On Boxing Day, Finnish authorities seized the Russian oil tanker Eagle S in the Baltic Sea after it was suspected of dragging its anchor on the ocean floor, damaging a major power cable and four communications cables. The incident was part of the Kremlin’s “hybrid warfare” strategy and was the latest in a series of Russian covert operations targeting Europe’s physical infrastructure and political stability.
The Russian government denied involvement, but Finnish authorities accused Russia of sabotage. Investigators who boarded the ship reportedly found spy equipment, reinforcing suspicions. The incident prompted NATO to increase its military presence in the region to protect vital communications and energy links.
Rapid increase in hybrid operations
Last year saw a dramatic increase in documented Russian hybrid warfare activities across Europe. According to a study by Leiden University, that number rose from just 13 in 2023 to 44 in 2024. Its activities included a fire that destroyed Warsaw’s largest shopping center, the assassination of a Russian defector, and election interference in Romania. According to the investigation, Russia is suspected of being involved in at least 56 acts of vandalism, sabotage, influence operations and targeted violence across Europe since 2022.
“Not only are the number of incidents increasing, but they are also expanding geographically,” said Bert Schulmann, professor of terrorism and political violence at Leiden University. Previously focused on Scandinavia and the Baltic states, these operations have now moved west, with new targets including France and Germany.
As a result, “European governments are waking up,” said Riho Telas, a member of the European Parliament who is Estonia’s former defense minister.
From assassinations to infrastructure destruction
NATO Secretary-General Mark Rutte warned in his first speech to the European Parliament in Brussels last Monday that Europe was “not at war, but neither is it at peace.” This is a sentiment that has resonated in Northern and Eastern Europe since Russia’s invasion of Ukraine in 2022. Incidents such as border provocations and cable cutting by Russia occur frequently from the Arctic Circle to the Black Sea.
“For[Russian President Vladimir]Putin, Ukraine is just one battleground in a broader conflict with the West,” said Kremlin expert Mark Galeotti. “My gloves started coming off last year.”
The tactics used by Moscow range from physical sabotage to cyberattacks and election interference. In early 2024, a plot to assassinate Armin Pappelger, CEO of German defense giant Rheinmetall, was thwarted by German security forces. Mr. Papelger had announced plans to build a Panther tank factory in Ukraine, making him a prime target.
Experts say Russia’s aim is to sow fear, suspicion and division in Europe, ultimately making it difficult to take coordinated action against Russia.
Last year, Romanian intelligence concluded that Russia orchestrated a sophisticated social media campaign, particularly on TikTok, to support far-right pro-Russian politician Karin Georgescu’s presidential candidacy.
“People are becoming anxious and turning to pro-Kremlin politicians, which could undermine support for Ukraine in the West,” Schulman said.
Attribution challenges
Moscow frequently recruits low-level operatives who are difficult to trace back to the Kremlin. Similarly, Russia’s “shadow fleet” of oil tankers operates under flags of convenience and complex ownership structures. “Russians don’t leave notes,” Schulman told Congress.
This makes it difficult to pinpoint Russia’s involvement. In some cases, accidents initially attributed to sabotage, such as the Swedish train derailment, were later determined to have natural causes. This ambiguity often works to Moscow’s advantage.
“We must avoid overestimating or underestimating the threat. Treating every incident as a Russian conspiracy risks turning President Putin into a James Bond villain.” Galeotti said.
Cable cutting is a popular tactic
This ambiguity makes countering sabotage in European waters particularly difficult. Since 2014, more than 160 Russian civilian vessels have engaged in espionage in the North Sea, staying for suspiciously long periods near key infrastructure such as cables and pipelines.
“We have seen an increase in activity by Russian vessels for a long time, certainly since the Russian invasion of Ukraine,” Schulman said. He explained that Moscow knows exactly where data, energy and other infrastructure cables are being installed for purposes of sabotage and espionage. Multiple cases of cable cutting have been reported in the Baltic states since 2023, with three incidents occurring in just over a month from November to December last year.
“There’s not much we can do about it. They (Russia) have found a weak spot,” Telus said.
Problems caused by disconnected cables are often not serious. The impact is generally financial. Reduced energy supplies mean higher energy costs for consumers, and repairing these cables is expensive and time-consuming.
Finland’s Fingrid said repairs to the Estlink2 cable, which was damaged in December, would continue until the end of July and could cost tens of millions of euros. A cable carrying electricity between Estonia and Finland is suspected to have been damaged by the oil tanker Eagle S. Finnish authorities now claim the ship was preparing to cut a second power cable.
NATO is currently increasing its military presence in the Baltic Sea, with Estonia deploying the Raju patrol ship to monitor Estlink 1.
However, further coordination is needed between the EU and NATO countries regarding terraces. “We need a register of (shadow) ships. We have to have that kind of information sharing between European member states and NATO member states,” he said.
European countries need to prepare for further incidents in the Baltic Sea after recent damage to undersea infrastructure, leaders of NATO countries in the region said last week ahead of a security conference in Helsinki. Ta.
European reaction
The EU has already imposed sanctions on Russia’s Shadow Fleet, as well as 16 individuals and three entities involved in destabilizing activities, including cyberattacks and disinformation campaigns.
Prime Minister Rutte has called on Europe’s NATO allies to increase defense spending, but experts suggest he will prioritize counterintelligence investments to fend off Russia’s destabilizing efforts. “If Europe redirects the cost of the F-35 fighter to counterintelligence, we would already be in a stronger position,” Schuurman said.
In any case, as the third anniversary of Russia’s invasion of Ukraine approaches and the Kremlin’s hybrid warfare intensifies, Galeotti said, “Governments and security agencies must work better together to identify and counter these threats. ‘ he warned.
