The International Centre for Counter-Terrorism (ICCT), in collaboration with GLOBSEC, has released a report confirming that Russia is systematically conducting a hybrid war against Europe. Researchers documented incidents of sabotage, diversion, and destabilization carried out through networks of intermediaries, criminal groups, and “one-off agents.”
From February 2022 to February 2026, 151 incidents linked to Russian activity were identified across Europe, with 41 new cases reported in the most recent period. Security services estimate that the actual number is much higher. In Germany alone, up to 320 suspected sabotage attempts were recorded in 2025.
Targets: Poland and Baltic States—Strong Allies of Ukraine
Geographical data show a clear pattern: countries strongly supporting Ukraine are the primary targets. Poland leads with 31 incidents, followed by France (20), Lithuania and Germany (15 each), the UK (12), and Estonia (11). The Baltic states account for nearly one-fifth of all incidents, reflecting Moscow’s continued imperialist view of the region.
The report indicates that the level of support for Ukraine is a key factor in target selection, confirming that destabilization is used as a tool of political pressure.
The Balkans as a Logistical Base
A particularly notable case involved 11 Serbian citizens arrested in September 2025. Investigations indicate that they traveled across Europe and were linked to incidents aimed at provoking ethnic and religious polarization. Recorded actions include:
- Vandalism of Jewish sites in Paris
- Provocative installations near the Brandenburg Gate
- Incidents near religious buildings
French authorities associate these activities with foreign interference and Russian interests. The report notes that part of the training likely took place in Serbia, and one individual remains at large. ICCT analysts suggest this case demonstrates how Southeast European networks and individuals are used as operational channels for Moscow’s broader geopolitical goals.
Assassination Attempts, Propaganda, and Infrastructure Sabotage
- In France, four Russian nationals were arrested for planning an assassination against Vladimir Osechkin, founder of Gulagu.net.
- Activities of SOS Donbass were uncovered, suspected of spreading propaganda and gathering intelligence for Russian interests.
- In Poland and Romania, attempts to send incendiary devices to Ukraine were prevented.
- In eastern Poland, an attack targeted railway infrastructure linked to individuals close to Russian intelligence.
Profile of Actors
The report challenges the stereotype of professional agents: 95% of identified perpetrators were civilians with no formal ties to Russian security services. Most acted for financial motives. Recruitment occurred via social media platforms like TikTok and Telegram, and included minors, people with criminal backgrounds, and individuals in precarious socio-economic conditions. About 15% expressed pro-Russian views, while the majority acted for monetary reasons.
Worryingly, about half of the perpetrators were non-residents of the countries where the attacks occurred—they traveled specifically to carry out the acts and returned home immediately, mostly from Central, Eastern, and Southern Europe.
Conclusion
ICCT highlights a decentralized network model: vulnerable individuals and criminal groups operate for relatively small sums but produce a disproportionate effect on security and politics. While the war in Ukraine continues on the front lines, a parallel hybrid war against European stability unfolds quietly, exploiting cross-border networks and systemic weaknesses throughout the continent.
