A European public-broadcaster investigation documents a sustained physical campaign of arson, drone and maritime attacks that officials say is built to last a decade or more.
Intelligence Lead
A joint investigation by Swedish public broadcaster SVT and the European Broadcasting Union counts at least 54 physical hybrid attacks or plots linked to Russia between 1 April and 15 October 2026. The tally indicates that sabotage below the threshold of armed conflict has become a routine instrument of Russian pressure on NATO's eastern and northern flanks, and Swedish military leadership now warns the period could last 10 to 15 years. The count rests on attributions by authorities and journalists, and only some have been confirmed by an intelligence service.
Situation Report
According to the investigation, reported on 25 October by Postimees and republished by the Baltic Sentinel, 17 European public broadcasters compiled incidents including arson, attempted sabotage, drone attacks and airspace violations that authorities or journalists have linked to Russia. Poland, Romania and Latvia recorded the highest numbers. The study excludes cyberattacks, influence operations, conventional espionage and undisclosed incidents, so the true figure is likely higher than 54.
The clearest official attribution concerns a fire at a building in Tallinn's Lasnamae district on 15 August, linked to the Estonian defence firm Milrem Robotics. After a six-week investigation, Estonia's Internal Security Service (KAPO) confirmed the arson was, in its words, a deliberate and premeditated act carried out at the behest of Russian intelligence services. No one was injured. Three suspects were detained in Latvia and handed to Estonia.
At sea, the EBU reports drone attacks on merchant ships off Romania and Bulgaria in the Black Sea, with at least two people killed and at least ten missing since the start of October. The figures are attributed to the EBU without a named underlying source and remain unverified here. Moscow's Foreign Ministry denies involvement in sabotage in Europe and accuses Western states of waging hybrid war against Russia.
Background & Context
An earlier SVT-EBU investigation, "Playing with Fire," identified 60 hybrid attacks linked to Russia across 2024 and 2025. The two counts are not directly comparable, since methods and time windows differ, and the new study itself cautions against drawing firm conclusions about acceleration. What the comparison does show is that a six-month tally now approaches the total for the previous two years.
The pattern follows a recognisable Russian method: recruit disposable local intermediaries, often through online channels, to carry out arson, parcel and rail sabotage or surveillance, which limits exposure for Russian intelligence officers after successive diplomatic expulsions. Recent counterintelligence cases in Germany, Austria and Denmark, covered in earlier SpyWitness briefs, sit in the same operational family and target the same defence-industrial and logistics nodes supporting Ukraine.
Analysis & Assessment
It is assessed with moderate confidence that the campaign is deliberate, centrally tasked and aimed at two objectives: raising the cost of European support for Ukraine and testing NATO's tolerance threshold for attacks that avoid a clear Article 5 trigger. The geographic concentration on Poland, Romania and Latvia is consistent with a focus on frontline logistics and the Black Sea corridor. Hybrid CoE's director, Teija Tiilikainen, has argued that new technologies are being layered onto established sabotage and influence tactics and that the grey zone between peace and war is widening.
The Black Sea casualties, if confirmed, mark an escalation from property damage to loss of life, which narrows Moscow's room for deniability and raises pressure for a collective NATO response. Carl-Johan Edstrom, chief of staff of the Swedish Armed Forces, told SVT that this is not something that will pass in a year or two and that there is a significant risk the activity spreads to other Baltic Sea countries.
Alternative explanations carry some weight: not every incident in the tally may be state-directed, and attribution in several cases rests on journalists rather than prosecutors. The headline number should be read as a floor for suspected activity, not a verified count of Russian operations.