Fire, drones and graffiti: Russian connection to sabotage across Europe

Explosives were found on the border between Serbia and Hungary, an Ikea store was set on fire in Lithuania, a drone was found at Leipzig airport, a warehouse with equipment for Ukraine was burning in London, and pig heads appeared near mosques in France.

Seemingly unrelated, similar incidents have occurred across Europe in recent years, and what they all have in common is that investigations or authorities in those countries are linking them to Russia.

In Serbia alone, three people have been convicted of spying for Russia and causing incidents against Jewish and Muslim communities in France and Germany, while a person linked to sabotage against Russia in EU countries was sentenced to a year of house arrest in Subotica.

German media are linking this case to Russian intelligence services and an incident in early August at Leipzig airport, where a drone with an explosive device was found near Ukrainian cargo planes.

Since the beginning of the invasion of Ukraine in February 2022, experts have recorded more than 180 similar attacks.

"The big ambition is to punish us for supporting Ukraine," Kacper Rekawek, senior researcher and program manager at the International Center for Counter-Terrorism (ICCT) in The Hague, told Radio Free Europe.

And a study by the Dutch University of Leiden from April this year claims that since the beginning of the invasion of Ukraine in 2022, Russia has been conducting a campaign of “covert actions” designed to support its frontline efforts by “weakening European support for Ukraine.” The Kremlin is being helped in this by “low-level operatives,” the study says, usually citizens of other countries who are not Russian and “have no official ties to intelligence services.”

But who are the people who are carrying out actions in European countries from Poland, Germany, France to Great Britain?

These are mostly "ordinary people," Rekawek explains.

"Or maybe not so common because sometimes they are ex-criminals, people with extremist backgrounds, football hooligans," he adds.

Until recently, Russian covert operations in Europe were carried out primarily by intelligence agencies, according to a study by GLOBSEC and the International Counterterrorism Center.

It is also alleged that Russia began expanding its hybrid campaign in Europe after the annexation of Crimea in 2014. From the explosion of 50 tons of ammunition stored in the Czech Republic, to the attempted coup in Montenegro and the attempted assassination of former Russian double agent Sergei Skripal in England, which led to the expulsion of Russian diplomats. According to a study on hybrid warfare last year, about 600 Russian operatives have been expelled from Europe since 2018.

"And obviously, you don't have these people in local communities, you don't have them on the ground. That's why you have to carry out these activities online," explains Kacper Rekawek, adding that the desire to make money and knowledge of Russian play a role in recruitment.

"We are talking about Ukrainian refugees or immigrants, Belarusian refugees or immigrants, Moldovans. We are talking about our citizens, but also about Russians. There are also Russians in Latvia, Russians in Estonia and so on."

The people who will tomorrow deliver packages, light fires or just put up stickers and draw graffiti are found on job sites, online sites, on Telegram. And what happens, Rekawek explains, is that they recruit one person and then that person has to recruit others.

What is happening with the recruitment of "ordinary individuals" for incidents across Europe is similar to what the so-called Islamic State did a decade ago, says this Polish researcher.

"Because ten years ago we were talking about how ISIS uses friends and family to recruit people into its network. That's exactly what's happening now," says Rekawek.

A similar thing happened in the case of a fire in 2024 in a London warehouse that was storing aid for Ukraine.

According to British prosecutors, the arson was organized by the Wagner group, namely Dylan Earl, who voluntarily contacted the group on Telegram and offered help. He then recruited other men in Britain to organize and carry out the attack. They were sentenced to a total of 29 years in prison last year for that attack, and the arson they organized on behalf of Russia caused damage of almost a million pounds.

Several arsons have also been set in Poland. For example, in April 2024, a fire was set in a hardware store, and Polish prosecutors said the attack was carried out on behalf of Russian intelligence services.

How many attacks were carried out by available agents?

According to Czech Foreign Minister Jan Lipavsky, in 2024 alone, more than 100 "suspicious incidents" attributed to Russia were recorded.

From February 2022, when Russia began its invasion of Ukraine, to early 2026, GLOBSEC researchers have recorded more than 150 incidents linked to Russia. Rekawek says that number is now close to 180.

Moreover, in Germany alone, 320 potential sabotage attempts were recorded last year, but according to GLOBSEC, clear attribution of responsibility remains a challenge because perpetrators are rarely identified. Russia regularly denies accusations that it employs random agents to carry out incidents across Europe.

Although single-use agents operate across Europe, the majority of attacks have been recorded in Poland, followed by France, Lithuania, Germany and the United Kingdom.

Of the 180 incidents recorded by the International Counterterrorism Center, a third involve deliberate arson. “If a fire goes wrong, people can die. That hasn’t happened yet, but we’re not far from it,” Rekawek said.

As part of these actions, trains were also redirected and various types of sabotage were carried out, such as graffiti on walls and sending packages with explosives.

Thus, in July 2024, four packages containing incendiary devices were sent from Lithuania.

One of the shipments caught fire on July 20, 2024, at a DHL cargo center at Leipzig Halle Airport in Germany, shortly before it was to be loaded onto a plane bound for the United Kingdom. A second caught fire two days later at a DHL warehouse in Birmingham, while a third set fire to a truck trailer in Poland. A fourth package was seized undamaged.

During pre-investigative activities, Lithuanian prosecutors determined that these crimes were coordinated by Russian citizens associated with the “military intelligence services of the Russian Federation.” It was also determined that citizens of Lithuania, Russia, Latvia, Estonia, and Ukraine were used in carrying out the tasks.

"They were sought for this purpose through acquaintances, recruiting and maintaining contacts via Telegram, with offers of rewards and payments in cryptocurrencies," Lithuanian prosecutors said.

According to Eurojust, the investigation, which covered Germany, Lithuania, Poland, the Netherlands and the United Kingdom, identified a total of 22 suspects in Lithuania and Poland who are suspected of acting in the interests of Russian military intelligence.

Several cases are currently in court, including Aleksandr Bezrukavyi, a Russian citizen who was extradited to Poland from Bosnia and Herzegovina.

According to the indictment, which Radio Free Europe/Radio Liberty obtained from the Warsaw Court, Bezrukavyi was part of a group specifically responsible for preparing test shipments to the US and Canada.

Five of them, including Alexander Casian, who has dual Russian and Moldovan citizenship, are currently under international arrest warrants.

A case involving a Moldovan national is also under investigation in France for vandalism and anti-Ukrainian graffiti. Iurie Manic, who was arrested in Romania, was released to defend himself after France failed to extradite him within the deadline.

In France, he faces five years in prison for recruiting other Moldovans in the summer of 2024 to paint graffiti depicting coffins and the message "French soldiers in Ukraine."

In most cases, the motive of those who are also called “former agents” is money, and more rarely a pro-Russian stance. But, as Rekawek adds, we do not know what the thoughts of those who are hired for money are. “But, yes, this is not an ideologically motivated recruitment campaign.”

A study by the International Counterterrorism Center, for example, identified 172 individuals who participated in these incidents across Europe. Of these, 95 percent were ordinary citizens with no ties to Russian security agencies. Their motive was profit, sometimes pro-Russian sentiment, the study said.

Although, Rekawek explains, in the case of people recruited from Serbia, "a little goodwill" is needed, it is still about money.

“I don’t know to what extent there was an ideological connection,” Rekawek adds. “If you’re a Russian intelligence service and you want to recruit people for these jobs, it’s easier to do it in Belgrade than, say, in Tallinn, Helsinki or Warsaw. I think that plays a role, but I would still say that money is essential.”

And the money paid ranges from seven to 10,000 euros, the research showed. The price increases with the risk. “It is possible to earn a few euros from graffiti or stickers, while an arson or sabotage can bring in thousands,” says the research “Crime as a Tool of Hybrid Warfare in Europe.”

In the case of a group that, on the orders of the Russian intelligence service, caused unrest in France and Germany, the decision of the Supreme Court in Smederevo, to which Radio Free Europe journalists had access, states that in addition to paying for travel expenses – renting a vehicle, buying bus and plane tickets, and hotel accommodation, the group members were promised that they would receive money for each “job” they performed – five hundred, one thousand or one and a half thousand euros.

As investigations and trials continue into many of the hundreds of cases of various types of attacks recorded in European cities, researcher Kacper Rekawek says there is "no victory" over the available agents.

“You can disrupt networks by interfering with communications. But if Russia really wants to recruit someone for a lower-level task, they will do that.”

What can be done is to limit these campaigns, to limit them. "And to support Ukraine even more," Rekawek concludes.

In their report, GLOBSEC and the International Counterterrorism Center recommend a series of measures for national governments and EU institutions to improve European resilience. These include cutting recruitment, limiting incentives for organized crime, and strengthening institutional resilience.