Russia’s GRU directs escalating covert sabotage campaign across Europe

Infrastructure and Transportation Under Direct Assault

Sabotage incidents span multiple European nations and target critical supply chains supporting Ukraine. Roughly 27 percent of attacks targeted transportation networks like trains and airplanes, while another 21 percent struck critical infrastructure, including electricity grids, pipelines, and undersea fiber-optic cables. Industrial targets, particularly defense manufacturing facilities, accounted for another 21 percent of the recorded incidents. Weapons used in these operations frequently involved explosives and incendiaries, alongside blunt or edged instruments such as anchors utilized to sever subsea communication lines.

Germany’s Interior Ministry attributed an August incident at Leipzig airport to Russian hybrid operations. German authorities stated that the event involved a first-person view quadcopter carrying a Semtex-style plastic explosive near a Ukrainian cargo plane loaded with French-supplied ammunition. Following the discovery, Germany summoned Russian Ambassador Sergey Nechaev, terminated the leases for the Russian House of Science and Culture in Berlin and the Russian consulate in Bonn, and implemented new visa restrictions for Russian citizens. Russian officials dismissed the allegations, with Nechaev telling journalists that German authorities failed to provide material evidence or a solid case linking Moscow to the incident.

The Mechanics of Moscow’s Shadow Warfare

Moscow utilizes outsourced, low-cost proxy networks, ranging from criminal syndicates to radicalized local recruits, to maintain plausible deniability while conducting operations abroad. Franz-Stefan Gady, an adjunct senior fellow at the Center for a New American Security’s defense program, noted that such activities are attractive to the Kremlin because they degrade allied cohesion without crossing the threshold required to invoke Article 5, NATO’s mutual defense clause. Gady observed that escalation is a political choice and that the primary risk lies in Russia judging the alliance as too divided or slow to respond.

The Center for Strategic and International Studies analysis indicates that the Main Directorate of the General Staff of the Armed Forces of the Russian Federation, known as the GRU, executes these missions either directly through military officers or indirectly through recruited agents. Operations have also used Russia's "shadow fleet" of commercial vessels to circumvent Western sanctions while conducting undersea attacks. Attacks have directly affected U.S. and European assets, including military installations in Germany.

Deterrence and Allied Response Gaps

Western democracies have largely focused on defensive measures such as cyber defense and intelligence sharing, which researchers and defense analysts argue remain insufficient to halt the campaign. Franz-Stefan Gady pointed out that capabilities crucial for a crisis, including long-range strikes, suppression of enemy air defenses, and interceptor stocks, have been severely depleted by demands from conflicts in Ukraine and the Middle East, while agreed thresholds for a collective alliance response remain absent.

Meanwhile, NATO has increased military exercises near Russian borders, particularly in the Arctic. Russian Foreign Minister Sergey Lavrov criticized these maneuvers, stating that the alliance is driving the region toward militarization and creating focal points of international tension. As security frictions intensify, Dmitri Trenin, academic supervisor at the National Research University Higher School of Economics’ Institute for Global Military Economics and Strategy in Moscow, stated that the threat of a direct clash between Russia and NATO continues to grow.