Testing the waters: Suspected Russian activity challenges Europe’s support for Ukraine

Methodology note

The incidents in which Russia’s covert involvement is strongly suspected have prompted much interest recently.¹ ACLED strives to contribute to the discussion with a regularly updated public dataset mapping such activity leading to confirmed physical damage or significant disruption in Europe, as well as suspicious surveillance of sensitive sites. To facilitate user access to these events, ACLED has been applying a “suspected Russian activity” tag to relevant events since the beginning of Russia’s all-out invasion of Ukraine in 2022. The tag can be found in the tags column of the dataset. The tag does not imply attribution to Russia or Russia-linked actors — rather, the events list suspected perpetrators as unidentified armed groups or civilians as per the ACLED coding guidelines.

The purpose of the tag is to track instances of suspected Russian hostile activity across Europe, the South Caucasus, and Central Asia. Suspected Russian hostile activities include, but are not limited to, targeting and hostile monitoring of both public and military infrastructure supporting Ukraine, disrupting services and operations in countries supporting Ukraine, and targeting Russian exile groups in Europe. The tag is applied to an event only when at least one credible source is reporting suspected Russian involvement. ACLED researchers do not make assumptions themselves on whether they suspect Russia might be involved. The tag is not applied to events for which Russia is clearly identified as the perpetrator, and Russian state actors are coded. To include the latter events in an analysis of suspected and attributed activity, one should parse actor columns for Russian state actors in addition to events filtered through the tag.

On 26 September 2022, four blasts occurred on the Nord Stream 1 and 2 pipelines that used to pump Russian natural gas to Europe, leaving only one of the four pipes intact. European officials suspected the involvement of Russia,² which by then had halted supplies in an attempt to strong-arm European Union countries to ease sanctions related to its ongoing invasion of Ukraine. Only a year later was it revealed that the sabotage of Nord Stream may have been the result of a Ukrainian operation, likely an attempt to make it difficult for Russia to resume deliveries of natural gas to Europe. A Ukrainian attack on the TurkStream pipeline that runs from Russia to Turkey was also allegedly considered but not carried out, according to international security sources.³ The Nord Stream incident points to the lack of protection and surveillance of critical infrastructure and underscores the difficulty of attributing responsibility for sabotage.⁴

The attack on the Nord Stream pipelines was followed by a string of incidents beginning in October 2023 that damaged European underwater infrastructure in the Baltic Sea, primarily by means of anchor-dragging that cannot be explained by choppy waters or crew ineptitude alone.⁵ Russia denies involvement,⁶ but persistent incidents at sea occur against the backdrop of proliferating suspicious events across Europe that law enforcement agencies suspect could have been orchestrated by Russia. Policy responses in Europe and beyond further corroborate the plausibility of the suspicion.

What appears to be a Russian campaign targeting NATO allies in Europe is reminiscent of the deniable tactics Moscow used before its covert invasion of Ukraine’s Donbas region.⁷ It is also not entirely new. Russia’s covert operations stem from the “active measures” taken during the Soviet era,⁸ which combined deniable sabotage and influence operations. It was resuscitated in the modern “Gerasimov doctrine” on hybrid warfare, which outlines a strategy of covert and deniable attacks on Russia’s adversaries short of prompting armed response.⁹ These operations stop short of triggering mutual defense clauses and include recently ramped-up mis- and disinformation campaigns,¹⁰ interference in elections to install malleable counterparts,¹¹ and encouraging irregular migration in the EU to fuel the ascendance of nativist political forces.¹² The tug of war in the cyber domain is another important dimension,¹³ with frequent attacks on public services. For instance, in 2024, cyber attacks tracked to Russia-linked perpetrators disrupted hospital operations in Romania and the United Kingdom.

The scope of this report, however, is limited to incidents that inflicted physical damage and caused significant disruption. It maps 190 events since 2022 (see tables and map below), detailing activity that is not directly attributed to Russia but in which Russia’s covert and increasingly reckless efforts to undermine Europe’s support for Ukraine are suspected. They mostly target countries involved in helping Ukraine’s self-defense and expose the vulnerability of Europe’s own infrastructure, while also sowing chaos on the streets. ACLED notes a concentration of suspicious events in the Baltic Sea area, possibly due to the rushed accessions of Finland and Sweden to NATO. The resulting extension of the NATO land and maritime border with Russia may lead it to respond by probing the defenses on the Alliance’s eastern flank.

Suspected Russian activity across Europe January 2022 – April 2025
Country	Incidents
Germany	39
Norway	19
Finland	17
Poland	16
France	13
Spain	11
Sweden	10
United Kingdom	8
Others*	57
Total	190

* Includes Ukraine, Moldova, Estonia, Romania, Czech Republic, Austria, Lithuania, Latvia, Italy, Greece, Bulgaria, Slovakia, Netherlands, Hungary, Denmark, Croatia, Belgium, and Albania.

Suspected Russian activity across Europe January 2022 – April 2025
Type of activity	Incidents
Drone overflight	59
Sabotage	45
Spying	15
Vandalism	13
Arson	12
Bloody parcel	9
Attack	7
Jamming	6
Flammable parcel	6
Cyberattack	6
Other	12
Total	190

Punishment for supporting Ukraine

Since the start of Russia’s invasion of Ukraine, European countries pledged over 100 billion euros in military aid to Ukraine.¹⁴ In addition, these countries host transit routes as well as logistics and training hubs, helping Ukraine fend off Russian aggression. Coupled with EU sanctions on Russia, siding with Ukraine renders Europe a target of Russian retribution.¹⁵

In the early stages of the invasion in 2022 and amid mass expulsions of Russian diplomats suspected of moonlighting as intelligence operatives in Europe, ACLED data show 10 instances of possible Russia-linked activity, including the torching of clothing aid collected by the Ukrainian embassy in Athens in May and a blast at an arms depot in Bulgaria in July. An outburst of suspected Russian activity in Europe beyond amateur surveillance of sensitive sites occurred in late November and December, after the Russian army was first routed in Ukraine’s Kharkiv region and then forced to withdraw from Kherson city (see graph below). The spate of activity included at least six flammable parcels sent to Spanish government officials, an arms producer in Spain, and Ukrainian and United States diplomats posted to Spain, as well as at least nine parcels containing animal parts and blood sent to Ukrainian diplomatic missions across Europe.

Likewise, 2023 appears to have been relatively calm as Russia gained confidence on the battlefield after fending off a Ukrainian counter-offensive and relaunching its ongoing assault on the Donetsk region. Mid-year, a series of explosions occurred at the same arms depot in Bulgaria — days after Bulgaria announced its intent to send ammunition to Ukraine.¹⁶ In August, the spoofing of radio signals disrupted rail traffic in Poland after Polish authorities detained nine people suspected of setting up a surveillance network to track rail shipments of weapons to Ukraine.

The tide may have turned in 2024. ACLED data show that more than half of all suspicious events since February 2022 occurred in 2024. Around 35% of these events were sabotage, and another 27% were unauthorized drone overflights. During the year, Russia’s steamroller offensive secured only incremental gains in Ukraine but incurred staggering losses of personnel.¹⁷ Meanwhile, Ukrainian drones wreaked havoc on Russia’s oil installations, reaching targets as far afield as the Ural mountains.

These developments may have prompted Russia to ramp up deniable attacks on Europe’s defense industry, which was only occasionally targeted in the previous decade.¹⁸ In February, the US and Germany called out a Russian plot to assassinate the head of Rheinmetall, Armin Papperger, an arms producer involved in supplying the Ukrainian army and opening assembly sites in Ukraine. In May, a fire at another weapons producer — a Diehl factory near Berlin — destroyed four floors and caused partial collapse of the building. German authorities, citing communications intercepts, attributed the incident to Russian sabotage.¹⁹

Civilian or probable dual-use targets also faced an increased threat of sabotage, with attacks becoming more reckless. Between March and May 2024, suspected Belarusian and Ukrainian recruits of Russian agents set ablaze three warehouses in Lithuania, Spain, and the UK, as well as a shopping mall in Poland. In July, three explosions involving flammable parcels occurred at warehouses in Germany, Poland, and the UK, with a fourth attempt foiled.²⁰ The incidents prompted alleged US backchannelling with Russia, according to The New York Times, to dissuade further attempts to send flammable parcels across the Atlantic due to the risk of mid-air explosions.²¹

Furthermore, military sites became increasingly targeted. At the end of May, a cache of explosives was discovered at a pipeline hub supplying military bases in Germany’s Bellheim municipality. In August, security breaches occurred at two military bases in Germany’s Nordrhein-Westfalen, prompting concerns about water contamination at and around them. In addition, between August 2024 and February 2025, ACLED records about 20 sightings of unidentified drones hovering over military bases or warships in or near Germany and the UK. Similar incidents occurred on at least two occasions near Romania’s Mihail Kogalniceanu airbase in April 2024. Facilities in Germany, Poland, and Romania are extensively used for supplying, training, and coordinating Ukrainian armed forces.²²

The Baltic Sea in crosshairs

On 7 October 2023, a vessel registered in China cut two telecommunications cables in the Baltic Sea connecting Estonia to Finland and Sweden and broke a natural gas pipeline linking Finland and Estonia. Four similar incidents occurred in late 2024 and early 2025, three near Sweden’s strategic Gotland island,²³ and affected telecoms, power, and gas lines connecting Nordic countries, the Baltic states, and Germany. None of the ongoing investigations have so far proved ill intent,²⁴ although some of the cargo ships suspected of sabotage are part of Russia’s so-called shadow fleet — often run-down ships used to circumvent the G7 and Australia’s price cap on Russia’s oil.²⁵ The existence within Russian military intelligence of a dedicated unit tracking subsea infrastructure further corroborates the suspicion.²⁶

Incidents targeting Europe’s infrastructure do not appear to be meant to cause significant disruption but rather point to its vulnerability to outside interference. The persistence of such incidents and their concentration in the highly contested Baltic Sea area leaves room for concerns about a deliberate campaign. Russia cited NATO’s actual and perceived eastward expansion as a rationale for invading Ukraine.²⁷ The accession of hitherto neutral Finland and Sweden to NATO in 2023 and 2024 in response to the invasion extended Russia’s land and maritime border with the alliance by hundreds of kilometers. It further isolated Russia’s Kaliningrad exclave, which is believed to serve as a hub for organizing covert operations targeting neighboring countries.²⁸ Rising tensions and rapid re-militarization of the Baltic Sea by both sides²⁹ may be prompting Russia’s interest in surveilling infrastructure in shoreline countries and elsewhere in Europe, possibly to probe its susceptibility to sabotage.

Rival militaries in close proximity are involved in numerous incidents that could lead to an escalation if something goes wrong. These are difficult to quantify, as only a fraction of these occurrences are known to the public. Reported ones nonetheless point to an increasingly contested space in and around the Baltic Sea (see map below). For instance, in late 2024 and early 2025, the Russian military harassed German and French airborne patrols over the Baltic Sea near Kaliningrad by firing emergency flares in one instance and locking in an air defense system in another. NATO allies’ jets have scrambled to respond to unannounced or suspicious Russian activity in the air practically on a daily basis since Russia’s invasion of Ukraine, though the frequency has declined since 2022.³⁰

Another indicator of rising tensions is GPS signal interference affecting civilian aircraft in the Baltic Sea area. In 2024, ACLED records at least four reports of persistent jamming preventing the landing of passenger planes, mostly in Finland but also in Estonia. In addition, Russia is believed to have jammed the then British defense secretary’s plane when it was flying near Kaliningrad in March 2024.³¹ The need to blunt incoming Ukrainian drones targeting Russia’s oil infrastructure, including in the nearby Russian Leningrad region, provides only a partial explanation, given that at least two similar incidents occurred in 2022, when Ukraine had not yet acquired long-range drone capacity. Furthermore, GPS signal interference also affects maritime traffic, and it is likely that some jamming has possibly been conducted off the shadow fleet vessels.³²

Furthermore, the addition of the two Nordic members to NATO and soaring tensions in the Baltic Sea may explain the correlation with the increased frequency of unauthorized surveillance of infrastructure in northern Europe. Since Russia’s invasion of Ukraine, ACLED records almost 40 instances of unidentified drones overflying infrastructure sites in northern Europe, of which around half occurred in September and October 2022 alone, mainly in Norway’s territorial waters over sensitive energy installations and in Finland over critical infrastructure. After a lull in 2023, possible Russia-linked drones returned in August 2024. Seven of nine sightings between then and February 2025 occurred in northwestern Germany over energy and port infrastructure and sensitive production sites. Notably, the drone sightings were concomitant with sabotage scares and drone overflights at or over military sites across Germany in August and December 2024. The proximity of most sightings to the sea suggests that the drones may have been launched from military or commercial vessels.

The persistence of attempts to sabotage the water supply and treatment infrastructure in Europe is particularly concerning. In May and June 2024, ACLED records at least seven attempts to tamper with equipment at water installations at five locations in Finland. Two similar incidents occurred in Sweden in October 2024 and March 2025, the latter probably the most serious to date, as unidentified perpetrators damaged a water supply cable on Gotland, threatening the interruption of running water on the island. In addition, cyber attacks by Russia-linked hackers targeted water infrastructure in France in March 2024 and in Denmark in December 2024. This happened against the backdrop of intelligence services’ public warnings about Russia-linked actors’ attempts to remotely sabotage Europe’s power grid and rail service.³³

Sowing chaos in Europe

Deniability is the core feature of suspected Russian activity across Europe. Although some events could be catalogued as mere vandalism, their significance and potential for disruption should not be underestimated. Meanwhile, Russia may exploit the cover of local militancy to stage attacks and sow chaos with plausible deniability, further blurring the lines and complicating investigations.

Between 26 and 30 October 2023, stencilled blue Stars of David appeared in the greater Paris area. Occurring at the height of Israel’s offensive in Gaza, the graffiti incidents could hardly be seen as conducive to interfaith comity amid rising hate crimes in a country populated by sizable Jewish and Muslim communities.³⁴ The inflammatory street art was traced back to a Moldovan couple acting at the behest of a Russia-linked Moldovan businessman. Similar vandalism occurred in Paris in the run-up to the 2024 Olympic Games and included the desecration of a Holocaust memorial site, graffiti warning of the imminent collapse of balconies in the Notre-Dame Cathedral area, and stencils of coffins with the text “French soldier in Ukraine” spray-painted on walls. Additionally, actual coffins draped in French flags and inscribed with the same text were left at the Eiffel Tower. The suspected Moldovan and Bulgarian perpetrators, however, may have aimed for the graffiti to reach a wider audience than the crowds descending on the French capital. In all instances, they sought to amplify the messages on social media as well.³⁵ Security concerns ahead of the Olympics reached a fever pitch with the arrest of a Donetsk native who accidentally detonated explosives while making a bomb in a hotel room in a Paris suburb in June, along with the arrest of an operative of the Russian Federal Security Service, or FSB, on charges of plotting to disrupt the opening ceremony in July. The latter apparently fell victim to his own partiality to drink and boast.³⁶

Despite French and allied authorities’ best efforts to avoid major incidents, serious disruption nonetheless did occur around the Olympic Games. On the eve of the opening ceremony on 26 July, unidentified perpetrators set fire to railway line cables north, east, and southwest of Paris, severely disrupting high-speed rail traffic from and to the capital for three days. A smaller-scale coordinated attack on infrastructure occurred on 29 July, targeting the country’s fiber-optic networks and affecting at least 17 of 96 French mainland departments. In both instances, far-left groups claimed responsibility, citing dissatisfaction with capitalism, nuclear waste management, and the government’s response to the New Caledonia riots occurring at the time. Despite the likelihood of homegrown militant activism, French authorities did not rule out Russia’s possible involvement in the incidents.³⁷

The French case suggests that the room for deniability may be expanding and cutting both ways. Months ahead of the revelation of the alleged Russian plot to assassinate Rheinmetall boss Papperger, suspected far-left activists attempted to set ablaze the arms manufacturer’s second home over his support for Ukraine.³⁸ Europe’s pivot toward greater defense spending and away from enforcing stricter environmental policy may prompt increased activity among concerned groups and individuals, complicating investigations that may be looking for a non-existent Russian footprint. Meanwhile, increasing polarization may be a boon for Russian recruiters who increasingly rely on local criminals, militant activists, and destitute migrants — including Ukrainian refugees — to carry out operations.³⁹ The amateurization of sabotage may increase the probability of collateral victims, including the presumed perpetrators themselves, and is mirroring the shadow war between Russia and Ukraine, where arson and bombing attempts by unwitting perpetrators duped over the phone or online have been common since 2023.

Bracing for what’s next

Incidents across Europe in which Russian involvement is suspected appeared to wane by March 2025, especially compared to the peak observed in late 2024 and early 2025, when the standoff between Russia and Ukraine’s backers was most acute. The second Trump administration’s overtures toward Russia may have contributed to the latter hitting the brakes on covert operations in Europe to explore the possibility of forcing Ukraine to capitulate during negotiations rather than in an increasingly costly all-out war. The outcome of roller-coaster talks to end the fighting in Ukraine is unpredictable, and the high odds of the US leaving Ukraine and Europe to their own devices in dealing with an aggressive Russia may mean that the lull in sabotage attempts may be only temporary.

NATO allies have been careful not to overreact to covert Russian operations, despite the growing suspicious activity.⁴⁰ A low-key response is underway nevertheless, especially in the Baltic Sea area, where NATO increased patrolling, including with naval drones.⁴¹ It also launched a dedicated unit to ensure the security of undersea infrastructure.⁴² Attempts to hold perpetrators accountable for damage to infrastructure in the Baltic Sea have not borne fruit, however, despite several vessel seizures and crew arrests. International sea navigation law’s priority on unhindered passage may be precluding bolder action.⁴³ Beyond the actions taken in the Baltic Sea, the targets of suspected Russian activity respond where they can. Polish authorities shut down the Russian consulate in Poznan in late 2024, citing its involvement in coordinating sabotage attempts in the country, and another in Krakow in May 2025 in response to the Warsaw shopping mall fire.⁴⁴ Finland has kept its land crossings with Russia shut for over a year due to the flow of asylum-seekers from poorer countries.⁴⁵

The Baltic States may face a greater risk of an escalation from their eastern neighbor than others in Europe. If Russia is allowed to get away with yet another land grab in Ukraine, it may attempt to test the validity of mutual defense clauses amid waning interest from the US in defending its allies in Europe. Estonia, Latvia, and Lithuania — all three former Russian and Soviet dominions — have been the focus of Russian media and diplomatic narratives alleging the discrimination of Russian-speaking populations for most of their independence since 1991. This is even longer than Ukraine, which has been subjected to a similar informational policy since the Orange Revolution in 2004. Possible, though not exhaustive, scenarios replicating Russian covert and then all-out invasions of Ukraine since 2014 may include another “special operation” to “liberate” Russian speakers in Estonia’s Narva just across the eponymous river that serves as a border or the seizure of the Suwałki gap, sandwiched between Lithuania and Poland, to gain a land link to Kaliningrad. This would echo the occupation of southern Ukraine to acquire a land corridor to the annexed Crimean peninsula.

However outlandish these possibilities may seem, the countries concerned appear to take them seriously — all EU states bordering Russia announced plans to leave the Ottawa Convention banning the use of anti-personnel mines, citing the need to improve defenses.⁴⁶ A major test of wills and capabilities may occur as early as September 2025 when Belarus is scheduled to host another iteration of the joint Russian-Belarusian “Zapad” drill.⁴⁷ The drill in late 2021 was used to justify the build-up of Russian forces along Ukraine’s border with Belarus, which Russian forces used to attempt a decapitating attack on Kyiv.

Even if the worst fears may prove overblown, European countries will have to reckon with the need to invest in efforts to foil sabotage attempts on both land and at sea and protect critical infrastructure. With the US apparently disengaging from the region and viewing Russia as less of a threat,⁴⁸ Europe may have to make do without the US intelligence and law enforcement support that helped foil the excesses of suspected Russian activity, such as assassination attempts and flammable parcels onboard planes. Europe may not have much time to prepare for another possible wave of Russian attempts to test its resolve to stand by Ukraine and ultimately defend itself.

Visuals produced by Ciro Murillo.