On 11 May 2024, a fire swept through the Marywilska 44 shopping centre in Warsaw overnight. The market held more than 1,000 shops. Nobody died. Polish investigators later concluded it was arson coordinated by Russian secret services, with hired conspirators paid to light it, and in 2025 evidence showed the order came from a GRU officer in Russia. Several suspected local intermediaries were arrested in Poland and Lithuania.
It is one piece of what Western governments and intelligence agencies describe as a Russian hybrid war on countries that back Ukraine. Officials say the GRU largely coordinates it and covert operatives or locally recruited perpetrators carry it out. Russia denies responsibility and blames other actors. In 2025 NATO called the sabotage threat “record high.”
Fires and a paid network
Four days before the Warsaw blaze, an IKEA store in Vilnius burned after closing time. No one was hurt. Lithuanian prosecutors called it GRU “terrorism.” Two Ukrainians were charged, one arrested in Lithuania and the other in Poland. Investigators said Russian handlers had promised them 10,000 euros to carry out bombing or fire attacks at shopping centres in Lithuania and Latvia.
Lithuanian and Polish authorities thought the same network was probably behind both. In May 2025 Poland expelled Russian diplomats and ordered Russia’s consulate in Kraków closed.
In Britain, on 20 March 2024, a factory and warehouse complex owned by a Ukrainian businessman in east London was set on fire. It had supplied protective gear to Ukraine. Police arrested a group of suspects and said the ringleader had been recruited online and directed by people linked to the Wagner Group.
Cables, rails and the seabed
In November 2024, two fibre-optic cables in the Baltic were cut within two days, one linking Finland to Germany and one linking Sweden to Lithuania. German and Finnish authorities spoke of possible “intentional damage.” In late December an undersea power cable between Finland and Estonia, Estlink 2, was cut along with several nearby telecom cables, causing blackouts and internet cuts. Finland seized a Russian-owned ship suspected of involvement.
On land, saboteurs cut two Deutsche Bahn fibre-optic cables on 8 October 2022, crippling train signalling in northern Germany and stopping long-distance and freight traffic for about three hours. German officials said hitting redundant cables at once took good knowledge of the system. In Poland, prosecutors charged more than a dozen people reportedly working for Russian intelligence with preparing sabotage of transport infrastructure.
The International Institute for Strategic Studies documented more than 50 sabotage events in Europe between 2022 and mid-2025 that were likely linked to Russia. European security services told reporters the campaign was kept at low casualty levels on purpose, to avoid provoking a direct military response from NATO.
Older roots
None of this is new. Czech investigators blamed GRU Unit 29155 agents for the 2014 explosions at the Vrbětice ammunition depot, which killed two people. That led to mass expulsions of diplomats between Prague and Moscow.
More recently, Romania’s intelligence service and its organised crime prosecutors announced on 26 October that a network coordinated from Russia had set fire to the Carfil industrial platform in Brașov, close to an ammunition factory. Three people were identified in the arson.
