Russia is shifting from individual recruits to professional networks to carry out sabotage and other attacks across Europe, Poland's internal security service said in a report published Wednesday, marking a dangerous escalation in Moscow's hybrid warfare campaign that threatens critical infrastructure and national security across the continent.
The report said many of the people involved were recruited online as disposable agents and some had no idea they were working for Moscow, but Russia is now moving away from those low-cost, one-time recruits toward more professional operations that tap into organized crime networks. The Associated Press said it has tracked more than 150 such incidents linked to Moscow by Western officials over four years since the invasion of Ukraine.
Espionage Surge Unprecedented in Scale
Poland's Internal Security Agency, or ABW, said Poland has conducted as many espionage investigations in the past two years as it did over the previous three decades, and said 62 people have been arrested. ABW said those espionage efforts are part of Russia's "undeclared war with the Western world," in which "Russian intelligence is increasingly using methods typical of special forces (reconnaissance and sabotage)."
The report said the long-term goal of the Russian Federation remains the disintegration of Euro-Atlantic structures, the isolation of specific countries and their internal socio-political and economic destabilization. It said some of the espionage activities were also dictated by Belarus' secret services, which are "closely cooperating" with Moscow, as well as by China.
Organized Crime Networks Exploited
ABW said the "mass surveillance" operations in Poland are meant to set the ground for acts of diversion, which it considers "the most serious challenge" it faces, and said Russian intelligence services are accepting the possibility of "occurrence of fatalities." The agency said that in 2024 and 2025, 69 espionage investigations were initiated, the same total number as between 1991 and 2023.
It said that in 2023 Russian services were still basing their operations mainly on so-called one-time agents recruited ad hoc via the internet, but in 2024-2025 Russia placed greater emphasis on the creation of "complex sabotage cells" relying on "the closed structures of organized crime." ABW said, "Russians prefer individuals with experience in law enforcement (e.g., former soldiers, police officers, mercenaries from the Wagner Group)."
Professional Training for Terrorist Activities
The agency added that Russian services had intensified training conducted on the territory of Russia itself, aimed at "professionally preparing agents for terrorist activities." The shift toward professional training and recruitment of individuals with military and law enforcement backgrounds represents a significant upgrade in capability and threat level compared to the ad hoc online recruitment methods previously employed.
Critical Infrastructure Under Attack
Six months ago in November 2025, Poland faced what Prime Minister Donald Tusk called an "unprecedented act of sabotage," when explosions and other malfunctions on a section of railway line used for deliveries to Ukraine affected two trains, including a passenger train. There were no casualties. The incident demonstrated the vulnerability of critical infrastructure supporting Ukraine and the willingness of hostile actors to target civilian transportation networks.
Why This Matters:
The evolution from amateur online recruits to professional sabotage cells utilizing organized crime networks and trained former military personnel represents a fundamental escalation in the security threat facing Poland and other European nations. Poland's acknowledgment that it has conducted as many espionage investigations in two years as in the previous three decades underscores the unprecedented scale of Russian intelligence operations targeting Western infrastructure and institutions. The willingness of Russian intelligence services to accept "occurrence of fatalities" in sabotage operations elevates the threat beyond economic disruption to direct danger to civilian populations. The attack six months ago on railway lines used for deliveries to Ukraine demonstrates that critical supply chains supporting allied nations are vulnerable targets, with potential implications for defense readiness and economic stability. The involvement of Belarus' secret services and China in espionage activities further complicates the security landscape, requiring enhanced counterintelligence resources and international coordination at a time when defense budgets face competing demands.