Russia's hybrid war escalates as GRU sabotage agents enter Europe

By Tony Wesolowsky | 2025-03-10

Czech intelligence passed on a tip to its German colleagues in mid-February: five suspected Russian agents were traveling in a minibus through the country and the vehicle was approaching the shared border with Germany.

Czech intelligence, in cooperation with its counterparts in North Macedonia where the vehicle was reportedly registered, suspected those on board were agents of Russia's military intelligence service, or GRU, the most shadowy of Russia's secret services and perhaps its most effective.

In this case, the vehicle and its five passengers ultimately slipped away, according to news reports, including Bild, the German newspaper that broke the story on March 2.

The minivan crossed into Germany on February 16 at a border crossing in Bad Gottleuba, a small border town in Saxony, Germany.

Acting on the tip from Czech intelligence, German border police downloaded information from a mobile phone of one of the five during what police said was cloaked to appear like a routine and random check, according to Bild.

Once the vehicle crossed into Germany, the Military Counterintelligence Service and the Federal Office for the Protection of the Constitution, Germany's civilian counterintelligence agency, tracked it.

However, at some point the trail went cold, according to Bild, and the whereabouts now of any of the five is unknown.

The group is suspected of being part of a sabotage team linked to the GRU, and one of the five -- four men and a woman -- was allegedly schooled at a GRU institute for special forces, that, among other things, focuses on explosives, electronic attacks and poisonous substances.

'A clear escalation'

It was unclear whether the five were planning any attacks in Germany or elsewhere.

But the latest research from Leiden University in the Netherlands indicates Russian efforts to destabilize European nations are shifting from misinformation and cyberattacks to physical sabotage and political assassinations.

Researchers documented 44 Russian hybrid war attacks across Europe in 2024, up from 13 in 2023.

Russia is suspected of involvement in at least 56 acts of sabotage, vandalism, influence operations or targeted violence across Europe since 2022, according to the report released January 20.

"What we are witnessing is a clear escalation of Russian tactics," said Bart Schuurman, a professor of terrorism and political violence at Leiden University, in the study. "These are no longer limited to cyberattacks or propaganda, but now include actions with direct consequences for physical infrastructure and civilian safety."

In 2024, Russia targeted critical infrastructure such as energy supplies, water networks and civil aviation, the report found.

Recorded incidents included attacks on DHL cargo planes as well as a plot to assassinate Armin Papperger, chief executive officer of the German defense company Rheinmetall, a key military provider for Ukraine.

German security services, alerted by US intelligence, disrupted the conspiracy last July.

Months earlier, last April, German authorities arrested two individuals with both German and Russian citizenship on charges of preparing an attack on a military base in Bavaria and of being in contact with the GRU.

German Interior Minister Nancy Faeser accused the regime of Russian leader Vladimir Putin of trying to undermine German support for Ukraine.

Wake-up call

The Kremlin is bent on undermining Western backing of Ukraine, using hybrid warfare activities and employing, in many cases, GRU agents or those they recruit to carry out such acts.

The incidence of such arts is rising at an alarming rate.

Russian destabilizing efforts are expanding geographically, the Leiden University report noted.

"While in previous years, Eastern European countries, such as the Baltic states, were the primary targets, in 2024, Germany and France have become the new priorities," it said.

"This suggests that Russia is expanding its activities into ... ever more members of the European Union [EU], highlighting the urgency of a coordinated European response."

The uptick in Russian sabotage across Europe should serve as a wake-up call, Schuurman said.

"Europe must invest in resilience and develop a joint strategy to effectively combat sabotage and hybrid warfare," he said in the report.

Hybrid war

The GRU's activities often fall under the broader umbrella of Russia's hybrid warfare strategy -- a combination of military, cyber and covert operations designed to destabilize nations, create confusion and advance Russian geopolitical interests.

In Poland, a series of fires and sabotage incidents in 2024 were linked to Russian operatives, including an arson attack on the country's main shopping center. Polish authorities accused Russia of attempting to sow chaos and undermine support for Ukraine, a charge that Moscow has consistently denied.

In addition to physical sabotage, the GRU is linked to cyberattacks targeting critical infrastructure. Czechia, for example, reported a series of attacks aimed at disrupting its transport systems.

These cyberattacks, part of Russia's broader strategy of interference, have prompted warnings from officials in Europe, who fear that these tactics may escalate as tensions with Russia continue to rise.

The growing threat of Russian interference and the GRU's role in it have led many European nations to take defensive measures.

In March 2024, Czechia announced that it would restrict the movements of Russian diplomats in response to a series of suspicious incidents.

The EU has similarly imposed sanctions on individuals linked to the GRU's cyber operations.

In January, the EU sanctioned three Russian nationals for alleged role in cyberattacks targeting Estonia in 2020. The three -- Nikolay Korchagin, 28, Vitaly Shevchenko, 28, and Yuriy Denisov 45 -- are reportedly linked to Unit 29155 of the GRU.

Last September, the US Department of Justice indicted Unit 29155 and offered a reward of up to $10 million for information that could assist prosecutors. The US indictment focuses on the so-called WhisperGate data-wiping attack targeting Ukraine ahead of the Russian full-scale invasion in 2022.