Between January and May 2025, just 11 Russian-linked hybrid incidents were recorded in Europe, a sharp drop from over 30 in all of 2024, according to the International Institute for Strategic Studies. These acts included attacks on infrastructure like fiber-optic cables in Sweden, GPS jamming, and even arson targeting warehouses supplying Starlink equipment to Ukraine.

Western officials say the Kremlin’s reliance on poorly trained criminals—some of whom acted beyond their mandates—led to unintended escalation risks. In response, Russia’s GRU has reportedly begun instructing operatives to film sabotage operations to retain control and credibility.

Trump’s second-term diplomatic posture is believed to have influenced this rollback. Kremlin-linked actors were warned directly by US officials in late 2024 not to escalate hybrid threats. The warnings followed an arson attack at a UK DHL facility and fears that incendiary devices could be placed aboard US-bound cargo planes.

Hybrid War Evolves, Not Ends

Despite the decline in physical sabotage operations, Russian cyberattacks and traditional espionage continue at a high tempo, officials caution. Several ongoing investigations across the UK, Germany, and Poland suggest that Moscow still views hybrid pressure as a viable long-term strategy—particularly in eastern Europe.

In July 2025, three men in the UK were convicted of committing an arson attack linked to the Wagner Group. In Poland, a major 2024 fire that destroyed the Marywilska 44 shopping center in Warsaw was also attributed to Russian intelligence by Prime Minister Donald Tusk.

Analysts say the strategic reallocation of GRU assets to the Ukraine front reflects the Kremlin’s challenges in achieving battlefield gains, while domestic and European crackdowns have made proxy sabotage riskier. New UK legislation increasing jail time for sabotage is believed to have further deterred low-level operatives, who typically received meager payments and no state protection if arrested.