Fire, drones and graffiti: Russian traces in acts of sabotage across Europe

Explosives were found on the border between Serbia and Hungary, an IKEA store was burned in Lithuania, a drone was found at Leipzig airport, and a warehouse with equipment for Ukraine was burned in London. Meanwhile, in France, pig heads appeared near mosques.

At first glance unrelated, similar incidents have occurred in recent years across Europe, but they all have one thing in common: investigations or authorities in these countries link them to Russia.

In Serbia alone, three people have been convicted of spying for Russia and inciting incidents targeting Jewish and Muslim communities in France and Germany, while one person, suspected of links to sabotage carried out on behalf of Russia in European Union (EU) countries, has been sentenced to one year of house arrest in Subotica.

His case is linked by German media to Russian intelligence services and the incident at the beginning of August at Leipzig airport, where, near Ukrainian cargo planes, a drone with an explosive device was found.

Since the beginning of the invasion of Ukraine in February 2022, experts have recorded more than 180 similar attacks.

"The big ambition is to punish us for the support we give to Ukraine," says Kacper Rekawek, senior researcher and program director at the International Center for Counter-Terrorism in The Hague (ICCT), in a statement to Radio Free Europe (RFE/RL).

A study by Leiden University in the Netherlands , published in April of this year, also notes that since the beginning of the invasion of Ukraine in 2022, Russia has been conducting a campaign of “covert actions” designed to support its efforts on the front lines, “weakening European support for Ukraine.” In this regard, the Kremlin is assisted by “low-level operatives,” the study says, usually citizens of other countries who are not Russian and “have no official ties to intelligence services.”

But who are the people who carry out these actions in European countries, from Poland, Germany and France to Great Britain?

It's mainly about "ordinary people," explains Rekawek.

"Or maybe not so common, because sometimes it's former criminals, people from extremist circles or football hooligans," he adds.

Until recently, Russian covert operations in Europe were carried out mainly by intelligence officers, GLOBSEC and the International Center for Combating Terrorism explain in a study.

The study also notes that Russia began expanding its hybrid campaign in Europe after the annexation of Crimea in 2014. From the explosion of 50 tons of ammunition stored in the Czech Republic, to the attempted coup in Montenegro and the attempted assassination of former Russian double agent Sergei Skripal in England, which was followed by the expulsion of Russian diplomats. According to the study on hybrid warfare, published last year, about 600 Russian operatives have been expelled from Europe since 2018.

"And, obviously, you don't have these people in local communities anymore, you don't have them on the ground. Therefore, you have to carry out these activities online," explains Kacper Rekawek, adding that the desire to earn money and knowledge of the Russian language play a role in their recruitment.

"We are talking about Ukrainian refugees or immigrants, Belarusian refugees or immigrants, Moldovans. We are talking about citizens of the respective countries, but also about Russians. There are Russians in Latvia, Russians in Estonia, and so on."

People who could tomorrow be delivering packages, setting fires, or simply putting up posters and graffiti are found on job boards, websites, and Telegram. It also happens, Rekawek explains, that one person is recruited, who then has to recruit others.

What is happening with the recruitment of "ordinary people" for incidents across Europe resembles what the so-called Islamic State (IS) was doing about a decade ago, says the Polish researcher.

"Because ten years ago we were talking about how IS used friends and family to recruit people into its network. That's exactly what's happening now," says Rekawek.

Something similar happened in the case of the 2024 fire in a London warehouse where aid for Ukraine was stored.

According to information from the British prosecution , the fire was organized by the Wagner group, namely Dylan Earl, who voluntarily contacted the group via Telegram and offered his help. He then recruited other men in Britain to organize and carry out the attack. For this attack, last year they were sentenced to a total of 29 years in prison, while the arson organized on behalf of Russia caused damage of almost a million pounds.

Several fires were also set in Poland. For example, in April 2024, a shop selling equipment was burned down, with Polish prosecutors claiming that the attack was carried out on behalf of Russian intelligence services.

How many attacks have been carried out by "single-use" agents?

According to Czech Foreign Minister Jan Lipavsky, more than 100 "suspicious incidents" attributable to Russia were recorded in 2024 alone.

From February 2022, when Russia launched its invasion of Ukraine, to early 2026, GLOBSEC researchers have recorded more than 150 incidents linked to Russia. Rekawek says the number is now close to 180.

Moreover, in Germany alone, 320 attempts at possible sabotage were recorded last year. However, as GLOBSEC points out, clearly assigning responsibility remains a challenge, as perpetrators are rarely identified. Russia regularly denies accusations that it employs “disposable” agents to carry out incidents across Europe.

Although single-use agents operate across Europe, the majority of attacks have been recorded in Poland, followed by France, Lithuania, Germany and the United Kingdom.

Of the 180 incidents recorded by the International Counter-Terrorism Center, a third involved deliberate arson.

"If the fire gets out of control, people can die. So far it hasn't happened, but we're not far from that," says Rekawek.

As part of these operations, trains were also diverted and various types of sabotage were carried out, such as graffiti on walls and sending packages with explosives.

Thus, in July 2024, four packages of incendiary devices were sent from Lithuania.

One of them caught fire on July 20, 2024, at the DHL cargo center at Leipzig/Halle Airport in Germany, shortly before it was loaded onto a plane to the UK. Another caught fire two days later at a DHL warehouse in Birmingham, while a third caused a fire in a truck trailer in Poland. The fourth package was seized intact.

During preliminary investigations, Lithuanian prosecutors determined that these criminal acts were coordinated by Russian citizens associated with the “military intelligence services of the Russian Federation.” It was also determined that citizens of Lithuania, Russia, Latvia, Estonia, and Ukraine were used in the execution of the tasks.

"For this purpose, they were found through acquaintances, through recruitment and maintaining contacts via Telegram, offering rewards and being paid in cryptocurrencies," Lithuanian prosecutors stated.

According to Eurojust data, the investigation involving Germany, Lithuania, Poland, the Netherlands and the United Kingdom identified a total of 22 suspects in Lithuania and Poland, who were allegedly acting in the interests of the Russian military intelligence service.

Several cases are currently in court. Among them is the case of Aleksandar Bezrukavyi, a Russian citizen extradited to Poland from Bosnia and Herzegovina.

According to the indictment, which Radio Free Europe/Radio Liberty obtained from the Warsaw Court, Bezrukavy was part of a group and had specific responsibility for preparing test shipments to the US and Canada.

International arrest warrants have currently been issued for five of them, including Alexander Casiani, who has dual Russian and Moldovan citizenship.

The case involving the Moldovan citizen is also being investigated in France, due to vandalism and graffiti against Ukraine. Iurie Manic was arrested in Romania, but was released on bail after France failed to extradite him within the stipulated deadline.

In France, he risks up to five years in prison after recruiting other Moldovans in the summer of 2024 to draw graffiti depicting coffins and carrying the message "French soldiers in Ukraine."

In most cases, the motive of those who are also called "disposable" agents is money and, less often, pro-Russian attitudes. However, as Rekawek adds, we do not know what the people who engage in paid activities think.

"But, yes, this is not about an ideologically driven recruitment campaign."

For example, a study by the International Counterterrorism Center identified 172 individuals who participated in these incidents across Europe. Of these, 95 percent are ordinary citizens, with no connection to Russian security agencies. Their motive is money and, sometimes, pro-Russian sympathies, the study says.

As Rekawek explains, in the case of people recruited from Serbia, "a little goodwill" is required, but it's still about money.

“I don’t know to what extent there was any ideological connection,” Rekawek adds. “If you are a Russian intelligence service and you want to recruit people for tasks of this level, it is easier to do this in Belgrade than, for example, in Tallinn, Helsinki or Warsaw. I suppose that plays a role, but I would still say that the decisive factor is money.”

The rewards paid range from seven euros to 10.000 euros, the study showed. The amount increases depending on the risk. “Graffiti or stickers can fetch a few euros, while arson or sabotage can bring thousands of euros,” says the study “Crime as a Tool of Hybrid Warfare in Europe.”

In the case of the group that, on the orders of the Russian intelligence service, incited unrest in France and Germany, the verdict of the Supreme Court in Smederevo, which Radio Free Europe journalists have reviewed, states that, in addition to covering travel expenses – including renting vehicles, purchasing bus and plane tickets, and hotel accommodation – the group members were promised payment for each “job” performed: 500, 1.000 or 1.500 euros.

The verdict against the person tried in Subotica, who had agreed to transport a drone for a fee, indicated that he should have received 500 euros. According to the verdict, which Radio Free Europe has reviewed, the convicted person had managed to transport the device to the designated location.

As investigations and trials continue into dozens and hundreds of cases of various types of attacks recorded in European cities, researcher Kacper Rekawek says that "there is no final victory" against "disposable" agents.

"You can disrupt networks by interfering with their communications. But if Russia really wants to recruit someone for a low-level task, they will do that."

What can be done is to limit these campaigns, to curb them.

"And, even greater support for Ukraine," Rekawek concludes.

In their report, GLOBSEC and the International Counter-Terrorism Center recommend a series of measures for national governments and EU institutions to strengthen Europe's resilience. These include preventing recruitment, limiting incentives for organized crime, and strengthening institutional resilience. /REL/