Russian intelligence orchestrates brazen acts across Europe, prompting alarm and countermeasures

Russian intelligence, notably the GRU, has orchestrated brazen acts across Europe, from arson to espionage, targeting military bases, officials, and infrastructure. Tactics include recruiting locals via social media for sabotage. Governments, notably in the Baltics, confront this threat, fearing escalation and highlighting the challenge of attribution and defence against such hybrid warfare.

Sign up for your early morning brew of the BizNews Insider to keep you up to speed with the content that matters. The newsletter will land in your inbox at 5:30am weekdays. Register here.

By Bloomberg News

In Germany, two suspects hired by Russian intelligence to target military bases had come to the country as teenagers. In Estonia, young men with criminal records were recruited over Telegram to vandalize a minister’s car and national monuments for a bit of cash.

Elsewhere in Europe, government workers are advised to take precautions against a greater risk of violence by Russian-backed thugs. The hand of the GRU military intelligence service is likely behind a series of ever-more overt, frequent and coordinated incidents across the continent, according to officials familiar with the matter speaking on condition of anonymity to discuss open investigations.

The Russian Embassy’s compound in London’s Highgate. The UK deported Russia’s defense attaché.

From Berlin to Vilnius, governments are coming to grips with the growing threat from Russian-sponsored acts of sabotage and violent intimidation on NATO territory ahead of European Union elections next month that alongside a determined campaign of disinformation is designed to test the continent’s support for Ukraine.

The sheer brazenness now of Kremlin-sanctioned activities — years after the Salisbury poisonings that the UK believe were likely ordered by Russian President Vladimir Putin and the Tiergarten killing in Berlin — has led one senior official to the conclusion that Moscow no longer cares if it’s caught carrying out hostile acts and has jettisoned more subtle forms of clandestine espionage with open brutality on Western targets.

In London on Friday, a British man will appear in court, accused of carrying out an arson attack against a Ukrainian-linked warehouse in East London. The UK expelled a top Russian diplomat as part of a crackdown on Russian spies in response.

In Poland, prosecutors arrested a man they accused of collecting information on an airport that serves as the main stopover point for officials traveling to and from Ukraine on suspicion of assisting in a Russian plot to assassinate President Volodymyr Zelenskiy.

One European official said several of the incidents in Europe were part of a GRU-coordinated operation with similar activities being carried out in various capitals. The response is focused on activity that has happened as opposed to the threat of activity that could happen – and demonstrating to Russia that the West knows what it’s doing and there are consequences, the official said.

“Russia has been sending death squads to Europe for years — Berlin, London, Salisbury, but also other places,” Polish Foreign Minister Radoslaw Sikorski said Thursday in Tallin, Estonia. “We had a Russian-recruited terrorist who tried to perform an act of terrorism in Poland a couple of months ago and I’m sure they’re trying to do that in other countries, too.”

Kremlin spokesman Dmitry Peskov told journalists on Monday that allegations that Russia plans sabotage acts in Europe were “just another series of unfounded accusations against our country,” according to the Interfax news service.

In their aggressiveness, methods and scope, the Russian-backed actions represent a new threat emanating from the Kremlin and officials point out that the spate of recent attacks share common traits, often involving locals hired mostly online through intermediaries to hit targets in the West or carry out other malign tasks at Moscow’s behest.

It is highly likely that the strategy — aimed at Europe as a whole — has been signed off at the highest level in Moscow, one of the officials said. Russia has a deliberate strategy of sabotaging aid to Ukraine across Europe, recruiting locals to help their efforts, another official said.

Teija Tiilikainen, director of the European Center of Excellence for Countering Hybrid Threats, sees behind all this Russia’s willingness to strengthen the role of authoritarian regime and is also possibly preparing itself for an escalation of its conflict with the West by testing its tools.

Baltic Crosshairs

Estonia arrested earlier this year around a dozen individuals suspected of working for Russian intelligence and that were part of a wider low-cost plan to gain influence abroad, according to Margo Palloson, who leads its Internal Security Service. Lithuania’s intelligence service warned this week that Russia is trying to employ residents in the Baltic states to carry out provocations or attacks.

“There’s an increased use of social platforms for this, with ads searching for people to recruit, for people willing to spy for a fee, to photograph infrastructure of military objects of strategic importance, to collect data on individuals and to carry out acts of sabotage or vandalism,” the agency said in a statement.

While the Baltics are NATO’s frontline with Russia, they are by no means alone in raising the alarm on how far Moscow is prepared to go with these tactics. In the past month, Germany arrested two men for plotting “possible sabotage actions” against military and industrial sites, including US installations. For example, the US military base in Grafenwoehr is where Ukrainian soldiers are being trained on Abrams tanks.

US Bases

Officials at Germany’s domestic intelligence service are concerned that Russian intelligence agencies are systematically targeting Russian-Germans living in the country via social media channels, a person familiar with the matter said on condition of anonymity.

The danger is especially high among countries with a Communist past or once formerly part of the Soviet Union because they consume Russian media and are most exposed to anti-Ukrainian and anti-European propaganda, the person added. Romania’s top defense council warned in a report about the potential infiltrations of Russian spies as Ukrainian refugees or even potential sabotages of military transport to Ukraine.

Romania is the EU member state that shares the longest border with Ukraine and has seen an increase in cyberattacks against some of its key institutions and politicians since the start of the war. During one of the attacks against the parliament’s database, the hackers have stolen the ID details of Prime Minister Marcel Ciolacu and posted it on the dark web, forcing him to change his ID.

Beyond sharing intelligence and expertise, NATO’s tools to counter these hybrid threats are often limited and attribution is notoriously challenging.

As Tiilikainen said, by staying under the threshold of armed attack and NATO’s collective defense commitment known as Article 5, “Russia is trying to get the most out of its power while still avoiding counter reactions or immediate countermeasures.”