From graffiti to bombs: the evolution of Russia’s “shadow war” against NATO

Arson attacks on weapons depots linked to Ukraine. Surveillance cameras targeted at NATO training sites for Ukrainian troops. Vandalism of government vehicles. Even an apparent but failed bombing.

Russia has been engaged in a “bold” sabotage operation against NATO member states for more than six months, targeting arms supply lines to Ukraine and the lawmakers behind them, according to a senior NATO official.

Several security officials across Europe describe a threat that is multiplying as Russian agents, increasingly under scrutiny from security services and frustrated in their own operations, hire local amateurs to carry out high-risk, and often deniable, crimes on their behalf.

The NATO official said they had observed “an unprecedented escalation and spread of Russia’s hybrid warfare” over the past six months, which included “physical sabotage” of NATO’s arms supply line to Ukraine.

“It’s everything from the point of production and origin, to storage, to those who are making decisions, to the actual delivery,” the senior NATO official said. “It’s brazen. Russia is trying to intimidate (our) allies.”

Russia has dismissed the allegations as unfounded, but Russian sabotage and hybrid warfare will be on the agenda at NATO’s 75th anniversary meeting in Washington, DC, which began on Tuesday (9).

However, it is unclear how publicly member states will express their outrage at what analysts have called the Kremlin’s new “shadow war,” as they may be reluctant to hand Moscow a propaganda victory or raise alarm over a series of security breaches across Europe.

Recent arrests have revealed the last-minute and clumsy nature of how the Kremlin’s intelligence operations have evolved since the start of the war in Ukraine.

Last year, 14 Ukrainians and two Belarusians were arrested in Poland in a case on suspicion of working for Russian intelligence. A Ukrainian, who under Polish privacy law can only be identified as Maxim L., 24, was sentenced to six years after weeks of being given tasks by a Russian handler, Andrzej, whom he had never met physically but encountered on the Telegram messaging app in February 2023.

Andrzej initially paid him $7 in digital currency to spray paint anti-war graffiti across Poland, Maxim said. But the assignments soon took a darker turn.

“Easy money… seemed so insignificant”

In a rare interview with CNN Inside the maximum security wing of Lublin prison, Maxim said he fled Ukraine for Poland in a failed attempt to escape unemployment and poverty. “It was easy money,” he said of the job offered by Andrzej. “I needed the money badly.”

He said he felt no obligation to fight for Ukraine after Russia invaded in February 2022. “That country has never done anything for me,” he said. “I don’t believe that just because you were born in a certain country, you should go to war for it. Don’t get me wrong: I’m not pro-Russia, I’m not pro-Ukraine. I’m not pro-anything.”

Andrzej soon began sending locations for him to place surveillance cameras along the railway tracks near the border town of Medyka, through which military and humanitarian aid flowed into Ukraine. “I didn’t think any of this could cause any real harm. It seemed so insignificant,” he said.

Andrzej later asked him to burn down the fence of a Ukrainian-owned shipping company in the eastern Polish town of Biała Podlaska, he said, which Maxim claims he faked, taking a photograph of the fence with pieces of coal he placed there to mimic fire damage.

However, Maxim’s slow realization that Andrzej was a Russian agent became complete, he said, when he was instructed to place cameras outside a base where Poland was training Ukrainian soldiers.

“That’s when I realized it could be serious,” he said. “It made me feel uncomfortable. That’s when I decided I was going to stop. But I never got the chance. I was arrested the next day.”

Polish internal security agents arrested Maxim on March 3, 2023, after weeks of surveillance, partly triggered by the discovery of a gas station receipt that Maxim accidentally dropped in one of his operations, according to a Polish official.

Several other arrests followed, making it the largest known Russian espionage operation in Poland in recent times, raising concerns in Warsaw about the extent of Moscow’s infiltration.

Two Russian citizens were detained last August on suspicion of recruitment for the Wagner group and a Pole and two Belarusians in May this year for alleged arson.

Another Pole was arrested in April 2024 for possession of ammunition and surveillance at Rzeszow Jasionka airport, a NATO arms hub for Kiev, in an alleged plot to assassinate Ukrainian President Volodymyr Zelensky, who also frequently uses the facility.

The Polish plots join a series of incidents across Europe that, taken together, paint a picture of the broad ambition of Moscow’s operations. Russia was “probably” responsible for an arson attack that hit Poland’s largest shopping mall in May, Prime Minister Donald Tusk said, and suspicions have been raised about another fire at a munitions factory south of the capital in June.

Czech authorities have expressed concerns about Russian involvement in the hacking and disruption of their railways last year.

Last month, a suspicious fire ripped through a weapons manufacturer’s metals factory outside Berlin, and a 26-year-old pro-Russian Ukrainian was arrested after blowing himself up with a homemade bomb near Paris’ Charles de Gaulle airport.

A fire at a warehouse in east London in March led to two men being charged by London’s Metropolitan Police with arson and assisting a foreign intelligence service, namely Russia.

While the incidents were not all definitively linked to Russian intelligence, they were unified by the apparent involvement of amateurs or petty criminality intended to spread fear or disruption.

A “very dangerous game”

The senior NATO official said Russian sabotage of NATO states amounted to a “very dangerous game, if (Russia believes) that these things are always below the threshold of armed conflict” that would not trigger NATO’s Article 5 stipulation that an attack on a member state is an attack on the entire alliance.

“Finding where that line is is a difficult and dangerous calculation to make,” the official said, adding that Russian President Vladimir Putin’s troubled invasion of Ukraine shows the Kremlin chief is not always getting good military advice.

Russia is using the “full range” of hybrid operations, the official added. “We see everything from high-profile operations in Europe, where we’ve seen up to 400,000 euros paid for some kind of intelligence activity, to some places where bad guys are being hired for a few thousand euros.”

A similar threat has grown on Russia’s NATO border in Estonia, where 10 suspected Russian agents were arrested in February after the interior minister’s car was vandalized.

The incident was a high-profile peak in what Estonian authorities said was a years-long campaign by Moscow to destabilize its small NATO neighbor, about a fifth of whose 1.3 million population speaks Russian, according to a 2021 analysis by the European Union.

In recent months, GPS interference has made it difficult for civilian aircraft to land, and even buoys marking part of Russia’s border with Estonia have disappeared, amid a brief call from Moscow for maritime borders to be reassessed.

Harrys Puusepp, spokesman for KAPO, Estonia’s internal security service, told CNN that Russian activities have increased in recent months.

“We saw a significant increase in their activity last autumn, and in the winter, we managed to arrest more than 10[suspects]. The number has grown now – people who were involved in their hybrid activities against Estonian security – in a way we had not seen before.”

He said operations were moving “towards physical attacks” and suggested the war in Ukraine could lead to more aggressive Russian tactics in the coming months if operatives were redeployed to the Baltic areas from the war.

“We have to face facts. Russia is big enough to have the resources to fight a war against Ukraine and also to maintain its security operations against European countries, against us. There are people who participate in the war against Ukraine and then they are rotated to some other region or area. They have more experience. Their mentality is more violent. They may not be as patient anymore trying to get results.”