Inside Russia’s hybrid attacks on Europe that could threaten the UK

https://inews.co.uk/wp-content/uploads/2025/11/SEI_274795170.jpg?w=640&h=360&crop=1

Russia’s hybrid warfare campaign is just getting started – and that should worry us all

Two acts of sabotage against railway lines in Poland over the weekend have been blamed on Moscow, and highlight an emerging Russian campaign of disruption and subversion meant to undermine Western unity and support for Ukraine.

Tomasz Siemoniak, the minister responsible for Poland’s security services, said there was a “very high chance” that the attacks were organised “on the orders of foreign intelligence services”, which is being interpreted as pointing the finger firmly at Russia. On Tuesday, Polish authorities accused two Ukrainians reportedly connected to Russian military intelligence of being behind the attacks.

The first incident, which appears to have involved an improvised explosive, took place on the line at Mika, between Warsaw and Lublin, destroying a section of track. The second, later the same day, saw a passenger train forced to a sudden stop at Pulawy, closer to Lublin, after apparent sabotage to overhead power cables.

Polish Prime Minister Donald Tusk was quick to note that this particular railway line is “crucially important for delivering aid to Ukraine”, including military supplies.

These latest incidents are likely an escalation of Russia’s existing “hybrid warfare” taking place in Europe. In 2023, more than a dozen individuals were caught installing secret cameras close to Poland’s railway lines, apparently to monitor the movement of military aid to Ukraine.

Poland has been especially outspoken about Russia’s actions and at the forefront of European rearmament. Its planned defence budget for 2026 is a record €46.9bn (around £41.3bn), equivalent to 4.8 per cent of the country’s GDP, the highest level in Nato.

As a result, it has been something of a priority target for Moscow. Past incidents have included an arson attack on a shopping centre in Warsaw and cyber attacks on train operators. According to Siemoniak, 55 people have been arrested for their involvement in planned or actual attacks in Poland.

Police near the railway line that was damaged in an explosion over the weekend (Photo: Wojtek Radwanski/AFP)

However, Poland is not alone. The UK has seen an arson attack on Ukrainian-owned warehouses in Leyton, east London, in 2023, as well as cyber attacks from hacker gangs under the Kremlin’s protection and disruptive disinformation. Russian spy ships have also been spotted in the North Sea, mapping the underwater data cables on which so much British online communication depends.

There is a particular irony in Tusk’s claim that these latest incidents were an unprecedented act of sabotage – as well as his promise to catch those responsible “regardless of who their backers are” – given that his Government has supported denying the extradition of a Ukrainian suspected by Germany of being part of the team that sabotaged the Nord Stream gas pipelines in 2022.

Nonetheless, these latest attacks do highlight the particular challenge posed by Russia’s current hybrid warfare campaign.

Just as the perpetrators of the Leyton arson attack – who were convicted last month – turned out to be British citizens recruited on the internet, recent attacks in Poland have been carried out not by card-carrying Russian intelligence officers, but by Poles, other EU citizens, and even Ukrainians. Recruited online and paid in virtual cryptocurrencies, they often did not even know, or seem to care, who their paymasters were.

March 20, 2024 Eight fire engines and around 60 firefighters tackled a fire involving a range of industrial units at an industrial estate on Staffa Road in Leyton. Part of three single-storey units were damaged by fire. There were no reports of any injuries. Two of the Brigade's 32-metre turntable ladders were used at the scene to help get water on to the building externally. Crews remained on scene throughout the night damping down and carrying out salvage operations to minimise damage. The Brigade was called at 2349 and the fire was under control by 0413. Fire crews from Homerton, Leyton, Walthamstow and surrounding fire stations attended the scene. The cause of the fire was investigated by the Brigade and the Metropolitan Police Service. Image: London Fire Brigade https://www.london-fire.gov.uk/incidents/2024/march/fire-at-industrial-estate-leyton/
An arson attack on Ukrainian-owned warehouses in Leyton in 2023 (Photo: LFB)

This poses a new and problematic challenge for European security forces, including in the UK.

The targets appear to be chosen with the aim of causing disruption and public dismay, without risking coming anywhere near the threshold of a Nato, or even serious national, response.

As a Polish security official told me last month: “It’s easy to say we should fight fire with fire, but practical and legal considerations make that hard to do. We can’t copy what the Russians – and Ukrainians – are doing.”

The incidents are also calibrated to cause a degree of self-sustaining paranoia in targeted countries.

A recent wave of drone incursions, which forced several European airports to close, was blamed on Russia. Evidence to date is lacking, but at least some appear to have been triggered by thoughtless local drone fliers, or were simply the result of observers – already conditioned to be on the lookout – misidentifying birds or other distant objects.

General Wiesław Kukula, chief of the Polish General Staff, has warned that Russia is “preparing for war”, but this is not a “phase zero” in an escalating campaign that will culminate in direct military action. Rather, Moscow’s campaign is intended to foment instability and division, and to undermine support for continuing European assistance to Ukraine.

Perhaps most alarming is the way the Russian campaign has come in pulses of activity, followed by pauses. The impression is that this is still in its experimental phase, as Moscow tests different methods and targets to cause maximum impact.

In the words of one British security service source, it is “as if they try something, then stop and learn the lessons before trying something else”.

The implication is that, however worrying they have been to date, Russia’s “sub-threshold” hybrid warfare campaign of disruption in Europe is only getting started.