Since the beginning of 2024, Russia has increased acts of physical sabotage targeting public and private commercial entities in pro-Ukraine and NATO countries, in addition to continuing its traditional hybrid warfare tactics – such as cyberattacks and disinformation campaigns. This threat of sabotage is expected to remain elevated through 2025, regardless of whether Russia and Ukraine negotiate a ceasefire deal. This is especially given broader geopolitical tensions between Moscow and NATO states over multiple issues, including the alliance’s expanding military presence in Eastern Europe.
Judging by incidents reported over 2024, Russia is likely to specifically target countries that provide substantial military aid to Ukraine – such as Canada, Denmark, Finland, France, Netherlands, Norway, Poland, Sweden, the UK, and the USA. The UK and USA remain particularly vulnerable to sabotage attacks, as Moscow has threatened to retaliate against their decision to allow Ukraine to use long-range missiles to strike targets in Russian territory.
Within these countries, defense companies are expected to remain priority targets for Russian saboteurs, given the potential for disrupting aid to Ukraine and impeding the efforts of NATO states to augment their defense capabilities. This is supported by suspicions of Russian involvement in an arson attack targeting a German factory manufacturing air defense systems for Ukraine in May 2024, coupled with speculations of Russian involvement in an explosion targeting a British defense company’s factory in April 2024.
Further, Moscow is likely to target logistical, telecommunications, and transport companies, as such attacks can disrupt essential services in NATO countries. Indeed, in November 2024, western media reports claimed that Russia-backed actors were shipping parcels containing incendiary devices to logistical hubs in Europe to start “fires aboard cargo or passenger aircraft flying to the USA and Canada.” For companies in the telecommunications sector – their infrastructure such as undersea cables – also remain vulnerable to Russian sabotage plots, as these cables are often unguarded, and their exact positions are available in the public domain. This is evidenced by the damage caused to two fiber-optic undersea cables in the Baltic Sea in November 2024, with officials of multiple European countries expressing suspicions that Russian saboteurs were involved in the incident.
The risk of Russian sabotage is also likely to remain elevated for energy companies, including their offshore and undersea infrastructure. This is because such attacks have the perceived advantage of disrupting the energy supply and hindering the efforts of some NATO countries to end their reliance on Russian energy. This is particularly true for companies in Norway, as Oslo has reportedly replaced Moscow as Europe’s largest supplier of natural gas.
Although companies in the abovementioned sectors are expected to remain primary targets for Russian saboteurs, Moscow is also liable to target commercial entities that have no apparent strategic importance or links to Ukraine. This is supported by sabotage attacks and plots targeting a Swedish furniture retailer in Lithuania in May 2024, a shopping mall in Poland in May 2024, and a home improvement retailer in France in June 2024. While the targets of such attacks are often varied and unpredictable, Russia-backed saboteurs are likely to single out popular retail stores to gain media coverage and cause widespread panic.
As far as tactics adopted by Russian saboteurs are concerned, they are expected to resort to arson attacks, explosions, and vandalism, given precedent. This is especially so, as such attacks can sow fear and uncertainty among the domestic population in the NATO countries. This, in turn, can increase public pressure on NATO states to reduce or cease aid to Ukraine and force them to convince Kyiv to negotiate a ceasefire deal. To carry out such attacks, Moscow is expected to rely on local proxies, such as domestic criminal networks. This is especially given that multiple NATO countries have expelled Russian diplomats, including intelligence officers, in recent years, thereby limiting Moscow’s ability to coordinate and execute covert sabotage operations directly. Moreover, the use of local proxies offers plausible deniability for Russia, allowing it to claim that domestic criminal elements carried out the sabotage attacks. Additionally, Russia is liable to depend on allies, such as China, to further sabotage operations. Indeed, some European officials raised concerns about potential cooperation between Beijing and Moscow, after a Chinese cargo ship that departed from a Russian port was spotted near the area where two fiber-optic cables in the Baltic Sea were damaged in November 2024.
While German intelligence has previously indicated that Russian hybrid warfare could prompt NATO states to consider invoking the alliance’s mutual defense clause, the likelihood of a direct military confrontation between Moscow and NATO will remain low in 2025. This is due to the difficulty in decisively attributing hybrid warfare attacks to the Kremlin, which limits the scope for NATO to respond. Moreover, most NATO states are expected to continue being reluctant to be drawn into an escalation with Russia. Given this, they are expected to persist with other retaliatory measures, such as imposing sanctions targeting Russia, expelling Russian diplomats, and internationally isolating Moscow. This, in turn, is expected to provoke a response from Moscow, thereby perpetuating the threat of Russian sabotage attacks through 2025.
