Russian Hybrid Warfare on EU Intensifies
Germany’s domestic intelligence agency (BfV) warns that Russian threats to internal security also includes clandestine activities by the Russian intelligence services
Russia is staging their expected spring offensive in Ukraine, in practice ignoring attempts to reach a ceasefire agreement. At the same time, Russia also steps up its hybrid warfare on Europe, warn the German intelligence agencies BND and BfV (Verfassungsschutz) in its April report.
The dangers posed by espionage, sabotage, and disinformation have increased significantly since 2022 with Russia's war of aggression against Ukraine. While Russia's inhibition threshold for actions against Germany has decreased, the increase in incidents recorded in Europe that also generate public attention shows that Russia views the use of force as a legitimate means. In doing so, it deliberately uses public space as a sounding board. This threat to internal security also includes clandestine activities by the Russian intelligence services. However, it is becoming clear that actions with a publicly perceptible component – such as drone flights over military property and other sensitive areas, some of which have been repeatedly discussed in the press and may be controlled by Russia, cyberattacks against public bodies and companies, undue influence, acts of sabotage, and the accompanying propaganda of such activities – also represent a means of demonstrating power and intimidation for Russia.
Research published by WDR, NDR, and the Süddeutsche Zeitung on 23 April concludes that Russia's military intelligence service GRU is allegedly behind arson attacks involving DHL parcels last year, and that the Russian sabotage is on the rise in the rest of Europe.
Leipzig Airport is a major hub for Germany-based international parcel logistics company DHL. Last summer, incendiary devices were discovered in some of their warehouses both in Germany and Great Britain, where they caught fire. Some of the packages were allegedly destined for USA. In Poland, a package also set fire to a DHL truck. The incendiary devices were said to have been hidden in massage cushions, which were found in the packages along with cosmetics and sex toys, according to media reports. By luck, the parcels were discovered before being sent off by plane, because a fire on board could have caused a crash.
Investigations led to arrests in Germany, Lithuania, Poland, Bosnia-Herzegovina, and Great Britain. Some of these are ‘amateur’ agents recruited via Telegram, for example, to take on specific tasks without knowing the exact background. European intelligence agencies find that terrorists, including Russian agents, are finding new ways of recruiting agents for the low-level work involved with sabotage and terror attacks.
DHL crash in Lithuania
A Spanish cargo plane flying from Leipzig in Germany crashed in Vilnius at around 05:30 in the morning of 25 November, one of the four crew members onboard was killed, reported the local media LRT. The plane crashed into a residential area outside the airport but by luck, there were no person injuries to people on the ground. The incendiary devices discovered at DHL Leipzig earlier in the year came from Lithuania and were traced to a Russian source. However, the investigation later concluded that the reason for the crash was human error.
The investigation into the crash of a Spanish DHL plane in Vilnius last year found no evidence of foul play, Lithuanian Justice Minister Rimantas Mockus told reporters on Wednesday. (LTR report 2 April 2025)
LRT reel with surveillance video of the crash
As covered in an earlier post about Russian interference with air safety in the Baltic area, there are constant GPS disturbances all the way from Finland to the Baltic states. However, investigations of the Lithuanian crash concluded that the reason was human error, because the pilots were performing a perfectly normal landing - 1 km short of the actual airstrip - until the low altitude warning sounded, and it was too late to abort the landing.
Cable sabotage in the Baltic Sea
Since NATO started its intensified surveillance in the Baltic Sea earlier this year, there have been fewer reports of suspected sea cable sabotage. In February, there was a report from the Gulf of Finland that a Russian (!) cable had been damaged, inside Finnish territorial waters. Wall Street Journal recently discussed that the NATO activity has not led to any prosecutions, most likely because NATO has not been able to find proof, as of 8 April.
Drone incidents
Over the last few years, there have been incidents with unidentified drones flying close to airports, harbors or military installations. At the latest, in March, five Russian drone passes were detected over the EU Joint Research Center (JRC) in Ispra, Varese. (Disclaimer: The author of this newsletter worked for the JRC in the 1980’es). The center’s anti-drone systems detected the activity and reported to authorities, including concerning other sites in the vicinity, such as important plants of the Italian defense systems manufacturer Leonardo, as reported by Il Corriere della Sera on 25 March.
With their experimental detection system for unknown aircraft, JRC staff managed to capture at least five passages of the device that they also state is considered by experts to be of Russian manufacture. According to Il Corriere, the Leonardo Helicopters Training Academy is in Sesto Calende close by, while a little further away, in Vergiate, is the Helicopter Division, the flagship of Italian design and production of latest-generation civil and military aircraft. And still other strategic centers within a radius of 40 km are in Somma Lombardo, Samarate, and Venegono Superiore including the headquarters of the Aircraft division.
A no fly zone has now been announced over the European research center in Ispra as well as other critical areas nearby.
The newspaper also writes that the intention of Russian intelligence to map specific cities and places in Italy already emerged last year with the investigation by the Carabinieri of the ROS special operations group on two Milanese owners of a technology services company accused of ‘corruption of the citizen by the foreigner’, aggravated by the purpose of terrorism and subversion. After being ‘enlisted’ on Telegram and in exchange for cryptocurrency payments, the couple used dash cams mounted on taxis to film sensitive locations in Milan and Rome.
Russia’s escalation to test the NATO Article 5
Intelligence agencies in Europe warns that Russia has escalated its intimidation approach in a way that leads experts to believe that they are getting close to testing NATO's Article 5. ‘Russia is pushing the boundaries and testing when and how we will respond,’ says Lithuanian Foreign Minister Kęstutis Budrys to Süddeutsche Zeitung. ‘Does a cyberattack on a hospital or on our critical infrastructure, in which many people could die, already constitute Article 5? We discuss and discuss, but instead we should start setting limits and taking action ourselves.’
This is a worry. Thank you for reporting on this important topic.
These are concerning reports. Thanks for putting everything together.