ROME, July 12 — Since Russia’s full-scale invasion of Ukraine in 2022, European counter-intelligence services have uncovered numerous Russian espionage operations. The tally of expulsions, arrests, and indictments across at least seven countries now forms a pattern that intelligence officials describe not as isolated incidents but as a sustained, coordinated campaign. The mechanics here are worth following closely.
In April 2022, Italy expelled 24 Russian diplomats. That was the opening salvo.
The following July, Norway arrested a Russian man for flying drones near oil and gas installations — a clear signal that energy infrastructure had become a priority target. By January 2023, Austria had arrested a former Austrian military officer for passing NATO secrets to Russia. The catch, on closer reading of the sequence: no single country has been spared.
The Italian thread
Italy has been a particular focus. After the initial expulsion of 24 Russian diplomats in April 2022, Rome expelled four more in March 2023. The Italian operation announced on March 31, 2025, is the latest in this series.
The pattern suggests Italian authorities have been running parallel investigations, uncovering one network after another. But Italy is far from alone.
The Netherlands expelled four Russian diplomats for espionage in April 2023. Germany arrested a German defense ministry employee for spying for Russia in June 2023. The following October, the UK charged five Bulgarians with spying for Russia.
Sweden arrested a Russian man for illegal intelligence activities in February 2024. And in March 2025, Poland uncovered a Russian spy ring targeting military supplies to Ukraine.
Follow the targets
European intelligence agencies have warned that Russian espionage has intensified since 2022. The focus, according to those warnings, falls into three categories: military technology, energy infrastructure, and political interference. The energy piece is particularly telling.
Norway’s arrest of a drone operator near oil and gas installations in July 2022 was an early indicator. Energy infrastructure is difficult to defend — pipelines, platforms, and processing facilities stretch across vast areas of coastline and remote terrain.
A single drone carrying explosives or conducting surveillance could map vulnerabilities for later sabotage. On the military technology front, the German defense ministry employee arrested in June 2023 and the Austrian officer arrested in January 2023 both had access to NATO-level secrets. The five Bulgarians charged in the UK in October 2023 were allegedly running a sophisticated network targeting military and political intelligence.
Political interference remains the hardest to prove but the most consequential. The Polish spy ring uncovered in March 2025, targeting military supplies to Ukraine, sits at the intersection of all three categories: it aimed to disrupt the flow of weapons (military technology), potentially damage supply routes (infrastructure), and undermine political support for Ukraine within the NATO alliance.
What to watch next
The March 31, 2025 Italian operation is the most recent confirmed action, but the timeline suggests European counter-intelligence services are running long-term investigations that take years to culminate in arrests or expulsions. The gap between the initial 2022 expulsions and the 2025 operation in Italy — roughly three years — indicates that new networks are being discovered as old ones are dismantled. The question European security officials are now asking is whether Moscow is shifting tactics.
If traditional diplomatic cover has become too risky after so many expulsions, Russian intelligence may be relying more on non-diplomatic assets: businesspeople, students, or ideological sympathizers recruited online. The five Bulgarians charged in the UK fit that profile.
So may future cases that have not yet become public. The catch, for European governments, is that each successful disruption reveals a new vulnerability — and the pace of discovery shows no sign of slowing.
