Summary

Russia is likely ramping up its sabotage operations across Europe, targeting critical infrastructure to destabilize NATO allies and disrupt their support for Ukraine. Recent incidents, including break-ins at water treatment facilities in Finland and explosions at arms factories in Poland, highlight Russia’s use of “gray zone” tactics to undermine Western military, economic, and political capabilities without crossing the threshold of open conflict. Insikt Group’s analysis identifies a pattern of Russian hybrid warfare involving covert operatives, agent networks, and plausible deniability tactics that echo Soviet-era sabotage strategies. With these tactics, Russia aims to degrade NATO’s capacity to support Ukraine, increase internal tensions, and strain emergency resources.

Russian Sabotage Activities Escalate Amid Fraught Tensions

As tensions between Russia and NATO remain high, Russia is very likely expanding its sabotage operations across Europe, with a focus on undermining NATO’s support for Ukraine. These covert activities align with Russia’s broader hybrid warfare strategy, aiming to destabilize NATO countries, weaken their military capabilities, and strain political alliances. Recent incidents analyzed by Insikt Group reveal the calculated and persistent nature of Russian sabotage, using covert operatives, agent networks, and plausible deniability to avoid direct attribution.

Objectives

Since Russia’s invasion of Ukraine in 2022, European governments have increasingly reported suspected sabotage activities linked to Russia. This “gray zone” warfare includes operations that damage critical infrastructure without escalating to open conflict. Russia perceives itself as being in a “passive phase of war” with NATO countries due to their military support for Ukraine, thus justifying these low-profile but effective actions as part of a broader strategy to weaken adversaries.

Recent Incidents of Sabotage

In June 2024, Insikt Group identified several incidents across six European countries bordering Russia that align with Russian sabotage tactics:

• Finland: Break-ins at water treatment facilities were reported, raising concerns about potential contamination and public safety risks. These breaches are indicative of economic sabotage targeting essential resources.
• Poland: Explosions at the Mesko arms factory and fires at the Broad Gauge Metallurgy Line transshipment terminal caused significant disruptions. Given the strategic importance of these facilities in supplying arms to Ukraine, these incidents are likely intended to hinder NATO’s logistical support to Ukraine.
• Norway: Multiple arson attacks on vehicles and fires at critical transport hubs have disrupted infrastructure, increasing operational strain on local authorities.

These incidents exemplify Russia’s likely objectives: to degrade NATO's operational readiness, overwhelm emergency response systems, and create an atmosphere of insecurity among European populations.

Russian Sabotage Tactics

Russian sabotage activities rely on techniques that ensure plausible deniability. Intelligence networks recruit agents, often disaffected individuals or groups, who can execute these operations without drawing direct links to the Russian state. For example, covert operatives may infiltrate target nations under civilian covers, such as tourists or diplomats, or recruit local agents to avoid suspicion.

Russian sabotage tactics can be categorized into three groups:

• Economic sabotage: Targeting infrastructure essential to economic stability, such as water treatment facilities and supply chains
• Military sabotage: Disrupting arms production, transportation, and military readiness through attacks on weapons factories or logistics hubs
• Political destabilization: Amplifying socio-political divisions and instilling fear within local populations by creating a persistent threat of sabotage

Legacy of Soviet-Era Sabotage Strategies

Russian sabotage objectives today are largely consistent with Soviet-era strategies, as detailed by defector accounts and declassified documents. The Soviet Union frequently deployed covert operatives to weaken adversaries before and during conflicts. Today, Russian operatives continue to use cover identities, recruit agents, and employ rudimentary means (like arson or improvised explosives) to maintain plausible deniability. This continuity highlights the enduring influence of Soviet military doctrines in Russia’s current approach to hybrid warfare.

Mitigations

To counter the growing threat of Russian sabotage, NATO and its member states should strengthen infrastructure security and improve intelligence-sharing mechanisms across borders. Key steps include:

• Use Recorded Future® Intelligence Cloud’s Facility Risk feature to monitor notable events occurring in close proximity to critical infrastructure facilities.
• Use the Recorded Future Intelligence Cloud to track potential Russian sabotage events and monitor commonly used tactics.
• Enhance national and local counterintelligence, surveillance, and physical security monitoring measures around critical infrastructure, such as those identified in previously documented Russian sabotage operations.
• Increase cooperation and intelligence-sharing among European nations on Russian sabotage activities and collaborate on identifying transnational Russian agent networks.
• Monitor for signs of escalating Russian hybrid activities, such as sudden upticks in unexplained accidents or environmental incidents, and communicate risks to relevant businesses and industries.

Outlook

Russia’s sabotage activities are unlikely to wane as tensions with NATO continue. As hybrid warfare evolves, so too will Russian tactics, with an increased emphasis on leveraging emerging technologies and maintaining deniability. The stakes for European security are high; Russian sabotage has the potential to not only disrupt essential services but also create political instability and weaken public trust in governments’ ability to protect their citizens.

To read the entire analysis, click here to download the report as a PDF.