Russia's Sabotage Campaign in the West, “That's Not a Hybrid Attack, That's State-Sponsored Terrorism”

Russia typically tries to leverage its status as a major energy exporter when trying to influence the policy of foreign nations, but when that doesn’t work, things tend to take a turn into the shadowy world of assassinations and sabotage.

Clandestine attacks on foreign countries would continue into the period of Russia’s full-scale invasion but through different channels. More than 600 of Russia’s European spy assets were expelled from European embassies, forcing Russia to adopt new tactics. They began by recruiting European individuals to commit sabotage in exchange for payment. Some may not even know they’re Russian intelligence assets.

In May, European intelligence agencies warned of Russia's plans for violent sabotage across the continent, including in the form of explosions and arson. German domestic intelligence head Thomas Haldenwang noted increased risks following arrests for spying and attack planning. 

Russia already has a long-standing history of sabotage, which has only intensified with the start of the full-scale invasion of Ukraine.

Here are some notable examples:

Explosions at the Czech ammunition depot in Vrbětice (2014) and the attempted assassination of Skripal in the UK (2018)

In 2014, explosions rung out at ammunition depots in Vrbětice, Czech Republic—resulting in the deaths of two employees. The ammunition in the depots was to supply Ukraine during the first years of its war with Russia, known as the Anti-Terrorist Operation (ATO). 

In 2018, two men were linked to these explosions, when information came to light about the poisoning of a former Russian military officer and double agent for the British intelligence services—Sergei Skripal and his daughter—with military-grade nerve agent Novichok in the UK.

The investigation led British intelligence services to identify three Russian nationals involved in the attack. They were part of a clandestine Unit in GRU called Unit 29155. Named were Col. Anatoly Chepiga, Dr. Alexander Mishkin, a GRU doctor, and Sergey Fedotov, also associated with the GRU. All of them were Russian assets embedding themselves in the UK as tourists or law-abiding citizens. 

Czech authorities found that Alexander Mishkin and Anatoly Chepiga, the primary suspects in the Salisbury incident, were also active in the Czech Republic prior to that. They had arranged a visit to the Vrbětice ammunition depot using fake identities shortly before the initial explosion occurred.

Russian ships appear to damage Norwegian internet cables (2022)

Footage shows the radar signature of Russian-flagged fishing ships circling an area of the North Sea, where Norway’s main internet cables are laid on the sea bed. The ships were trawling in an area between Svalbard and the Norwegian mainland, which involved casting a weighted net deep into the water. 

Photos released by Norwegian authorities showed the extent of the damage done by the weighted nets onto the casing of the fiber optic cables. Footage from a radar showed the multiple laps taken around the area where the cables were present.

Fires in US and UK factories producing 155mm shells for Ukraine (2024)

On April 15th, 2024, a fire broke out on an assembly line at a General Dynamics ammunition factory in Scranton, Pennsylvania. The plant produces 155mm artillery shells that would ultimately be sent to Ukraine. 

Two days later, on April 17th, 2024, an explosion was reported at a BAE factory in Wales, United Kingdom. The factory also produced 155mm artillery shells for Ukraine. 

The mysterious circumstances of the incidents, their timing, and the connection to 155mm artillery shells being provided to Ukraine—who desperately needed them at the time—have some experts pointing to Russian sabotage.

Two Russians suspected of spying arrested in Germany (2024)

On April 18th, 2024, German police arrested Dieter S. and his accomplice Alexander J. in Bayreuth for allegedly spying for Russia. Dieter S., a 39-year-old German-Russian, is accused of fighting alongside Russian separatists in Eastern Ukraine from 2014 to 2016. He allegedly maintained contact with a Russian secret service agent since October 2023 and agreed to carry out attacks on military infrastructure to disrupt German support for Ukraine.

Prosecutors believe Dieter S. scouted US military facilities in Germany, including one in Grafenwöhr, Bavaria, where the US Army trained Ukrainian soldiers. The suspects appeared before judges of the Federal Court in Karlsruhe and were taken into custody. Germany’s Interior Minister, Nancy Feser, stated that the security authorities prevented potential explosive attacks aimed at undermining military aid to Ukraine.

Finnair flights grounded due to GPS jamming (2024)

On April 29th, 2024, Finnair suspended its flights to Tartu, Estonia, due to GPS jamming believed to have been caused by Russian interference. This disruption led to two flights from Helsinki being forced to turn back when their GPS signals were jammed, making it unsafe to land in Tartu. 

Estonian Foreign Minister Margus Tsahkna called Russia's GPS jamming a “hybrid attack” and stated that Russia is waging a “shadow war” against the West. The GPS jamming issue has been ongoing since late 2022, significantly affecting air traffic procedures in the regions bordering Russia. 

Cyber attacks against Germany and the Czech Republic (2024)

On May 3rd, the European Union and its member states issued a joint statement condemning a cyber attack conducted by the Russians, specifically a group called Advanced Persistent Threat Actor 28 (APT28). 

Josep Borrell, the EU’s Foreign Policy Chief said: “The malicious cyber campaign shows Russia’s continuous pattern of irresponsible behavior in cyberspace by targeting democratic institutions, government entities, and critical infrastructure providers across the European Union and beyond”.

Diehl metal factory fire in Germany (2024)

Also, on May 3rd, 2024, a massive fire broke out in a metal plant in Berlin belonging to Diehl Metal, a subsidiary of the German defense contractor Diehl Stiftung & CoWestern.

The fire lasted seven days and took over 200 firefighters to extinguish, causing an estimated 20 million euros in damages. German police and Diehl’s fire insurance company investigators came to the same preliminary conclusion: a technical defect. Yet European security officials blamed Russia, as the plant is integral in producing the IRIS-T Air defense system—which Germany announced it would supply to Ukraine.

IKEA warehouse fire in Lithuania (2024)

On May 9th, 2024, a fire at an IKEA warehouse in Lithuania raised suspicions of Russian involvement. Lithuania’s National Crisis Management Centre (NKVC) requested that pro-Ukrainian businesses “strengthen their vigilance,” insinuating that Russia is attempting to sow instability within the NATO member state. 

Gabrielius Landsbergis, Lithuania’s Minister of Foreign Affairs, indicted Russia directly, calling the country a terrorist state for its funding of arson attacks on the furniture retailer, saying: ”If a country hires someone to burn down buildings in another country, that's not a hybrid attack, that's state-sponsored terrorism.”

Fire at Warsaw shopping mall (2024)

On May 12th, 2024, a fire broke out inside Warsaw’s largest shopping mall. The entire structure was burnt down, which included 1500 retail spaces that mostly consisted of small businesses. The suspicious nature of the incident drew comments from the nation’s top bureaucrat.

Prime Minister Donald Tusk would say at a press conference that Russian Special Forces could be involved in carrying out the arson attack. The timing of the fire raised alarms as it was only three days after a fire with similar circumstances in nearby Lithuania. 

Russian cyber attacks on NHS hospitals (2024)

A cyberattack attributed to the Russian cyber-crime group Qilin has disrupted operations at two major London NHS trusts, causing significant disruptions to patient care. The attack targeted IT systems responsible for reporting patient tests at hospitals served by Synnovis, including King’s College and Guy’s and St Thomas’ NHS trusts.

As a result, hospitals have been forced to resort to paper-based record-keeping, causing delays and cancellations in non-urgent operations and procedures. Doctors were instructed to cancel all non-emergency blood tests, compromising routine HIV testing and cervical cancer screening services. NHS sources warned that full recovery could take months.

The incident has been classified as a ransomware attack, and Former National Cyber Security Centre chief Ciaran Martin identified Qilin, who had been demanding payment to restore access to the affected systems. 

GPS interference on British Military flights (2024)

Russia has been accused of disrupting GPS signals during hundreds of British military flights. From January to April 2024, an analysis of Flight Radar data revealed that British military aircraft, conducting 1,467 flights over Eastern Europe and the Middle East, encountered GPS disruptions on 142 occasions, affecting 60 flights multiple times. The Telegraph noted that Russia has a GPS jamming station located in the Kaliningrad region, an enclave between Poland and Lithuania on the Baltic Sea.

British Defense Minister Grant Shapps, who experienced GPS disruption firsthand during a flight earlier in the year, characterized the report as evidence of Russia’s disregard for international norms and Western interests. Since Russia’s full-scale invasion of Ukraine, reports of GPS navigation issues in Europe have been prevalent, particularly around the Kaliningrad region.