serious sabotage, including arson and attacks on critical infrastructure.
What are Russia's targets?
Russian hybrid attacks mainly target particularly vulnerable critical infrastructure facilities
1. Military logistics
Most of the attacks targeted facilities related to providing military assistance to Ukraine. These include railroad tracks in Poland, which are used by Western equipment; ammunition depots; weapons factories (such as the Diehl plant in Germany, which produces IRIS-T air defense systems); and logistics centers.
2. Energy infrastructure
Submarine cables, gas pipelines, and power plants - European infrastructure, according to the IISS, is vulnerable due to decades of underinvestment and deterioration
3. Civilian sites
Attacks on large shopping centers (such as the arson attack on Marywilska 44 in Warsaw), although not directly military in nature, are designed to spread fear, uncertainty, and increase tension in society.
Europe's weak response
Despite the growing threat, European countries' reactions remain fragmented and insufficiently decisive. Governments often avoid direct accusations against Russia, fearing escalation and lacking absolute evidence for prosecution.
Russia, in turn, operates in the so-called "gray zone" – below the threshold that could provoke a complete military response from NATO. This campaign of destabilization is an integral part of a larger war that the Kremlin is waging against the entire Western world, trying to undermine it from within.
