New Eurasian Strategies Centre (NEST Centre)@nestcentreorg · Sep 11, 2026Russia is waging a sabotage war inside the EU. Its operations have targeted shopping centres, railways and water…
Summary
Russia has conducted an extensive sabotage campaign across EU member states since 2022, targeting critical infrastructure including railways, water supplies, shopping centers, and cyberattacks on power and heating facilities. The operations involve arson, explosives, cyberattacks, and assassination plots coordinated by Russian military intelligence (GRU) and Wagner operatives, with documented attacks in Poland, Latvia, Estonia, Lithuania, Germany, Denmark, Romania, and other European nations.
Summarized by ThreadOut AI from the full thread. May miss nuance — read the thread below.
- #1
Russia is waging a sabotage war inside the EU. Its operations have targeted shopping centres, railways and water supplies. 🧵Here is a chronology of the attacks and plots across Europe
- #2
On 24 February 2022, a cyberattack on the KA-SAT satellite network disrupted communications in Ukraine and several EU countries. The EU attributed the attack to Russia. [2/25] consilium.europa.eu/en/press/press…
- #3
In 2023, Poland uncovered a Russian spy ring monitoring supply routes to Ukraine. Latvian authorities linked arson at a company that year and a plan to burn a truck with Ukrainian plates in early 2024 to Russian intelligence. [3/25] polskieradio.pl/395/7784/artyk…
- #4
In 2023–24, a man planned sabotage in Germany for a contact linked to Russian intelligence, a court later found. Estonia’s security service linked attacks on a minister’s car, a journalist’s car and memorials to Russia. justiz.bayern.de/gerichte-und-b… [4/25]
- #5
In February 2024, a car with Ukrainian plates was burned in Tartu. On 28 February, someone threw a petrol bomb into Riga’s Occupation Museum. Estonian authorities and the EU attributed these attacks to Russian intelligence. kapo.ee/sites/default/… [5/25]
- #6
Men recruited by Wagner organised an arson attack on a London warehouse on 20 March 2024. It stored humanitarian aid and Starlink equipment for Ukraine. The organisers and arsonists were later convicted. cps.gov.uk/cps/news/how-c… [6/25]
- #7
On 13–14 April 2024, an incendiary device caused a fire at a Warsaw OBI store. Prosecutors say the suspect acted for Russian intelligence and filmed his actions. The footage later appeared on Russian propaganda sites. [7/25] gov.pl/web/prokuratur…
- #8
In April 2024, GPS interference prevented planes from landing in Tartu. Finnair suspended flights between Helsinki and Tartu while an alternative landing procedure was arranged. Estonia blamed Russia for the interference. [8/25] vm.ee/uudised/valism…
- #9
An IKEA store in Vilnius was set on fire on 9 May 2024, followed by Warsaw’s Marywilska 44 mall on 12 May. A planned IKEA arson in Riga was prevented. Prosecutors say the group responsible worked for Russian intelligence. gov.pl/web/prokuratur… [9/25]
- #10
On 14 May 2024, people painted red hands on the Shoah Memorial in Paris. Four defendants were later convicted of vandalism. Investigators suspected Russian involvement, but the court did not establish that Russia ordered it. [10/25] sos-racisme.org/actualites/tag…
- #11
In May 2024, depots in Warsaw and Radom were set on fire. Polish prosecutors linked the organiser to Russian intelligence. The accused man also set fire to buses in Prague that June and was convicted in 2025. [11/25] gov.pl/web/prokuratur…
- #12
In summer 2024, CNN reported a foiled Russian plot to kill Rheinmetall’s CEO. Other suspects began watching two intended victims in Lithuania. Prosecutors later linked those murder plots to Russian military intelligence. [12/25] edition.cnn.com/2024/07/11/pol…
- #13
In July 2024, parcels sent from Lithuania caught fire in Germany, Poland and Britain. Investigators later identified a group suspected of carrying out the attacks for Russia’s military intelligence service, the GRU. eurojust.europa.eu/news/joint-inv… [13/25]
- #14
On 30 July 2024, Romanian authorities arrested a man surveying a recycling depot in Bragadiru, near gas, oil and telecom facilities. Romania’s intelligence service said he was preparing sabotage on instructions from Russian services. [14/25] sri.ro/articole/SRI-a…
- #15
On 17 and 22 September 2024, people tried to set fire to TVC Solutions in Šiauliai, Lithuania, where equipment for Ukraine’s armed forces was stored. Both attempts failed. Prosecutors say Russian military intelligence ordered the attacks. [15/25] prokuraturos.lt/lt/baudziamoji…
- #16
Dutch intelligence said Russia carried out two cyberattacks in the Netherlands in 2024. One targeted a public facility’s control system without causing damage. The other failed to access critical infrastructure. The dates were not disclosed. [16/25] defensie.nl/actueel/nieuws…
- #17
In December 2024, hackers manipulated pumps at Denmark’s Tureby–Alkestrup waterworks. Pipes burst, and households lost water. Danish intelligence said Russia carried out the attack through the Z-Pentest group. [17/25] fe-ddis.dk/da/nyheder/202…
- #18
In Estonia, a supermarket in Osula was set on fire on 17 January 2025 and Tallinn’s Slava Ukraina restaurant on 31 January. Prosecutors later reported a conviction for both attacks, which they said were ordered by the GRU. aastaraamat.prokuratuur.ee/prokuratuuri-a… [18/25]
- #19
In March 2025, test parcels containing GPS trackers were sent from Germany to Ukraine for a Russian sabotage operation. One man was later convicted and two were acquitted. The court did not find that they knew about plans to send incendiary parcels. [19/25] zdfheute.de/panorama/krimi…
- #20
In spring 2025, hackers tried to disrupt a heating plant in western Sweden. The government later linked the attackers to Russian intelligence and said protective systems had prevented damage. It disclosed the case in April 2026. [20/25] svt.se/nyheter/inrike…
- #21
In August 2025, arsonists burned railway relay cabinets and a locomotive in Latvia. Latvia’s security service said the attacks caused significant damage and were carried out in Russia’s interests. It disclosed the case in March 2026. [21/25] vdd.gov.lv/en/news/press-…
- #22
On 14–15 October 2025, Romanian authorities intercepted and disarmed two incendiary parcels at a Nova Post branch in Bucharest. Romania’s intelligence service said Russian intelligence had directed the attempt to set fire to the branch. [22/25] sri.ro/articole/comun…
- #23
On 15–16 November 2025, an explosion damaged a railway near Mika, Poland, and another attack damaged the line near Puławy. Polish officials blamed Russian intelligence and said the attacks were intended to cause a train disaster, which was prevented. gov.pl/web/premier/pr… [23/25]
- #24
On 29 December 2025, cyberattacks targeted Polish wind, solar and heating facilities. One plant briefly stopped production, but customers did not lose heating. Polish officials suspected Russian involvement. [24/25] cert.pl/posts/2026/08/…
- #25
On 4 August 2026, an explosive drone was used in an attempted attack at Leipzig/Halle airport. On 1 September, the German government publicly held Russia responsible. [25/25] bundesregierung.de/breg-de/schwer…
- #26
Subscribe to our newsletter to stay up to date: nestcentre.org/#subscribe Follow @nestcentreorg for analysis of Russia and the choices facing Europe.
