Russia’s Covert Sabotage Campaign Targets European Infrastructure

On November 15, a significant explosion occurred on the Warsaw-Lublin railway line near Mika, Poland, disrupting a vital logistics route for military support to Ukraine. The blast, attributed to a C-4 explosive, compromised both the railway tracks and a freight train, halting rail traffic and raising security alarms across Poland, a crucial ally to Kyiv. Polish authorities have since charged three Ukrainian nationals—Oleksandr K., Yevhenii I., and Volodymyr B.—with carrying out the attack under Russian guidance. This incident highlights a broader trend of covert sabotage operations targeting critical infrastructure throughout Europe.

According to Ivana Stradner, a research fellow at the Foundation for Defense of Democracies, these operations represent a “long, low-cost pressure campaign” by Russia that seeks to undermine public support for Ukraine across European nations. Polish prosecutors have detailed the meticulous planning behind the attack. In September 2025, Volodymyr B. was arrested after conducting reconnaissance at the site, enabling the identification of the optimal location for the explosive device. Following the attack, Radoslaw Sikorski, Poland’s Foreign Minister, described the incident as “state terror,” leading to the closure of Russia’s last consulate in Gdansk and the deployment of thousands of soldiers to protect critical infrastructure.

The Kremlin rejected these allegations, labelling them as “Russophobia” and promising retaliation by severing diplomatic ties with Poland. This exchange of accusations reflects a larger strategy of employing sophisticated, low-profile attacks aimed at degrading Ukraine’s supply lines without instigating a full-scale conflict.

The use of proxies marks a distinct feature of Russia’s sabotage strategy. Local citizens and displaced individuals are often recruited to carry out these operations, providing Russia with plausible deniability. In Poland, the involvement of Ukrainian nationals has raised alarms regarding a recruitment campaign targeting vulnerable youth from war-affected areas. Ukrainian security services have reported that over 170 minors have been ensnared by Russian operatives in the last 18 months, often enticed through social media platforms like Telegram.

These recruits are typically individuals facing economic hardship or possessing criminal backgrounds. Tasks that initially appear harmless, such as taking photographs or sending postcards, can escalate into dangerous activities, including bomb placements. Vasyl Bohdan, head of Ukraine’s National Police Juvenile Prevention Department, emphasized the subtlety of these operations, noting that many young recruits often do not comprehend the severity of their actions.

The recruitment process often involves Russian operatives posing as sympathetic figures to build trust with potential recruits. Once a relationship is established, they utilize compromising information to exert pressure and secure compliance. In one instance, two teenagers in Ivano-Frankivsk were promised $1,700 each to plant a device that ultimately resulted in tragedy.

While Ukraine has increased its countermeasures, including public awareness campaigns in schools, the threat remains significant. Reports of attempted recruitments surged to 74 this year, but successful cases have dramatically decreased. Bohdan remarked that the number of successful child recruitment cases has fallen “exponentially” over the past year.

Despite these advances, analysts like Natalya Goldschmidt, CEO of Lightning Associates LLC, assert that Russia’s hybrid operations and cognitive warfare tactics remain effective against a fragmented Europe facing numerous domestic issues. Goldschmidt warns that the most concerning threat in the coming year may not involve a singular spectacular attack, but rather a series of coordinated incidents that create a strategic shock, potentially targeting critical supplies and energy links.

Coordinated sabotage activities have also been reported beyond Poland. In October, Romanian intelligence disrupted a similar operation involving two Ukrainian citizens who smuggled bomb components into Bucharest, targeting the Nova Post headquarters—an important courier service for Ukrainian aid. Investigators believe this operation is linked to a broader Russian network, including the notorious GRU Unit 29155, which specializes in sabotage and is led by General Andrei Averyanov.

Reports of sabotage have surfaced across Europe, including instances of undersea fiber optic cable damage and disruptions to GPS navigation in the Baltic region. These incidents have prompted serious investigations and a reevaluation of security measures among European nations. NATO has conducted consultations in response to a rise in drone incursions and airspace violations, notably involving Russian aircraft.

These subtle tactics, while seemingly tactical, serve a larger strategic goal of testing NATO’s unity and response mechanisms. Stradner points out that Vladimir Putin aims to undermine NATO’s Article 5, which stipulates collective defense among member states, thereby fostering ambiguity and inaction.

Some analysts, such as Alexander Graef, Senior Policy Fellow at the European Leadership Network, argue that these sabotage efforts aim to influence public opinion in Western societies rather than significantly disrupt logistics. Graef contends that Moscow misreads the West’s threat perceptions, as such actions often reinforce the view that Russia poses an escalating danger, thereby bolstering support for Ukraine.

Despite the ongoing sabotage, experts maintain that NATO’s collective defense clause remains a high threshold for invoking military support. Graef notes that low-level incidents are unlikely to provoke a unified response among member states.

As Europe ramps up its defenses in response to these threats, there is a growing recognition of the need for coordinated measures. Following airspace breaches, EU defense ministers are prioritizing the deployment of enhanced surveillance and counter-sabotage efforts along the eastern flank. Graef emphasizes that combating sabotage will require collaboration among law enforcement, counterintelligence services, and judicial authorities.

Despite these initiatives, concerns persist that Europe remains reactive rather than proactive, with some analysts arguing that existing measures are insufficient to counter Russia’s ongoing threats. Maksym Skrypchenko, a nonresident scholar in the Russia Eurasia Program, asserts that European governments need to acknowledge the severity of the threat posed by Russia and implement decisive actions to protect their infrastructure.

In conclusion, while the ongoing sabotage campaign reflects a strategic shift in Russian operations, the responses from European nations and NATO will be crucial in determining the effectiveness of these tactics. Addressing the ambiguity surrounding acts of aggression and enhancing collective defense mechanisms will be critical in countering Russia’s hybrid warfare strategy. Failure to act decisively may allow these threats to persist and escalate.