As the boundaries between peace and conflict blur in the era of grey-zone and hybrid competition, protecting critical infrastructure has become one of the defining security challenges of the 21st century. Systems such as power grids, transportation networks, communication channels, water supplies, and energy pipelines form the backbone of modern society. They support economic stability, safeguard public safety, and underpin national security.
These networks are also deeply interdependent. A disruption in one sector often cascades into others, amplifying its impact. A power grid failure can halt trains, disrupt communications, and cripple emergency services. The consequences of sabotage or disruption extend far beyond financial costs. They can create societal instability, trigger environmental damage, and result in the loss of life.
As threats grow more sophisticated, ranging from cyberattacks to physical sabotage of undersea cables, the need for stronger defenses is clear. Protecting these vital systems requires a mix of advanced technologies, informed policymaking, and international cooperation.
Since this article was first published, the threat to critical infrastructure has escalated dramatically. The IISS documented over 50 Russian-linked sabotage incidents across Europe from 2022 to mid-2025, a 246% increase from 2023 to 2024 alone. In the Baltic Sea, eight confirmed or suspected incidents since September 2022 have damaged at least eleven data cables alongside two gas pipelines and one power interconnector, prompting NATO to launch Operation Baltic Sentry in January 2025. Separately, at least 11 cable incidents occurred around Taiwan, with Chinese-crewed vessels suspected of deliberate anchor-dragging. Germany foiled a Russian-linked parcel-bomb plot targeting NATO logistics networks in May 2025. On 2 July 2026 German federal prosecutors charged a Ukrainian national over the September 2022 Nord Stream attack, the first criminal charges brought in any Baltic infrastructure sabotage case. The EU has also launched new initiatives to stress-test energy networks and enhance intelligence-sharing on hybrid threats.
Sources: IISS Research Paper → Atlantic Council → SIPRI Analysis →
Understanding the Threat Landscape
State-Sponsored Actors
Nation-states represent the most capable and persistent threat to critical infrastructure. Countries like Russia, China, Iran, and North Korea have developed sophisticated cyber and physical capabilities to target the essential systems of adversaries. Russia’s GRU, in particular, has been linked to a sustained campaign of sabotage across Europe since 2022, targeting energy grids, communication cables, military logistics, and transportation networks as part of a broader hybrid warfare strategy tied to the conflict in Ukraine.
These operations often fall below the threshold of armed conflict, designed to impose costs and create disruption while maintaining plausible deniability. Russia’s escalating sabotage campaign across Europe includes GPS jamming across Nordic airspace, arson attacks on warehouses linked to Ukrainian aid, and the systematic severing of undersea cables and pipelines in the Baltic Sea. China, meanwhile, has been implicated in suspected cable-cutting operations around Taiwan using civilian-flagged vessels with dragged anchors, a grey-zone tactic that exploits gaps in maritime law enforcement. State-sponsored cyber operations are equally concerning. The 2020 SolarWinds breach demonstrated how nation-state actors could infiltrate critical government and corporate networks through supply chain vulnerabilities, remaining undetected for months.
Terrorist and Militant Organizations
Terrorist groups and armed non-state actors target infrastructure to cause mass disruption, generate fear, and undermine state authority. Pipeline sabotage in the Niger Delta by groups like the Movement for the Emancipation of the Niger Delta (MEND) has cost Nigeria billions in lost revenue annually, while attacks on power infrastructure in Iraq and Syria by ISIS sought to collapse basic services and create governance vacuums. Even relatively unsophisticated attacks such as cutting power lines, contaminating water supplies, or bombing transportation hubs can have cascading effects when infrastructure networks are interdependent.
Insider Threats
Employees or contractors with legitimate access to sensitive systems can exploit that access for purposes ranging from ideological sabotage to personal grievance. In 2013, a targeted attack on the Metcalf transmission substation in California, where attackers used sniper fire to destroy 17 transformers, exposed critical vulnerabilities in the physical security of the U.S. power grid. Insider threats extend to digital environments, where trusted individuals may compromise sensitive systems through intentional action or negligence. Organizations address these risks through enhanced screening, continuous activity monitoring, and workplace cultures that encourage reporting of suspicious behavior.
Hacktivists and Cybercriminals
Cybercriminal organizations, driven primarily by financial gain, increasingly target critical infrastructure through ransomware and extortion. The 2021 Colonial Pipeline attack demonstrated how a single ransomware incident could shut down the largest fuel pipeline in the United States, causing fuel shortages across the southeastern states and triggering panic buying. Hacktivist groups, meanwhile, use cyberattacks to advance political or ideological causes. While their capabilities are generally less sophisticated than state actors, their attacks on government websites, utilities, and communication platforms can still cause significant disruption, particularly when timed to coincide with geopolitical crises.
Natural and Accidental Risks
Not all infrastructure disruptions are deliberate. Extreme weather events, equipment aging, and human error account for a significant share of outages and failures. However, natural risks and deliberate sabotage often interact: aging infrastructure is more vulnerable to attack, and climate-driven events can mask or complicate attribution of suspicious incidents. Between 100 and 200 subsea cable faults occur annually from environmental causes and marine activity, which is precisely why state actors use anchor-dragging tactics: the damage is plausibly deniable.
Regional Case Studies
Africa: Pipeline Sabotage in Nigeria
Nigeria, Africa’s largest oil producer, faces persistent pipeline sabotage driven by economic grievances and environmental degradation. Militant groups frequently target oil infrastructure across the Niger Delta, with more than 1,100 cases of pipeline vandalism reported in 2022 alone. The Nigerian National Petroleum Corporation estimates that sabotage costs the country billions of dollars in lost revenue annually. Pipeline attacks also create severe environmental and health crises, as oil spills contaminate rivers, groundwater, and farmland. Groups such as MEND have used sabotage not only as a weapon but as a negotiating tool, demonstrating how infrastructure attacks serve both tactical and strategic purposes in irregular conflicts.
Europe: The Baltic Undersea Cable Campaign
The Baltic Sea has become the most active theater for infrastructure sabotage in Europe. Since September 2022, eight confirmed or suspected incidents have damaged at least eleven data cables alongside two gas pipelines and one power interconnector. Three of those incidents, between November 2024 and January 2025, account for seven data cables and the Estlink 2 power interconnector between Finland and Estonia. The pattern began with the September 2022 Nord Stream pipeline explosions, then escalated through the October 2023 Balticconnector pipeline rupture (linked to the Chinese-crewed vessel Newnew Polar Bear), the November 2024 severing of Finland-Germany and Sweden-Lithuania fiber-optic cables, and the December 2024 cutting of the Estlink 2 power cable between Finland and Estonia. Finland seized a Russian-owned vessel, the Eagle-S, suspected of the Estlink 2 damage, and identified it as part of Russia’s “shadow fleet” of sanctions-evading tankers. NATO responded by launching Operation Baltic Sentry in January 2025, deploying allied naval assets to monitor and deter further attacks on critical undersea infrastructure. The full incident record, vessel by vessel, is maintained in our dedicated analysis of undersea sabotage in the Baltic.
Asia: Cyberattacks on Indian Power Grids
India has experienced multiple cyberattacks targeting its power grid, attributed by cybersecurity researchers to Chinese state-linked groups. These intrusions probed grid management systems in critical nodes, likely to map vulnerabilities for potential exploitation during a future crisis. The attacks highlighted the growing intersection of cyber espionage and infrastructure pre-positioning, where adversaries establish persistent access to critical systems that can be activated for sabotage on command.
Latin America: Venezuela’s Grid Collapse
Venezuela’s 2019 nationwide blackout left millions without electricity for days. The government attributed the incident to cyber sabotage of the Guri Dam, which supplies most of the country’s power, though independent investigations could not verify these claims. Regardless of cause, the event exposed how deteriorating governance and poor maintenance make infrastructure catastrophically vulnerable, a condition that both state and non-state adversaries can exploit.
United States: The Colonial Pipeline Attack
The May 2021 ransomware attack on Colonial Pipeline remains the most significant cyber infrastructure incident in U.S. history. The DarkSide ransomware group forced the shutdown of the 5,500-mile pipeline carrying 45% of the East Coast’s fuel supply. The immediate impact included fuel shortages across southeastern states, average gasoline price spikes of 6 cents per gallon, and panic buying that emptied thousands of gas stations. Colonial Pipeline paid a $4.4 million ransom (partially recovered by the FBI), and the broader supply chain disruptions lasted weeks. The attack demonstrated how a single cyber intrusion could cascade into a nationwide economic and logistical crisis.
Legal and Policy Frameworks
CISA (U.S. Cybersecurity and Infrastructure Security Agency)
The Cybersecurity and Infrastructure Security Agency (CISA) serves as the United States’ primary federal body for infrastructure protection. CISA identifies and mitigates vulnerabilities, conducts red team assessments, and provides resources for both public and private sectors to strengthen their cybersecurity posture. In response to the surge in ransomware attacks following Colonial Pipeline, CISA launched the StopRansomware.gov platform, a centralized hub providing tools and guidance for prevention and response. CISA’s National Risk Management Center develops strategies for managing risks to the 16 designated critical infrastructure sectors and coordinating responses to significant disruptions.
European Union’s NIS2 Directive
The EU’s updated Network and Information Security Directive (NIS2), which member states were required to transpose by 17 October 2024, significantly expanded the scope and enforcement of cybersecurity requirements across member states. NIS2 applies to “essential entities”, including energy, transport, banking, healthcare, and digital infrastructure operators, requiring them to implement comprehensive risk management measures, report significant incidents within 24 hours, and face substantial penalties for non-compliance. The directive also strengthened cross-border coordination through the EU-CyCLONe network, designed to manage large-scale cyber incidents affecting multiple member states simultaneously.
International Cooperation
Infrastructure protection increasingly requires international coordination. NATO’s creation of a Critical Undersea Infrastructure Cell in 2023, followed by Operation Baltic Sentry in 2025, represents the alliance’s most significant commitment to infrastructure defense. The Budapest Convention on Cybercrime facilitates international cooperation on cybercrime prosecution, while the ITU’s Global Cybersecurity Agenda provides frameworks for developing nations to build defensive capabilities. However, significant gaps remain, particularly in maritime law, where UNCLOS provisions make it difficult for coastal states to board and investigate vessels suspected of cable sabotage in exclusive economic zones without flag-state permission.
Emerging Technologies and Defenses
Defensive technologies are evolving in response to the escalating threat. AI-driven monitoring systems can now detect anomalies in real time across power grids and communication networks, identifying potential cyberattacks or physical disruptions before they cascade. Blockchain technology is being explored for securing supply chain data and preventing tampering with critical systems. Quantum-resistant encryption is under development to counter the future threat of quantum computing breaking current cryptographic standards.
In the undersea domain, new seabed monitoring sensors and autonomous underwater vehicles are being deployed to detect suspicious activity near cables and pipelines. The UK’s Operation Nordic Warden, launched in early 2025, uses AI to analyze maritime data and flag shadow fleet vessels operating near critical infrastructure. Lithuania has pioneered public-private partnerships between its armed forces and electricity transmission operators to coordinate infrastructure defense, a model other nations are studying.
The historical record offers perspective. States and resistance movements have targeted infrastructure for strategic advantage for centuries, from Operation Gunnerside’s destruction of Norway’s heavy water plant in 1943 to modern cyber operations. What has changed is the scale of interdependence and the speed of cascading failure. Understanding both the theory and history of irregular warfare and the technical realities of modern infrastructure is essential for developing effective defenses.
OSS: Combined & Remastered collects the Office of Strategic Services field manuals that first codified how to identify, attack and defend the infrastructure a state depends on, the doctrinal ancestor of every case in this article.
View on Amazon →Critical Infrastructure Sabotage Timeline: 2021-2026
