A twenty-year-old British man, Dylan Earl, set fire to a London warehouse containing cargo for Ukraine. He never met his handler — only corresponded with him via Telegram. According to CNN, he was recruited through pro-Russian chats where announcements for "work" look like ordinary freelance jobs. This is not an exception — it is a model.

Four times more in a year

The International Institute for Strategic Studies (IISS) has documented that the number of Russian sabotage operations in Europe has increased nearly fourfold from 2023 to 2024. According to data from Associated Press, which analyzed 145 documented incidents, arsons and explosions alone jumped from one case in 2023 to 26 in 2024. Half of all incidents since 2014 occurred in 2024 alone.

The cost to the Kremlin is negligible. Operatives — often petty criminals, migrants, or people in debt — receive a few hundred euros for a "simple task." They do not know the client, have no weapons, and do not cross borders with intelligence credentials.

"The typical scheme is: a small task is given, payment arrives. A person gets drawn in. But as tasks become more complex, they move on to executing the main objective. This is essentially a model of criminal outsourcing that Russian intelligence services have adapted for sabotage operations."

Viktor Yagun, Major General (ret.) of the SBU, former Deputy Head of the SBU (2014–2015) — UNIAN

"Gray zone" — this is not chaos, it is architecture

Deliberately blurring the line between criminal crime and state terrorism is not a side effect, but a constructive advantage. While investigators determine whether it is an ordinary arson or sabotage, time passes, intelligence resources are spent, and responsibility remains in the "gray zone."

Yagun acknowledges that some European intelligence services have begun working more proactively than two years ago. But "not yet well enough for a long war." The data confirms this: according to analytical company Dragonfly, suspicious hybrid incidents in Europe in just the first months of 2025 already exceed the total for all of 2024.

RUSI analysts point to an additional effect: Russia deliberately recruits Ukrainians to carry out sabotage in Poland and other countries — from 2023 to 2025 they made up the largest share of suspects detained in Poland. This is no coincidence: undermining trust in Ukrainians in Europe is a separate objective of the operation.

GRU without officers on the ground

Following mass expulsions of Russian diplomat-intelligence officers after 2022, the GRU restructured its logistics. As the analytical center hozint.com notes, recruitment now occurs remotely — through encrypted messengers and Russian-language job boards. The officer never appears on the ground. Operatives are forced to film the sabotage on video — as proof of completion, not as bravado.

• Arsons and explosions: 1 case in 2023 → 26 in 2024 (AP)
• Bridges and railways: European intelligence services are detecting reconnaissance of sites — agents examined automobile bridges, according to Financial Times
• Cables: at least 11 submarine cables in the Baltic and North Seas have been damaged since the beginning of 2024
• Damage: according to S&P Global Market Intelligence estimates — hundreds of millions of euros in physical damage from 2022–2025

Leading Russia analyst Mark Galeotti explained to CNN that such networks are effectively "embedded in the Russian state" — but with sufficient distance for the Kremlin to deny involvement.

In the first half of 2025, the pace of attacks has slowed somewhat — Bloomberg attributes this partly to operative incompetence and reorientation of resources toward sabotage within Ukraine. But intelligence services warn: a pause does not mean retreat.

If Russia is truly testing a "pre-war phase" — reconnaissance of bridges and railways — then the question is not whether Europe has improved its response, but whether it will manage to build a common counterintelligence architecture before the next wave strikes not at a warehouse with cargo, but at critical infrastructure.