Russia’s shadow war follows the support for Ukraine

On 23 September, a fire broke out at the Starlink station in Wola Krobowska, south of Warsaw. Parts of the facility’s infrastructure had been set alight. The investigation led Polish authorities to Germany, where two men were later arrested.

According to the Polish Interior Ministry, the attack was ordered by Russian intelligence services. The target is part of the satellite network Ukrainian forces use for communication.

On 9 October, Starlink antennas outside Sofia, Bulgaria, were hit by an arson attack. Prosecutors believe two German citizens carried out the operation during a short stay in the country. Both were charged in absentia and are wanted internationally. Who ordered the attack was still under investigation.

On the night of 18 October, another attempt followed, this time outside Vilnius, Lithuania. The country’s national crisis management centre linked the incident to Russia and to the attacks in Poland and Bulgaria. The authorities assessed that the saboteurs were trying to weaken Ukraine’s military capacity.

In under four weeks, the same type of communications facility had been attacked, or targeted for attack, in three European countries.

For Tomasz Siemoniak, the minister who coordinates Poland’s security services, this is part of a far denser stream of incidents. At a security conference in Warsaw on 13 October, he described Russian subversion as nearly daily. He said not a week passes without such activity, and that other European countries are experiencing the same.

Before the equipment reaches the front

Communications facilities are one link between Ukraine and the countries supporting its defence. Other links are factories, suppliers and transport routes.

Denmark’s Forsvarets Efterretningstjeneste (FE) described in September a trend in which Russia increasingly tries to stop support from getting through. The service pointed in particular to sabotage against the defence industry and against railways that carry military materiel.

This summer’s investigations show how concrete that threat can become.

At Delair’s drone factory near Toulouse, France, firebombs were thrown in early June. On 3 June, a man was arrested while filming a drone prototype. The factory supplies both French and Ukrainian forces.

According to prosecutors, the man had sent a video to a contact in Russia. He was placed under investigation for offences against French national interests.

On 15 August, the defence company Milrem in Estonia was hit by arson. The security service KAPO assesses the attack as planned and commissioned by Russian security services. The suspects were arrested shortly afterwards.

KAPO states that, together with its partners, it has since the full-scale invasion of Ukraine identified and arrested more than 20 people involved in physical attacks on behalf of Russian security services.

Leipzig/Halle airport in Germany has also been the target of a foiled drone attack. According to German authorities, as relayed by Danish FE, the operation had been planned in Russia over several months.

A target can begin with a photograph

Several investigations begin before the fire, with the mapping of people and buildings.

In March, police arrested two people in Spain and Germany, suspected of surveilling a German supplier of drones and components for Ukraine. One was arrested in Elda, the other in Rheine.

According to German prosecutors, the assignment included filming the supplier’s workplace and mapping the home of a person connected to it. Investigators believe the surveillance was carried out on behalf of Russian intelligence.

In Latvia, the perspective was lifted from street level to the air. A person is said to have photographed the Ādažimilitary base from a small private plane on behalf of the Russian military intelligence service, the GRU.

This came out when the security service VDD made public, on 1 October, the case against a married couple arrested on 28 June. They are suspected of gathering information on defence facilities, radars, military flight movements, NATO forces and support for Ukraine. According to VDD, the couple had also carried out activities that could support reconnaissance and sabotage groups.

On 22 October, a new arrest came in Germany. A Ukrainian man is suspected of collecting information about weapons production and about military personnel and facilities linked to NATO’s eastern flank.

According to prosecutors, the man had contact with Russian intelligence through an intermediary. Some of the material came from open sources. He is alleged to have obtained other information from contacts in European arms manufacturing.

The people who open the doors

Access to information recurs in several investigations.

Belgian prosecutors confirmed in June that a 46-year-old man had been arrested on 29 May. He is suspected of passing state secrets to people with links to Russia. Belgium’s military intelligence service had examined the case for several months.

In Italy, two men were arrested in Rome on 7 July in an investigation into possible espionage for Russia. According to ANSA, the case concerned, among other things, classified information about production in the defence sector.

A British case shows how an investigation can also concern preparations for physical harm. In September, a 31-year-old from Swindon in the United Kingdom was charged with assisting a foreign intelligence service and preparing sabotage.

The Crown Prosecution Service (CPS) stated that the man had allegedly received instructions from a person linked to the GRU Volunteer Corps, a group controlled by Russian military intelligence.

Other operations target the decisions behind the support for Ukraine.

On 10 August, Säpo in Sweden announced that a Russian intelligence operation had been stopped. The security police had documented meetings between a recruited agent and two officers from the Russian foreign intelligence service, the SVR.

According to Säpo, the aim was to influence Swedish decisions and undermine trust in Sweden, the EU and NATO. All three had diplomatic immunity and left the country.

Diplomatic circles have also been the subject of action further south. Hungary expelled ten Russian diplomats in September on national security grounds. On 23 October, Austria announced the expulsion of four more, based on findings by its security authorities. Three worked at the embassy in Vienna. The fourth was attached to Russia’sdelegation to the Organization for Security and Co-operation in Europe (OSCE).

Inside the systems

Digital espionage can give access to the same circles that are mapped with cameras and human sources.

On 13 July, French authorities linked attacks using the Turla toolset to the 16th Centre of the Russian security service FSB. According to CERT-FR, ministries and organisations in diplomacy, defence, justice and technology were among those affected.

In March, security researchers at Ctrl-Alt-Intel had documented compromised email systems in Greece, Romania, Bulgaria and Serbia, in addition to Ukraine. The researchers tied the infrastructure to APT28, also known as Fancy Bear, which Western security authorities have identified as part of the GRU. The findings included accounts linked to the Greek defence staff.

Denial-of-service attacks work differently: they try to make services unavailable.

In Czechia, the cybersecurity authority NÚKIB registered more than 70 cyber incidents in the first quarter. A wave of denial-of-service attacks by pro-Russian activists in January contributed substantially to the increase. The statistics also include data breaches and incidents involving other actors.

In Norway, ID-porten was hit by its third denial-of-service attack in nine weeks, between 24 and 26 August. The attack was two to three times stronger than the previous ones, according to the Norwegian Digitalisation Agency (Digdir). Services were largely available throughout the incident.

The pro-Russian group Server Killers claimed responsibility itself. The attack targeted a gateway citizens use to reach public services.

For pilots and seafarers in Finland, interference with satellite navigation has been a recurring burden. The Finnish Transport and Communications Agency, Traficom, reported a clear increase from February 2026.

Traficom links the signals to Russian territory and to Russia’s protection of its own installations. The effects are felt across the border too, with daily registrations in affected areas at the cruising altitude of passenger aircraft, and disruption in the eastern part of the Gulf of Finland.

Along the coasts

At sea, authorities must distinguish between ordinary traffic, intelligence gathering and possible preparation for sabotage.

In early April, military aircraft and coastguard aircraft followed a large group of Russian shadow fleet tankers off Ireland. Five sailed in convoy through the Irish exclusive economic zone.

The fishing vessel Ester also passed through. Norwegian authorities had in 2023 found a hidden military radio on board. The Irish Times described the vessel as previously suspected of covert maritime surveillance. The passage through the Irish exclusive economic zone documented the vessel’s movements, while the question of any sabotageactivity would require other evidence.

On 9 April, British authorities made public an operation in which the United Kingdom and Norway had tracked Russian underwater units.

According to the British Ministry of Defence, an attack submarine served as a decoy while vessels from the Russiandeep-sea directorate GUGI operated near critical undersea infrastructure. The vessels later withdrew after being tracked and made aware that they were under surveillance.

In June, the coastguard in Iceland followed the intelligence ship Yuri Ivanov, which had also been observed at NATOexercises and off Norway and the United Kingdom. Icelandic authorities assessed the activity as intelligence gathering and surveillance. At the same time, they said there were no indications of a threat to undersea infrastructure or other shipping.

Off Gedser in Denmark, the encounter was more direct on 14 September. A Russian frigate fired light signals at a Danish military helicopter. Danish FE described the incident as the most serious that Danish military units had been exposed to in this context. PET, the Danish security and intelligence service, had also warned publicly about Russianplanning of sabotage against Danish defence industry.

In the Black Sea, this security picture meets the open war against Ukraine. On 23 October, the merchant ship Khoryvwas struck by a drone just outside Romania’s territorial waters near Constanța. The ship was badly damaged and capsized. Romanian authorities and EU leaders linked the attack to Russia.

Romanian authorities reported the same day that nine seafarers had been rescued alive, one had died and three were missing.

The workplace as a target

On land too, human lives lie behind the wording about industry and infrastructure.

When police in Slovakia announced on 25 August that an arson attack on a drone manufacturer had been foiled, they described what could have happened inside the factory. The attack could have triggered a large fire, endangering life and health.

Two suspects were arrested in Slovakia and a third in Germany. Police believed they had acted on others’ instructions. The party who commissioned the attack had still not been publicly named.

Around 70 workers could have been inside the production facility when the planned attack was to be carried out.