Russia is shifting from individual recruits to professional networks to carry out sabotage and other attacks across Europe, threatening civilian safety and critical infrastructure as Moscow intensifies its undeclared war against democratic institutions, Poland's internal security service said in a report published Wednesday.
The report said many of the people involved were recruited online as disposable agents and some had no idea they were working for Moscow, but Russia is now moving away from those low-cost, one-time recruits toward more professional operations that tap into organized crime networks. The Associated Press said it has tracked more than 150 such incidents linked to Moscow by Western officials over four years since the invasion of Ukraine.
Unprecedented Threat Scale
Poland's Internal Security Agency, or ABW, said Poland has conducted as many espionage investigations in the past two years as it did over the previous three decades, and said 62 people have been arrested. The dramatic escalation reflects the growing danger to European citizens and democratic institutions from coordinated hostile operations.
ABW said those espionage efforts are part of Russia's "undeclared war with the Western world," in which "Russian intelligence is increasingly using methods typical of special forces (reconnaissance and sabotage)." The report said the long-term goal of the Russian Federation remains the disintegration of Euro-Atlantic structures, the isolation of specific countries and their internal socio-political and economic destabilization.
It said some of the espionage activities were also dictated by Belarus' secret services, which are "closely cooperating" with Moscow, as well as by China. ABW said the "mass surveillance" operations in Poland are meant to set the ground for acts of diversion, which it considers "the most serious challenge" it faces, and said Russian intelligence services are accepting the possibility of "occurrence of fatalities."
Professional Sabotage Networks Emerge
The agency said that in 2024 and 2025, 69 espionage investigations were initiated, the same total number as between 1991 and 2023. It said that in 2023 Russian services were still basing their operations mainly on so-called one-time agents recruited ad hoc via the internet, but in 2024-2025 Russia placed greater emphasis on the creation of "complex sabotage cells" relying on "the closed structures of organized crime."
ABW said, "Russians prefer individuals with experience in law enforcement (e.g., former soldiers, police officers, mercenaries from the Wagner Group)," and added that Russian services had intensified training conducted on the territory of Russia itself, aimed at "professionally preparing agents for terrorist activities." The shift toward professional operatives with military and law enforcement backgrounds represents a significant escalation in the threat to civilian populations and critical infrastructure.
Recent Attack on Critical Infrastructure
Six months ago, in November 2025, Poland faced what Prime Minister Donald Tusk called an "unprecedented act of sabotage," when explosions and other malfunctions on a section of railway line used for deliveries to Ukraine affected two trains, including a passenger train. There were no casualties. The attack targeted infrastructure vital to supporting Ukraine's defense against Russian aggression, demonstrating how sabotage operations threaten both civilian safety and international solidarity.
Why This Matters:
The professionalization of Russian sabotage networks across Europe represents a direct threat to civilian safety, democratic institutions, and the collective security framework that has maintained peace on the continent. Poland's experience—conducting as many espionage investigations in two years as in the previous three decades—reveals the scale of hostile operations targeting European societies. The willingness of Russian intelligence to accept civilian casualties, combined with the recruitment of professional operatives trained in terrorist activities, places ordinary citizens at risk as they go about daily life, whether commuting on trains or relying on critical infrastructure. The targeting of railway lines used for Ukraine aid demonstrates how these operations aim to undermine democratic nations' ability to support each other against aggression. The involvement of organized crime networks further threatens the rule of law and public safety. Effective response requires coordinated action among European security services, robust legal frameworks to prosecute saboteurs, and sustained public investment in counterintelligence capabilities to protect communities from this escalating threat.