The warning comes after a British court convicted three men over a March 2024 warehouse fire in east London—a site that stored military-grade equipment bound for Ukraine. The arsonist, Dylan Earl, was in contact with a handler using Russian-language messaging apps and linked to Wagner-affiliated Telegram channels.

Authorities revealed that since 2022, there have been more than 70 similar incidents across Europe, including 12 serious cases of arson or sabotage in 2024 alone—compared to just two in 2023. Officials now fear that the campaign, which began with low-level vandalism, is becoming increasingly violent and difficult to control.

“This kind of campaign creates its own momentum and escalates in danger,” one senior intelligence official told AP, citing firebomb plots in Lithuania, explosive-laden packages in Germany and Poland, and a failed bombing at a Vilnius IKEA store.

Moscow’s Shift to Amateur Saboteurs

Following the mass expulsion of Russian intelligence officers from Europe in 2018 after the Skripal poisoning, Moscow has resorted to recruiting foreign amateurs—often through online channels linked to the Wagner group. Many operatives are young, without criminal records, and motivated by small payments or ideological appeals.

Court evidence revealed messages between Earl and a handler called “Privet Bot,” who urged him to act independently, praised him as a “clever” young recruit, and recommended watching the spy drama The Americans as training. Earl had never met his co-conspirators in person and reportedly used Google Translate to communicate.

After the London fire, which destroyed half the warehouse contents and endangered nearby homes, Earl was told by his handler: “You are our dagger in Europe.” The recruiter reportedly expressed frustration that the attack was launched prematurely, rendering payment “impossible”—yet encouraged Earl to target additional Ukraine-linked businesses.

Escalation Beyond Control

European officials worry that Russia’s reliance on proxies—who lack formal training and oversight—has created a dangerous, decentralized sabotage ecosystem. Targets have included Starlink shipment centers, refugee support groups, and businesses owned by Russians supporting Ukraine.

Finnish intelligence analyst Lotta Hakala warned that Russian services try to maintain “strict operational control,” but “sometimes, that control does not hold.” This raises the risk of unintended casualties and long-term destabilization in urban centers.

Despite denials from the Kremlin, analysts say the campaign reflects a broader hybrid war strategy aimed at stretching European security services and intimidating civil society actors involved in Ukraine support.