By Galina Korol | 2025-11-17

While tanks and drones dominate the headlines, some of Europe's battles are unfolding in Poland's train yards and border towns, where Russian agents hunt for ways to disrupt the flow of Western aid.

Poland, a key transit hub for military supplies to Ukraine, remains a top target for Russian intelligence.

Between October 20-29, the Polish Press Agency (PAP), citing official sources, reported an unprecedented wave of counterintelligence operations. In recent months, Poland's Internal Security Agency has arrested 55 people accused of acting on behalf of Russian intelligence.

The latest detentions have heightened concern in Warsaw. PAP quoted Prime Minister Donald Tusk saying the agency, working with other services, had arrested eight suspects across the country "planning acts of sabotage." He said the investigation was ongoing.

Poland's Special Services Coordinator Tomasz Siemoniak said on X that the detainees had conducted surveillance of military sites and critical infrastructure while preparing materials for future attacks.

Viktor Yahun, a retired major general in Ukraine's Security Service, told Kontur that the arrests showed Europe was already in a "quiet war." He said similar spy networks had been uncovered in the Czech Republic, the Baltic states and Germany -- "everywhere supply chains of military aid to Ukraine pass through."

"Moscow is trying to destabilize the logistics of Ukraine’s allies ahead of a possible flare-up in fighting this fall," Yahun said.

One-time agents

Espionage is nothing new, experts say, but Russia's methods in Europe are evolving fast.

Volodymyr Solovian, head of the Hybrid Warfare Analytical Group at the Ukraine Crisis Media Center, told Kontur that Moscow lost many of its traditional intelligence tools after Western nations expelled Russian diplomats in 2022. Many of these diplomats worked in intelligence under diplomatic cover.

"Since 2022 Russia has lost a number of its traditional tools of influence, like networks of agents, which had been developing since the Soviet era," Solovian said.

He noted that Russia once relied on academic exchanges and research programs to recruit people who later advanced in foreign institutions. With those channels now closed, Moscow has turned to a faster, cheaper strategy.

"Russia has shifted to a gambit of one-time agents," Solovian said. "They find people through social networks who are dissatisfied with the government or just want to earn a living, and they hire them to carry out sabotage or intelligence."

In 2024 alone, Solovian said, about 150 suspected sabotage cases were recorded in the European Union, but the real number may be far higher. Many European countries still "don't have enough immunity" and struggle technologically to detect such operations.

He also pointed to weak coordination among EU intelligence services. Poland, Lithuania and Latvia have sharply cut Schengen visas for Russians, while Germany and France continue to issue tens of thousands.

"Under such circumstances it's very hard to track the infiltration of the Russian spy network," Solovian said. "When you let more than half a million Russian nationals onto your soil, it’s impossible to do the work to identify a spy network."

Ukraine aid targeting

In assessing Russia's sabotage campaign, Solovian said Moscow's efforts now center entirely on the war in Ukraine.

"Weapons deliveries to Ukraine are a sore spot for Russia, so of course that’s the number one target," he said. "Russia has staked everything in the war against Ukraine."

Solovian said the Kremlin sees disrupting Western arms shipments as a way to influence the battlefield and shore up its own economy.

"The weapons transfers by the Western countries are significantly drawing out the war, and in the future that could affect Russia's abilities not just to continue the aggression directly on the battlefield but also to keep its economy from collapsing," he said.

Solovian warned that Moscow could soon carry out more coordinated and open acts of sabotage in NATO countries, particularly in response to Ukrainian strikes on Russian refineries. He cited the 2014 explosions at Czech ammunition depots in Vrbětice, an operation later linked to Russian intelligence, as an example of how far the Kremlin is willing to go.

Baltic underwater espionage

Russian intelligence appears to be expanding its covert operations underwater, particularly in the Baltic Sea, a region important to both Moscow and NATO.

Citing a German media investigation, Bukvy reported October 26 that Russia's Main Directorate of Deep-Sea Research had installed special navigation and detection devices on the wreck of the Estonia, a ferry that sank in 1994 between Tallinn and Stockholm. The equipment allegedly helps Russian underwater drones navigate and track movement in the area.

The Estonia disaster killed 852 people, and the wreck, where many bodies remain, was declared a protected marine grave site. That this status made it an ideal cover for espionage.

"The choice of location is not accidental at all," said Pavlo Lakiychuk, head of security programs at the Centre for Global Studies Strategy XXI. "The Estonia is basically lying in the center of the Baltic, between Finland and Sweden. From there you can monitor the Baltic in all three directions."

Lakiychuk said hydroacoustic sensors on the ship's hull could monitor all underwater movement.

"If you put underwater acoustic surveillance systems on the vessel -- listening equipment or active sonars -- you can detect everything that's moving under the water, from submarines to midget submarines. This is a crucial boundary for Russia: they can see who is entering or leaving the Gulf of Finland going toward St. Petersburg," he told Kontur.

Western intelligence agencies reported increased Russian submarine activity near the wreck between 2021 and 2024, when Finland temporarily allowed new dives at the site. Around the same time, the Baltic states and the United Kingdom said they had found unidentified underwater sensors believed to be of Russian origin.

Analysts and Western officials note that Russia's Main Directorate of Deep-Sea Research operates some of the Defense Ministry's most secret programs. The agency commands a fleet of midget submarines and specialized vessels, including the Yantar, a ship NATO has identified as one of Moscow's key reconnaissance tools.

Even so, underwater surveillance is only one part of Russia's broader intelligence network.

"Russia is actively using a so-called shadow fleet -- tankers officially registered in other countries but crewed by people long recruited by its intelligence services," Lakiychuk said. "You can launch drones from those kinds of vessels."

He said Russia's military ships play a separate role, citing the Aleksandr Shabalin, a large assault ship in the Baltic Fleet.

"It has recently been spotted near the Danish Straits or north of Germany, and then drones appear there."

Analysts believe the Shabalin may relay data to or from drones launched by shadow tankers.

Lakiychuk offered another theory: "I can't prove this because it requires direct observation, but based on the ship's layout and capabilities, the Shabalin or another large assault ship in the Russian fleet could serve as a launchpad for those drones and for sabotage operations."

Unlike civilian vessels, he noted, military ships "are the territory of the state whose flag is flying," making them effectively untouchable. "It's like an embassy at sea."