6 hours ago
12
Serhiy was just about to board a coach bound for Germany when Polish security services detained him at the bus station in the city of Wrocław.
In his backpack, the officers found firelighter cubes, a juice bottle filled with paraffin, a lighter, two pocket knives, a mini handsaw and a face mask. Later, when they searched the mobile phone of the 49-year-old Ukrainian refugee, they found a pdf of a Russian-language book called Modern Pyrotechnics. It contained detailed instructions on how to start fires and detonate explosives.
Serhiy S – as he is identified in accordance with Polish law on naming criminal suspects – is one of dozens of people who have been rounded up across Europe over the past two years and accused of being foot soldiers in a new front of Russia’s war against the west.
European intelligence agencies say Moscow has launched a campaign of sabotage, arson and disinformation against the continent. Sometimes, it is focused on specific targets related to support for the Ukrainian war effort, but more often it is simply aimed at causing chaos and unease.
In Lithuania, an Ikea shop was set on fire; in Britain, seven people were charged over an arson attack on a business with links to Ukraine; in France, five coffins inscribed with the words “French soldiers in Ukraine” were left under the Eiffel Tower; in Estonia, the car windows of the interior minister and a local journalist were smashed. There have been numerous suspicious fires in Poland, including one that destroyed a huge shopping centre in Warsaw.
Taken together, the incidents point to how Russia’s intelligence services have moved towards a new kind of attack on the west, one that is dangerous and violent but also piecemeal and hard to prove.
On the ground, the acts are carried out by people who are recruited online and often paid in cryptocurrency. Some know exactly what they are doing and why, others do not realise they are ultimately working for Moscow. The professional intelligence officers who direct the operations never need to leave Russian territory.
This account of Russia’s sabotage offensive is based on thousands of pages of court documents from Britain and Poland, interviews with current and former security and intelligence officials in several European countries and the US, and discussions with people who knew some of the perpetrators.
“It’s easier to deal with spies under diplomatic cover or even [deep-cover] illegals,” said one senior European security official. “This kind of action is becoming dangerous for all of us.”
Just how aggressive the campaign might become remains a matter of conjecture. Western intelligence officials say that in recent months there has been a lull, perhaps as Vladimir Putin explores the possibility of improved relations with the US under Donald Trump.
But before the change of US administration, there were signs that Moscow was raising the stakes ever higher. Intelligence last year about an apparent plot to send exploding parcels to the US, which could have led to a plane crash and mass casualties, caused so much alarm in Washington that top Biden administration security officials called their Russian counterparts to warn them that such an escalation would force the US to respond. They were not sure if the orders had come from the Kremlin or from overenthusiastic mid-level planners.
“We didn’t know if Putin had approved it or knew about it,” said a former US security official. In a series of calls, senior Russian officials denied there was any such operation in the works but promised to pass on the message to Putin.
The phone calls seemed to put an end to the exploding parcels plan, but the episode left nerves frayed over what lines Russia might be willing to cross in future, and what the consequences might be.
“Their goal is not the same as Islamist jihadists who want as many victims as possible,” said Harrys Puusepp, the head of bureau at Kapo, Estonia’s internal security agency. “But if someone dies, they don’t care.”
Serhiy was born in Odesa in 1974 into a Soviet military family. As he was finishing school, the Soviet Union collapsed and his home city became part of independent Ukraine. The years went by, and Serhiy grew increasingly disdainful of the government in Kyiv, believing it discriminated against Russian speakers like him.
His motto, displayed on his Facebook page, was: “I speak Russian. Only Russian”. After the Maidan revolution of 2014, he spent a lot of time scrolling through pro-Russian news websites. Soon after the full-scale invasion in February 2022, he left a comment under a political video on a Telegram channel, and another commentator, a man called Alexei, messaged him privately to say he agreed with Serhiy’s point of view.
Alexei said he was a Kyiv-based businessman in the construction sector, and asked a lot of questions about Serhiy’s life and work. He made it clear he also hated Volodymyr Zelenskyy and the Ukrainian authorities.
In the middle of 2023, scared of being conscripted into the Ukrainian army to fight in a war he did not believe in, Serhiy illegally crossed the border into Moldova. He made his way to Germany, where a former schoolfriend from Odesa told him there was casual work that paid €75 a day.
After a few months of doing these odd jobs, his old Telegram buddy Alexei got back in touch from a new account. Alexei said he was now based in the Baltic states and suggested meeting up in Latvia or Lithuania to discuss a business proposal.
Serhiy told him it was too far away and too expensive for him to travel, but Alexei offered to pay for the trip and suggested a closer destination – Wrocław in Poland. He transferred about £350 in Ukrainian currency to Serhiy’s wife’s bank account, and Serhiy bought a bus ticket to Wrocław. He left on 27 January 2024.
Soon after Serhiy arrived in Poland, Alexei called him and apologised – something had come up and he was not able to travel. But he could reveal the business proposal: he wanted Serhiy to look for shopping malls and industrial centres in Wrocław and photograph them. If they found a suitable place, Serhiy was to set it ablaze. Alexei would pay him $2,000 upfront, and a further $2,000 on receiving proof of the arson.
For Serhiy, who was taking day jobs to keep afloat, it was a huge amount of money. According to the story he later told Polish investigators, he asked no questions about who might want to order such a plan or why.
Serhiy paced the streets of Wrocław looking for possible targets. Eventually he settled on a paint wholesaler in an industrial estate on the outskirts of town. He sent photographs of the building to Alexei, who agreed it was an excellent target – near various sensitive infrastructure sites and close to a canal that could be heavily polluted if paint spilled into it. Serhiy bought supplies for starting a fire.
But at some point, all alone in Wrocław and realising the seriousness of what he had signed up for, Serhiy got cold feet.
He remembered a building near his home in Germany that had burned down, and told his wife to send him a photo of it. Perhaps, he thought, he could send that to Alexei and pass it off as somewhere in Wrocław, to get the money without doing the deed. He decided there would be no arson, on this trip at least, and bought a bus ticket back to Germany. He was arrested just before he boarded the coach.
A week after Serhiy was arrested, a message appeared on a small Telegram group with 28 subscribers that shared white supremacist content. It was posted below an image of a mountain range that, if you squinted, appeared to show an image of Adolf Hitler’s face.
“Attention! Fight with blacks. We are looking for partisans in Europe,” read the message, in English. “We are looking for comrades who make arson to the store of black migrants.” The reward was $5,000. Attached was a photograph of the building Serhiy had identified.
The account that posted the message was the same one used by “Alexei”, who had told Serhiy he was a construction magnate from Kyiv. Now, the account was posing as a European neo-Nazi.
In fact, Polish authorities believe, it was run by a staff officer of the GRU, Russia’s military intelligence service.
Russia’s campaign of setting things on fire did not come out of nowhere. Research in the archives of communist security services shows that sabotage in enemy countries was part of the KGB’s intelligence doctrine as early as the 1960s, to be launched in times of heightened tension or war.
After the annexation of Crimea and the start of the war in east Ukraine in 2014, Russian operatives targeted ammunition factories and arms dealers in Europe who supported Ukraine. Unlike much of the current wave of sabotage, those attacks were carefully planned, using trained operatives against specific targets.
Many of those who carried it out were from a shadowy GRU unit known as 29155, whose tasks included sabotage and assassinations across Europe. However, their activities were so brazen that they were eventually unmasked. After the poisoning of Sergei Skripal in 2018 with the nerve agent novichok, British authorities – as well as investigative journalists from the outlet Bellingcat – identified the poisoners as 29155 operatives.
In response, European countries ordered the expulsion of hundreds of Russian intelligence officers working under diplomatic cover out of embassies. Checking passport databases, Bellingcat was able to identify many other 29155 operatives who had been used on short-term missions, busting their cover and rendering them unable to travel. Then, after the full-scale invasion of Ukraine in February 2022, there was a new round of diplomatic expulsions.
These episodes severely hampered Moscow’s ability to operate outside Russia, and spy bosses had to get creative to plug the gaps. First, some of the clean diplomats still abroad were co-opted. “We saw them tasking ordinary diplomats with intelligence activities, and this is not a phenomenon limited to Estonia,” said Puusepp, in an interview at the domestic security agency’s headquarters in Tallinn.
Second, Russia activated its network of “illegals”, deep-cover operatives posing as foreigners, whose missions could last decades. Giving them more daring missions meant more risk of capture, and in the year after the invasion of Ukraine, illegals were identified in Slovenia, Norway, Greece and Brazil. Those who did not flee in time were arrested.
Third, Russia turned to the services of all kinds of freelancers. In some cases, this meant hiring people with organised crime ties, such as Orlin Roussev, a Bulgarian based in the UK who ran surveillance and other operations for Russia using a group of fellow Bulgarians he called his “minions”, three of whom were found guilty last month at the Old Bailey in London.
In addition to using new actors to carry out old tasks, Moscow also launched a campaign of sabotage that was much broader than anything seen before. Unlike the earlier, targeted actions, this wave would be more scattergun and have different goals.
One former US intelligence official said that, in the immediate aftermath of the Russian invasion of Ukraine, Washington had expected to see massive Russian cyber-attacks launched against the west. These attacks largely did not materialise, and one theory is that Moscow went for a more explosive option instead. “The idea of sabotage was always in the field of vision as a possibility, but it’s still very surprising to see it play out,” said the former official.
In many cases, it is hard to prove Moscow’s involvement beyond reasonable doubt. There have been mixed signals over whether damage to a series of undersea cables in the Baltic Sea was the result of nefarious Russian actions or had more innocuous causes. But even when there is no apparent evidence of foul play, such as in the fire that closed down Heathrow airport last month, there is now inevitable speculation of possible Russian involvement.
“It creates a kind of fog,” said one senior European security official. “In the beginning some of these things look natural, but then it happens more and more and you start to wonder. You have cases where there is no proof, but we have strong suspicions.”
Many of the same operatives from unit 29155 who have been involved in sabotage operations for more than a decade are part of the new campaign, western officials say. The unit has been folded into a bigger GRU department and is still run by its longstanding chief, Andrei Averyanov.
But now, the work on the ground is done by one-time operatives recruited over Telegram, rather than the unit’s staff officers, most of whom are no longer able to travel to Europe. And instead of focusing narrowly on specific targets closely related to the Ukraine war, the approach is much broader, targeting shopping centres, warehouses and other civilian infrastructure.
“The strategic aim is to sow discord and insecurity. They are not destroying significant infrastructure. They are concentrating on soft targets that influence a general perception of insecurity in society. This is classic psy-ops,” said Piotr Krawczyk, the former head of Poland’s foreign intelligence service.
The way Moscow recruits operatives and selects targets varies from country to country. In the Baltic states, the Russian services make use of the extensive family ties of the local Russian-speaking population, according to intelligence officials there. Recruitments are made during visits to Russia, and Telegram is then used for communication, rather than for making the initial contact. The motivating factor is usually either money or blackmail.
Puusepp said: “It’s not a question of ideology but of business and relatives inside Russia. When we look at the people, their overall understanding of the world is not about much more than survival.”
Elsewhere in Europe, people are recruited over Telegram, without any in-person interaction at all. Some, like Serhiy, initially think they are talking to like-minded friends about a joint business project. Others may think they are working on the orders of white supremacist groups or domestic political actors.
Operatives are recruited via the grey employment groups where immigrants often find casual gig-economy work that pays under the counter. Often, they are people who have operated on the margins of the law for some time, and when the order comes to burn something down, they may think it is part of a criminal dispute rather than intelligence work.
Some recruits do have an ideological affinity with Russia, such as Serhiy, who supported Russia’s war in Ukraine and longed for his native Odesa to become Russian-controlled. More often, though, there is no ideological component.
Last May, Polish authorities arrested a Pole and two Belarusians on suspicion of planning sabotage acts for the Russians inside Poland. All three men had previously fought in Ukraine on the side of Kyiv.
A separate group of 16 saboteurs, mostly Ukrainian and Belarusian men, was apprehended in Poland in early 2023 and later sentenced. This group mainly comprised people who had little sympathy for the Kremlin’s geopolitical goals but were simply looking to earn money in the gig economy.
The recruits were offered tasks in Poland that ranged from posting anti-Nato flyers to installing cameras that would monitor trains with humanitarian and military cargo bound for Ukraine. Payments, made in cryptocurrency, ranged from $5 for putting up a poster to $400 for installing a camera.
The group’s activities were directed by a man who identified himself only as “Andrei”, and who communicated with two of the group and told them to distribute tasks among the others.
One of the defendants, a 20-year-old Belarusian woman who was arrested and convicted with her boyfriend, claimed that neither of them were supporters of Russia’s war effort. Her boyfriend, she claimed, would often put up a poster, take a photo to provide proof, and then immediately pull it down.
“He was doing this to earn money for us, because I was spending a lot. He just did it to have some extra cash without thinking of the consequences,” she wrote in a letter to her family after her arrest. “This is the worst thing to happen to me in my whole life.”
In late February, Serhiy was brought into a courtroom in Wrocław, dressed in the red prison overalls reserved for highly dangerous prisoners, his hands and legs in chains.
“The goal of the accused was to lower our morale, to question the effectiveness and competency of our state, and to question our support for Ukraine,” said the judge, Marcin Myczkowski, reading his verdict.
Serhiy looked on impassively, giving the occasional sigh, as an interpreter whispered the judge’s words into his ear. He had previously agreed a plea bargain with prosecutors in exchange for a three-year sentence but Myczkowski cancelled the deal, claiming it was too lenient.
Even though Serhiy had not, in the end, set anything on fire, and was arrested when he was about to board a bus out of the country, Myczkowski handed him an eight-year sentence. In part, the judge said, it was meant as a warning to others – “a clear and unequivocal signal to you and to all potential candidates that committing such acts is not worthwhile”.
For the Russians, the benefit of using one-time operatives is that, if something goes wrong, Moscow can discard them and leave them do their time in prison. No Russian diplomats are working behind the scenes to free Serhiy, and it is highly unlikely that he would be included in any prisoner exchange. Instead, the controllers at GRU headquarters can simply set up new Telegram accounts and start the process again.
“You jail one person and another pops up to take their place. These people are disposable and Moscow doesn’t care about them,” said a European security official.
The possibility that anyone looking for odd jobs on Telegram could be signing up for Russian intelligence missions sparks surveillance and privacy dilemmas reminiscent of counter-terrorism work, as authorities scramble to catch potential perpetrators before they act.
There is another question, too, brought into focus by the alleged aborted plot to send explosive packages to the US last year: what is the endgame?
One senior security official said that as Russia increasingly considers Europe a party to the war in Ukraine, the sabotage campaign is only likely to intensify as long as the war goes on. “They are crossing one red line after another and we don’t know how far they will go,” said the official.
Additional reporting by Ada Petriczko
