Translated material
Since 2022, the Kremlin has carried out more than 150 hybrid attacks in Europe
During the four years of full-scale war with Ukraine, the Kremlin organized at least 151 hybrid attacks in Europe. This is stated in the analysis of the International Center for Combating Terrorism (ICCT) and the Globsec project.
Hybrid attacks are understood as attempted murders, for example, against oppositionists and escaped security officers, attacks, kidnappings, arson, explosions, sabotage, vandalism and violation of public order.
The largest number of attacks – 64 – were carried out in 2024. In the second half of 2025 and the beginning of 2026, 12 hybrid attacks were recorded in Europe. According to the researchers, only one attack was organized by members of the Russian special services; in nine other cases, associated actors were involved.
The largest number of sabotage incidents (31) occurred in Poland. She, according to the report, most often became the target of Russian hybrid operations. Five incidents since mid-2025 and 20 during the count occurred in France. In Lithuania and Germany over four years there were 15 incidents each, in the UK - 12, in Estonia - 11.
The authors of the report counted 172 perpetrators, 95% of whom had no previous formal ties with Russian intelligence services. However, only 58% of them knew who they were actually coordinating.
Most often, according to the report, the perpetrators of hybrid operations were Ukrainians. Also among the performers there were many Russians with European citizenship and emigrated Belarusians, Moldovans, Bulgarians and Serbs.
About half of the perpetrators did not live in the country where the attack took place, but came there specifically (the majority came from the Republic of Moldova, Serbia and Bulgaria).
ICCT and Globsec named financial gain as the main motivation for the performers. Most of them are between 30 and 35 years old and have had problems finding work, low salaries or debt. 11 performers were under 18 years of age, the youngest was 16 years old. Some of them fled from the territory of Ukraine unaccompanied by adults and were vulnerable.
At least 12 of the perpetrators were associated with far-right communities, and 44 had criminal records in the past.
Recruitment sites included prisons, borders, job search sites, and most often communication took place through Telegram, the report says.
Recruiters began by paying small sums for simple tasks, and then the size of the reward increased along with the complexity of the tasks - up to large arson or explosive attacks. According to ICCT and Globsec, approximately 90% of perpetrators operated with at least one accomplice, often in larger groups.
Many performers agreed to perform sabotage for several hundred euros. At the same time, the “ideological” (26 out of 172) who lived in the country where the attacks took place were offered higher fees: several thousand euros for complex operations. One of these perpetrators, the holder of Russian and German citizenship, Dieter S., was sentenced in 2025 to six years in prison for sabotage on the railway in Germany. He previously participated in the war in eastern Ukraine in 2014-2016 on the side of pro-Russian armed groups.
The scale of sabotage operations has increased following the expulsion of more than 600 Russian agents from Europe since 2018, the report’s authors note. Deprived of intelligence officers working under diplomatic cover, the Kremlin switched to recruiting civilian agents in Europe.
Since 2022, the Kremlin has carried out more than 150 hybrid attacks in Europe