Sabotage has become one of the defining features of the Russia-Ukraine war — and increasingly, of Russia’s broader confrontation with Europe. What began as targeted Ukrainian strikes on Russian logistics has evolved into a bi-directional sabotage campaign spanning from the Russian Far East to the railways of Poland. Attacks on infrastructure, military targets, and logistics networks disrupt operations on both sides of the conflict, with consequences reaching far beyond the front lines.
Since 2022, the Armed Conflict Location and Event Data Project (ACLED) has documented over 1,200 sabotage-related events across Russia and Ukraine, with roughly 60% occurring inside Russia itself. These operations — ranging from railway sabotage and maritime strikes to drone warfare and insider dissent — represent a sophisticated campaign to degrade Russian military capacity while simultaneously creating strategic uncertainty. Meanwhile, Russian intelligence services have launched their own escalating sabotage offensive against European infrastructure, targeting the very nations that support Ukraine.
Since this article’s original publication, the sabotage landscape has transformed significantly. The ACLED has tracked over 1,200 sabotage events in Russia and Ukraine through mid-2025. The Atesh partisan group expanded from Crimea to conduct 32+ operations across Russia in 2025 alone, from the European border to the Far East. Simultaneously, Russian sabotage operations in Europe surged to what NATO called “record high” levels in 2025 — the IISS documented over 50 Russia-linked sabotage incidents across the continent from 2022 to mid-2025. A November 2025 attack on Poland’s Warsaw-Lublin railway, attributed to Russian-recruited agents, highlighted the campaign’s growing boldness. This article has been substantially updated to reflect the full scope of the bi-directional sabotage war.
Updated with ACLED data, Atesh operations intelligence, and European sabotage campaign analysis.
Railway Sabotage and Logistics Disruptions

Railway networks are the backbone of Russia’s military logistics. With a vast geography and limited alternatives for large-scale transport, the Russian military depends on efficient rail to move troops, equipment, and supplies. Disrupting these lines creates cascading effects — delayed resupply, ammunition shortages at the front, and forced reliance on less efficient road transport.
Ukrainian special operations and intelligence services, partnered with both Ukrainian and Russian partisans, have conducted a sustained campaign against Russia’s rail infrastructure. Two groups have been particularly prominent: “Stop the Wagons” and the “Combat Organization of Anarcho-Communists”, Russian political groups motivated by opposition to the Kremlin’s invasion. Their willingness to sabotage their own country’s infrastructure demonstrates meaningful internal resistance to the war.
The Atesh partisan group has been the most operationally active force in 2025. Originally from Crimea, Atesh has expanded its footprint across Russia-occupied Ukraine and into Russia itself, accounting for over half of the 30+ sabotage incidents in occupied areas in 2025. Their primary targets are relay cabinets and signaling systems — technically simple but operationally devastating targets that disable entire rail segments. In June 2025, Atesh operatives destroyed a relay box on the newly built Volnovakha-Mariupol railway, a line built by Russian occupying forces to bypass Crimea for faster frontline resupply.
Key incidents have included train derailments in Belgorod Oblast, targeted strikes on railways in Ulyanovsk, and persistent attacks deep inside Russian territory. In response, Russian forces have attempted to disguise military cargo and increase railway security patrols — but the decentralized nature of the sabotage campaign makes comprehensive defense nearly impossible. Each successful attack forces Russia to invest resources in repair and protection rather than offensive operations.
The historical precedents for railway sabotage are well established. European resistance fighters during World War II systematically targeted Nazi supply lines, and Cold War-era intelligence agencies engaged in similar operations. The current campaign follows these patterns while incorporating modern technology — drones for reconnaissance, encrypted communications for coordination, and social media for psychological amplification.
Maritime Sabotage and Disruptions

Ukraine’s campaign against Russian naval assets has been one of the most tactically innovative aspects of the war. With limited conventional naval power, Ukraine has relied on asymmetric methods — naval drones, explosives, and covert operations — to strike targets in the Black Sea and along Russia’s river networks. These operations have caused significant disruptions to both military logistics and commercial shipping.
Key incidents include the sinking of a Russian cargo ship following a suspected sabotage-related explosion, and reports from Ukrainian partisans that Russian soldiers have begun sabotaging their own transport boats to avoid being sent across the Dnipro to the front. On June 3, 2025, an underwater explosion occurred near a pillar of the Crimean Bridge — Ukraine’s third attempt to disable the structure that has become a symbol of Russia’s aggression since 2014.
Russian countermeasures — reinforced patrols, new defensive measures, increased surveillance — have had limited effectiveness against the adaptive nature of Ukrainian maritime sabotage. The high cost of securing vast maritime transport networks, combined with the psychological impact of repeated attacks, continues to strain Russian logistics and erode morale among naval personnel.
Drone and Explosive Parcel Attacks
Drones and unconventional explosive devices have become a hallmark of hybrid warfare in the current conflict. Their ability to evade traditional air defenses makes them effective for both reconnaissance and targeted strikes. The use of explosive parcels and other covert delivery methods further complicates security protocols, creating an environment of persistent uncertainty.
NATO intelligence has reported increasing incidents of explosive parcels and drone attacks on Russian military targets. Russian authorities have temporarily blocked traffic on the Kerch Bridge due to suspected drone activity — a key strategic chokepoint for logistics into Crimea. The evolution of drone technology, combined with the accessibility of commercial drone platforms, ensures that this attack vector will remain a persistent challenge for Russian air defense systems.
Russia has attempted to counter the threat through electronic warfare measures, including signal jamming. However, the rapid pace of drone technology development — including AI-guided autonomous navigation that does not rely on GPS signals — consistently outpaces countermeasures. This technological arms race reflects the broader transformation of irregular warfare in the 21st century.
Insider Sabotage and Dissent Within Russian Forces
Beyond external attacks, internal dissent within Russian forces represents a growing vulnerability. As the war extends into its fourth year, reports indicate deepening dissatisfaction among Russian troops. Low morale, poor leadership, and logistical failures have contributed to acts of self-sabotage — soldiers deliberately damaging equipment, refusing orders, or collaborating with Ukrainian partisans.
This phenomenon has historical parallels. Resistance movements throughout history have exploited fractures within enemy ranks, and Ukraine appears to be leveraging this strategy effectively. Ukrainian intelligence services have reportedly cultivated informants within Russian military circles to facilitate precision targeting of high-value logistics nodes.
The persistence of insider sabotage raises fundamental questions about the sustainability of Russia’s war effort. If internal dissent continues, it could weaken command structures, reduce operational effectiveness, and contribute to broader strategic failures. The Russian leadership has responded with crackdowns on suspected saboteurs, but attempting to suppress morale problems with force risks exacerbating the underlying issues.
Russia’s Sabotage Campaign in Europe
While Ukraine has waged sabotage inside Russia, Moscow has simultaneously escalated its own covert sabotage campaign across Europe — targeting the very nations that supply Ukraine with military and economic support. NATO described the threat level in 2025 as “record high,” and the International Institute for Strategic Studies documented over 50 Russia-linked sabotage events across the continent from 2022 to mid-2025.
From GRU sabotage of Czech arms depots in 2014 to the wave of arson, infrastructure attacks, and recruited-agent operations across NATO territory following Russia’s 2022 full-scale invasion of Ukraine. Incident count quadrupled from 6 in 2022 to 44+ in 2024.
GRU Unit 29155 operatives sabotaged ammunition depots storing weapons destined for Ukraine. Two workers killed, 58 tons of ammunition destroyed. Same agents later identified in the 2018 Skripal poisoning in the UK.
GRU agents poisoned ex-double agent Sergei Skripal and daughter with Novichok nerve agent in Salisbury. Led to mass expulsion of Russian diplomats from 28 countries, severely degrading GRU’s official-cover network.
Explosions destroyed three of four Nord Stream 1 & 2 gas pipelines linking Russia to Germany. Attribution remains contested — Germany arrested a Ukrainian suspect in 2024. Denmark and Sweden closed investigations without assigning blame.
Polish prosecutors charged over a dozen people working for Russian intelligence with plotting sabotage of rail lines and arms transports to Ukraine. Hidden cameras monitoring railway routes were recovered.
Subsea gas pipeline between Finland and Estonia ruptured along with two telecommunications cables. Finland called it deliberate. A Chinese-operated vessel from Russia’s shadow fleet was identified as the suspected cause.
Wagner-linked agents recruited via Telegram set fire to an east London warehouse storing Starlink equipment destined for Ukraine. Ringleader sentenced to 17 years — the UK’s first conviction under the 2023 National Security Act.
IKEA store in Vilnius set ablaze (May 8); Marywilska 44 shopping center in Warsaw destroyed by arson (May 11). GRU-recruited Ukrainian nationals charged. Poland arrested 9 suspects tied to the Russian-directed network.
Western intelligence services disrupted a Russian plan to assassinate the CEO of Rheinmetall, Germany’s largest arms manufacturer and a key supplier to Ukraine. NATO described it as part of the broader sabotage campaign.
November: two fibre-optic cables severed (Finland–Germany, Sweden–Lithuania). December: Estlink 2 power cable between Finland and Estonia cut along with telecom cables, causing blackouts. Finland seized a Russian-owned ship suspected of involvement.
Incendiary packages routed through EU hubs and the UK intercepted. Officials suspected a Russian-led test of air-cargo routes with potential to cause airliner disasters. Arrests and extraditions in several states.
Deliberate explosions destroyed sections of a key railway route used for delivering Ukraine-bound military aid. Two Ukrainian-passport holders recruited by Russian intelligence fled to Belarus. Poland expelled Russian diplomats and closed Russia’s Kraków consulate.
Sources: IISS, AP, Prevail Partners, ACLED · Updated March 2026
The targets span critical infrastructure categories: railway networks, gas pipelines, communication cables, and logistics hubs. In November 2025, a deliberate explosion destroyed a section of Poland’s Warsaw-Lublin railway — a route crucial for delivering aid to Ukraine. Polish Prime Minister Donald Tusk attributed the attack to two Ukrainian-passport holders recruited by Russian intelligence services, who escaped to Belarus after the operation.
The recruitment model is notable for its low cost and deniability. Poland’s Internal Security Agency tracks dozens of attempted attacks daily, describing a shift from trained intelligence operatives to “disposable agents” — individuals recruited via Telegram, often young, unemployed, or struggling with addiction, paid small sums to carry out attacks. In one case, a Colombian national was arrested for arson attacks on construction depots, trained remotely by Russian agents who had him film the fires for broadcast on Russian state television. Teenagers have proven particularly susceptible to recruitment, with tragic consequences — in March 2025, two teenagers were killed by their own explosive devices near a Ukrainian train station, betrayed by their Russian handlers.
The strategic logic is clear: if Western publics begin to associate support for Ukraine with rising domestic insecurity, political pressure on governments to reduce their commitments may increase. This represents a deliberate effort to use sabotage as a tool of influence — not just for the physical damage inflicted, but for the psychological and political effects it generates. Drone sightings have forced temporary closures at major airports across Copenhagen, Berlin, Munich, Frankfurt, Brussels, and other European cities, creating disruptions that remind populations of the risks of their governments’ foreign policies.
Europe’s response has been primarily defensive: improved intelligence cooperation, enhanced infrastructure monitoring, and operations like Poland’s “Operation Horizon.” But if sabotage is now a permanent element of Russia’s confrontation with the West, many analysts argue the response needs to match that reality through active countermeasures and enhanced infrastructure resilience.
Geopolitical Implications
The bi-directional sabotage war carries implications far beyond the immediate conflict. For Russia, the strain on logistics, the diversion of resources to security, and the psychological toll of persistent internal attacks degrade its ability to sustain offensive operations. For Europe, the need to defend vast critical infrastructure networks against low-cost, deniable attacks represents a fundamental security challenge that is likely to outlast the war itself.
The tactics on display — from partisan railway sabotage inside Russia to GRU-coordinated arson in Poland — mirror historical patterns of intelligence warfare while incorporating modern innovations. The use of commercially available technology, social media recruitment, and encrypted coordination tools has democratized sabotage capability, making it accessible to state and non-state actors alike.
For students of irregular warfare, the Russia-Ukraine sabotage campaign represents a real-time case study in how asymmetric tactics can shape outcomes in conflicts between conventional military powers. The campaign’s effectiveness lies not in any single dramatic attack, but in the cumulative, persistent pressure that degrades capacity, erodes morale, and forces the enemy into reactive postures — the very essence of what sabotage has always been designed to achieve.
Behind the Lines: How Ukraine Has Outgunned Russia in Sabotage — ACLED’s comprehensive analysis of 1,200+ sabotage events with data-driven methodology. →
Ukraine’s Railway Wars: How to Sabotage Russian Military Logistics — Irregular Warfare Initiative analysis of the strategic logic behind railway targeting. →
Sabotage by Matt Cook — A thriller exploring modern sabotage operations and their real-world parallels. →

