Under Siege - The Threat of Russian Sabotage in Eastern Europe

Key Takeaways:

• Since February 2022, Russia’s security and intelligence services have intensified sabotage and subversion operations across Eastern Europe, employing tactics from GPS signal jamming to arson attacks.

  
  

• The recent signal jamming attack conducted against Ursula von der Leyen’s plane in southern Bulgaria highlights the growing extent to which Russian operatives are willing and able to target high-profile political figures.

  
  

• Moscow's interference operations aim to both disrupt Ukrainian supply chains and signal Russia’s desire to regain hegemonic status within its former satellite states.

  
  

• Misinformation and physical sabotage campaigns in Poland demonstrate the range of tactics used by Russian operatives to achieve strategic national security objectives within the former eastern bloc.

  
  

• Lithuania, Estonia, and Latvia are likely to face an increase in the number of GPS jamming and signal spoofing incidents being conducted against both government and civilian air couriers due to the strategic significance of the Gulf of Finland to Russian naval forces.

  
  

• Moldova’s September 2025 parliamentary elections are anticipated to face significant Russian interference through cash payments to voters, paid protests, and AI-driven misinformation campaigns based on the tactics witnessed during the country’s 2024 presidential elections.

  
  

• European stakeholders face a heightened risk of physical sabotage, signal jamming, and online misinformation campaigns throughout Eastern Europe and the Baltic States as Russia seeks to consolidate strategic gains in the wake of the United States’ withdrawal of support from Ukraine.

The Empire Strike Back: Russian Sabotage Operations in the Former Eastern Bloc

Since its invasion of Ukraine in February 2022, Russia has relied increasingly heavily upon sabotage and subversion as instruments of foreign policy. These tactics, which range from arson attacks to radar signal jamming, constitute part of Moscow’s so-called “hybrid warfare” strategy, which aims to disrupt the operations of Ukraine’s European allies without a full deployment of military force. However, recent adjustments to the targets and tactics selected by the Kremlin suggest that the “hybrid war” strategy has undergone a degree of revision. Namely, western government officials have been targeted more overtly when travelling to via eastern Europe, whilst physical sabotage operations against industrial targets have grown more violent and expansive in scope. These developments may carry serious long-term security implications for European government personnel and industrial partners, whose risk of targeting by Russian operatives appears likely to increase over the next several months.

On 31 August 2025, the navigation system of a plane carrying European Commission President Ursula von der Leyen was disrupted due to suspected Russian interference in southern Bulgaria. According to initial reports, President von der Leyen was travelling to a meeting in Plovdiv when the satellite signal transmitting information to her plane's GPS navigation system was neutralised, forcing pilots to land the aircraft using only paper maps. Such incidents have become increasingly common across Eastern Europe and the Baltic states, where the Swedish Transport Authority have recorded a total of 733 cases of interference in 2025 alone.

Moscow’s use of signal interference serves two distinct purposes. Firstly, when launched against logistics or manufacturing operators, interference attacks aim to physically disrupt supply chains used in the provision of support to Ukraine.  Such examples include the arson attack conducted against a metallurgical factory owned by German defence contractor Deihl in June 2024, which aimed to disrupt a key German supplier of arms to Ukrainian forces. These operations typically leverage low-level threat actors, often using intimidation or financial incentives, to physically disrupt manufacturers and suppliers at source.

Secondly, interference and jamming attacks serve as a symbolic reminder to European leaders that Russia’s offensive capabilities remain powerful and varied, especially in regions where Russia perceives itself as a legitimate security guarantor. By engaging in limited acts of electronic warfare, Moscow aims to remind European leaders that the Kremlin maintains the capability and intent to conduct more serious acts of disruption, such as shutting down power to hospitals or permanently disabling airspace communications networks, if its diplomatic “red lines” are crossed. The fact that these acts have been primarily directed against targets in the Baltics and Eastern Europe suggests that Russia still regards affairs within its former satellite states as internal matters, thus justifying the employment of a far wider range of legal and security measures than would otherwise be used. Indeed, recent events in former eastern bloc states reveal this approach, which continues to pose heightened security threats to logistics providers, air couriers, and defence manufacturers across central and eastern Europe.  

A War on Two Fronts: Physical and Digital Sabotage in Poland

On 15 May 2025, Polish authorities reported attempts to interfere in the country’s presidential election campaign via cyber-attacks and digital misinformation campaigns. Specifically, researchers from Poland’s National Research Institute (NASK) issued reports detailing the discovery of “new information operations aimed at destabilising the country’s electoral process”. The analysis concerned the activity of a network of hundreds of fake accounts on the X social media platform, which reportedly spread political messages consistent with the Russian Federation's propaganda. The fact that pro-EU Warsaw mayor Rafal Trzaskowski was narrowly defeated by nationalist historian Karol Nawrocki demonstrates both the effectiveness of Moscow’s digital misinformation campaigns, and reveals the Kremlin’s intention to use such tactics to punish pro-European figures perceived as threats to Russia’s internal security.

Moreover, on 29 July 2025, Prime Minister Donald Tusk confirmed that authorities detained 32 individuals suspected of coordinating with Russia to engage in acts of physical sabotage. The group included nationals from Poland, Russian, Ukraine, and Belarus, in addition to a 27-year-old Colombian man accused of staging two arson attacks at Russia’s behest. The Polish Internal Security Agency confirmed that the suspect allegedly received his instructions, including how to make a Molotov cocktail to start the fires, from an individual associated with the Russian intelligence services.

Situated on both the physical and ideological front line of the Russia-Ukraine war, Poland has witnessed an especially sharp increase of activity from Russian intelligence and security operatives over the past three years. Many of the sabotage and interference campaigns directed by Moscow against Polish targets have directly involved units from the FSB and GRU, further revealing Russia’s perception of developments in Poland as internal security affairs. Over the next several months, pro-European government officials and defence manufacturers with ties to Ukraine are highly likely to incur attempted sabotage and disruption by the Russian security services as they aim to reconsolidate influence.

Signal Jamming in the Baltic States

Similarly, authorities in Lithuania, Estonia, and Latvia have placed their security services on high alert to respond to potential security threats from their eastern neighbour. Indeed, in 2024, several flights operating between Finland and Estonia were reportedly turned around mid-journey after pilots claimed they were unable to navigate safely due to GPS signal jamming. The same year, an RAF plane carrying British Defence Secretary Grant Schapps reported a “signal spoofing” incident, in which legitimate signals were replaced with fake ones to indicate a false location. The aircraft, which had been flying near the Russian exclave of Kaliningrad, was eventually able to continue its journey. These incidents further demonstrate the extent to which Russia has grown willing to use signal interference as a method of reminding both civilian and government targets of Moscow’s intent to protect its national security interest. Namely, the fact that the Gulf of Finland remains a major strategic chokepoint for the Russian navy means that maritime and aviation operators remain at high risk of targeting in the short to medium term.

Carrot and Stick: The Threat of Election Interference in Moldova

On 28 September 2025, Moldovan parliamentary elections are due to take place: an event which will almost certainly witness attempted Russian interference. Ongoing political tension regarding the nation’s political trajectory towards Europe provide fertile conditions for misinformation campaigns, as was witnessed during the country’s 2024 presidential elections.  The provision of cash payments to ethnic Russian voters in rural eastern regions, paid protests in urban areas, and social media misinformation campaigns based on AI-driven content were all tactics leveraged to undermine the pro-European agenda of President Maia Sandu. Based on this precedent, the country’s parliamentary elections are highly likely to witness similar tactics. Additionally, Russia has increased the number of missiles and drones passing through Moldova's airspace, likely in a bid to create fear among the Moldovan population that the war in Ukraine could spread westward should the country continue pursuing pro-European policies.

Looking Forward: The Future of Russian Interference in Eastern Europe

Recent adjustments to Moscow’s hybrid warfare strategy are likely to place government officials, logistics providers, and defence manufacturers across the former eastern bloc at a higher risk of disruption in the medium to long term. The withdrawal of American support for Ukraine has placed a larger onus on European nations, many of whom perceive Russian aggression as an existential threat to their own national security, to support Kyiv militarily and financially. This development has likely been received positively by Moscow, who may attempt to escalate physical sabotage, signal jamming, and online misinformation campaigns to solidify their strategic advantage over a weakened western alliance. As such, public and private sector stakeholders with links to western Europe or Ukraine are highly advised to revise and enhance their existing security protocols to ensure robust protection against the threat of Russian interference, which appears likely to grow ever stronger as the war in Ukraine continues .