[Editor’s Note: Army Mad Scientist welcomes back T2COM G2 analyst, Mr. Dorsel “Flip” Boyer as today’s guest blogger. In today’s piece, Flip examines the historical roots, modern tradecraft, and strategic implications of Russia’s post-2022 sabotage campaign against NATO countries. While sabotage has long been a feature of Soviet and Russian statecraft, the current campaign reflects a significant adaptation: online recruitment, disposable proxies, and low-cost financing mechanisms. He argues that this campaign allows Moscow to generate friction across Europe while minimizing operational risks. This post explores the historical roots of this campaign, how Russia has leveraged technology to recruit assets, and what it may mean for NATO’s future operating environment — Read on!]
Russia’s sophisticated post-2022 sabotage campaign in Europe represents the revival of a Soviet-era method through modern digitally enabled means. Russian intelligence services are planning and conducting sabotage activities across Europe to create friction, sow uncertainty, impose costs, and weaken NATO without crossing the line into open war. Today’s campaign depends less on trained and vetted agents and more on one-time assets recruited and tasked through encrypted messaging applications. These innovations in short-term proxy recruitment and low-cost financial transactions have made the post-2022 sabotage more scalable, deniable, and persistent than traditional agent handling methods.
The Long Shadow of Soviet Sabotage Doctrine
Soviet and Warsaw Pact intelligence services developed sabotage networks to conduct deniable attacks against NATO transportation networks, communications systems, energy infrastructure, arms facilities, and symbolic nodes of Western political power. These Cold War-era operations were designed to “weaponize friction” during periods of crisis or escalation. Sabotage was often paired with propaganda and other “active measures” meant to amplify panic, distrust, and political division.
Today’s Russian sabotage campaign in Europe seeks to weaken support for Ukraine and create confusion by targeting infrastructure for destruction and supporting psychological operations. The Kremlin has sponsored sabotage on NATO territory since before the annexation of Crimea. Earlier operations, conducted by professional intelligence officers from organizations like GRU Unit 29155, such as the 2011 ammunition depot explosion in Bulgaria and the 2014 Vrbětice explosions in the Czech Republic. Following Russia’s full-scale invasion of Ukraine in 2022, however, the pace and breadth of these operations increased. European governments have since reported a growing pattern of suspicious fires, cyber-attacks, rail disruptions, cable damage, GPS interference, and attacks affecting both civilian and military-related targets. The target sets are notable because they mirror the Soviet-era list: transport, logistics, defense industry, communications, energy, and psychologically resonant civilian infrastructure.
What Has Changed: From Agents-Saboteurs to a Sabotage “Gig Economy”
Although the campaign’s operational concept can be traced to Soviet-era plans, the operational model leverages the technology of the 21st century. Academic, government, and press reporting indicate a significant shift from the older intelligence model of carefully selected, trained, and handled assets to what researchers call a “gig-economy” approach to sabotage. Rather than investing the time and risk required to handle, vet, and train agents, Russian services increasingly outsource individual tasks to loosely connected or one-time assets recruited online.
These new techniques lower the cost of operations, expand the pool of potential recruits by reducing traditional barriers to entry, and creates thicker layers of deniability. Encrypted chat platforms, GPS and mapping services, and cryptocurrency channels allow handlers to issue tasks remotely—photograph a facility, install a camera, spray graffiti, deliver a parcel, or commit arson—without extensive in-person contact. The result is a distributed network of disposable assets who can be activated quickly, replaced easily, and, in many cases, may not fully understand who is directing them or why.
The post-2022 model was developed after the mass expulsion of Russian diplomats and undeclared intelligence officers following the 2022 Russian invasion of Ukraine degraded Russia’s traditional intelligence architecture in Europe. Moving to remote tasking and online recruitment reduced the need for physical presence while preserving Moscow’s ability to generate disruption.
Who Gets Recruited?
One of the more concerning findings revealed by the research is the breadth of the recruitment pool. Russian services are no longer limited to ideologically committed proxies or professional criminals. The current model can draw in amateurs, migrants, teenagers, economically vulnerable individuals, and people with only tangential sympathy for Russia. Some are recruited knowingly; others may be drawn in under false pretenses, believing they are supporting a different kind of illicit or commercial activity.
Recruiting loosely affiliated or unwitting assets produces multiple advantages for Moscow. First, it increases deniability by creating distance between the Russian state and the act itself. Second, it complicates attribution for European governments, which must determine whether an incident is criminal, political, or state-directed. Third, it introduces a social fracture line into the campaign that can be reinforced by other Russian information operations. The use of Ukrainian or third-country nationals can help Russia blur responsibility and potentially inflame anti-migrant or anti-Ukrainian sentiment inside Europe—turning the act of sabotage into a social and political weapon as well as a physical one.
Undercover reporting has shown Telegram-based recruiters offering money for surveillance, arson, attacks on NATO-related equipment, and even murder, with payment promised after completion through cryptocurrency. That is not simply criminal opportunism; it is sabotage adapted to the logic of platform-enabled labor markets.
The Financial Backbone: Cheap, Fast, and Good Enough
Russia’s sabotage ecosystem appears to rely heavily on cryptocurrency because it is simple, fast, accessible across borders, and often less tightly regulated than conventional banking channels. Although cryptocurrencies are a modern approach, their use here does not reflect especially sophisticated tradecraft. In many cases, the payment chains are low-value, unsophisticated, and operationally basic.
Recruits may receive small payments for low-level vandalism or surveillance, larger sums for riskier acts, and sometimes nothing at all. More traditional approaches—cash payments, bank transfers, intermediaries, and payments-in-kind—still play a role, but crypto serves as the backbone for an emerging distributed, deniable payment system. The campaign’s financing architecture is less a sophisticated laundering enterprise than a permissive operational ecosystem that exploits weak know-your-customer enforcement, small exchanges, cash-to-crypto services, and fragmented cross-border oversight.
This has an important implication for defense and intelligence communities: financing is also one of the campaign’s most promising vulnerabilities. Financial intelligence, if integrated early and shared effectively, can help expose facilitators, map networks, and identify emerging plots before physical sabotage occurs.
The Current Campaign: Strategic Vandalism at Scale
The current wave of sabotage across Europe appears strategically coherent. The aim is not to produce mass casualties or catastrophic infrastructure collapse—but to impose cumulative friction across the architecture that sustains Ukraine and underpins NATO’s credibility. Rail lines, warehouses, undersea infrastructure, logistics chains, defense firms, communication nodes, and symbolic public targets all offer opportunities to create delay, fear, and political pressure at relatively low cost.
Russian targeting has apparently widened to include the European defense-industrial base and the broader supply chain that supports Ukraine. The risk surface now extends beyond named weapons manufacturers to supplier networks, logistics nodes, and executive personnel, broadening from isolated facilities to the wider industrial ecosystem.
This evolution holds critical infrastructure, industry, transport, and defense-support functions across Europe at risk while NATO and European governments continue to struggle to develop a unified deterrent response. Limited reporting also suggests that more professionalized cells or organized criminal facilitation may be used for high-risk or high-payoff operations.
What This Means for NATO
For NATO, the deeper issue is that Russia appears to have found a way to generate strategic effects below the threshold of conventional armed attack.
First, the campaign targets the enabling systems of alliance power rather than purely military infrastructure Civilian rail systems, ports, energy networks, communications links, and commercial logistics nodes are all essential to reinforcement, sustainment, and military mobility. NATO depends heavily on civilian infrastructure that is not uniformly protected, interoperable, or resilient across member states.
Second, the campaign exploits the gap between national and alliance responses. Most sabotage incidents are investigated as criminal or law-enforcement matters, even when intelligence services suspect a larger pattern. That creates a fragmented response to what may be a coordinated transnational campaign. A distributed series of arsons, suspicious individuals near critical facilities, drone incidents, and cable disruptions may never individually trigger Article 5, but collectively they can test alliance cohesion, consume security resources, and erode deterrence.
Third, the campaign pressures NATO’s defense-industrial ecosystem at a time when it is already operating under strain. Even minor disruptions can matter when production lines, transport corridors, and industrial facilities are working near capacity in support of Ukraine. The goal may be systems destruction but then making it slower, more expensive, and less politically sustainable.
Looking Ahead
Russia’s sabotage campaign is unlikely to disappear on its own. It is relatively cheap, deniable, scalable, and adaptable. It exploits legal ambiguity, uneven protection standards, public-private seams, and the friction between intelligence attribution and political response. It also allows Moscow to compete with NATO in a space below conventional war while still shaping the operational environment in Europe.
For NATO and its member states the challenge goes beyond stopping individual plots. Although the attacks operate below the threshold of article 5 invoking attacks, the post-2022 sabotage campaign as a persistent form of systematic Russia-NATO competition. Defeating the threat requires better integration of counterintelligence, law enforcement, financial intelligence, cyber defense, infrastructure protection, and public communication. The alliance’s adversaries are not waiting to contest Europe only on a future battlefield. They are already contesting the logistics hubs, communications architecture, road and rail networks, and defense industries that ensure Europe’s security.
If you enjoyed this post, check out the T2COM G-2’s Operational Environment Enterprise web page, brimming with authoritative information on the Operational Environment and how our adversaries fight.
About the Author: Mr. Boyer is an experienced intelligence and defense policy professional with 23 years of experience in the field as both a uniformed service member and defense industry partner. He currently works as a threat environment analyst for the United States Army Transformation and Training Command (T2COM). His focus has been the Black Sea and its littoral and has worked directly in the field since 2015 supporting United States European Command, United States Special Operations Command, and the North Atlantic Treaty Organization. Mr. Boyer has published several studies for T2COM, the U.S. Army Center for Lessons Learned, and currently supports the T2COM G-2 Wargaming Team.
Disclaimer: The views expressed in this blog post do not necessarily reflect those of the U.S. Department of War, Department of the Army, or the U.S. Army Transformation and Training Command (T2COM).
