Russia’s Shadow War Won’t Stay Hidden Forever

Poland’s Prime Minister has accused Russia of an “unprecedented act of sabotage” against its rail system, the latest in a wave of attacks attributed to the Kremlin’s shadow war.

The creator of James Bond, the naval intelligence officer Ian Fleming, had a keen understanding of the dark arts and how events form a pattern. “Once is happenstance,” he wrote, “Twice is coincidence. Three times, it’s enemy action.”  

Russia’s shadow war against Europe’s democracies is a long way past Fleming’s three-point checklist. Recent CEPA analysis showed 38 suspected attacks in the last three months or so. The most recent, an extensive plot to derail trains in Poland on November 15, has the usual (partial) fingerprints of the Kremlin’s increasingly reckless intelligence agencies. 

Two Ukrainian men were identified as suspects after an explosion on the railway line from Warsaw to Lublin — a crucial supply route for military aid to Ukraine. Prime Minister Donald Tusk called it an “unprecedented act of sabotage,” and said Russia was responsible. 

The perpetrators had been collaborating with Russian intelligence “for a long time,” Tusk said, adding that they fled to Belarus after the incident. One suspect had previously been convicted of sabotage in absentia by a court in Ukraine. 

The attack used military grade explosives and was triggered beneath a freight train. A passenger train travelling behind was able to stop before it reached the broken track. Damage was also discovered elsewhere on the same line. Tusk said the attacks were designed to cause mass casualties and added, “A certain line has been crossed”.  

As a result of the sabotage incident, Poland has raised the threat level for certain rail lines from level two to level three out of four, and over 400 soldiers are patrolling key sections of the rail system. 

The attack aligns with a wider trend of attempted interference. Two years ago, Polish authorities arrested more than a dozen people after uncovering secret cameras being installed close to railway lines, and blamed the Russian intelligence. Poland says 55 people have been arrested this year for aiding the Kremlin’s spies, and last month detained eight suspected saboteurs in joint raids with Romanian authorities. 

In May, Tusk said that he knows “for sure” that a large fire at a Warsaw shopping center in 2024, which left 1,400 small businesses in ruins, was ordered by Russia. Reflecting the heightened threat environment, the Polish Chief of the General Staff, General Wiesław Kukuła, described the current situation as a “pre-war state.” 

The pattern, however, extends beyond Poland. Western officials have repeatedly warned that Moscow attempts to sow division and chaos in European countries following their support of Ukraine in its efforts to regain lost territory. “These acts of sabotage and the actions of Russian services across the whole of Europe, not only in Poland, are unfortunately gaining momentum. We are dealing with an escalation,” Tusk said in a statement regarding the rail attack. 

Despite its denials, Moscow is frequently linked to a shadow war unfolding through attacks and incursions on European soil (some more obvious than others). It marked a shift when, in September, German Chancellor Friedrich Merz said that Europe “is not at war . . . but no longer at peace” with Russia.  

What is Russia up to? CEPA’s November 19 report on the shadow war looked at Russia’s motives. Irina Borogan and Andrei Soldatov concluded that: “Intelligence and proxy operations give the Kremlin escalation options that fall below the threshold of overt war yet impose real pressure on Western public opinion, on the tempo and cohesion of military aid to Ukraine, and on the bandwidth of Western security and defense institutions. In other words, they allow Moscow to widen the [Ukraine] war’s effects without widening the war.” 

Russia is undeterred even by those operations that fail, because this successfully creates disruption and a sense of threat, telling the West it is under attack. And it makes a pledge to return its rescue its captured agents — Western intelligence is now fighting a battle with the Kremlin’s spy agencies over custody of a suspect in a July 2024 plot to bomb DHL cargo aircraft, according to the Washington Post. He is currently being held in Azerbaijan. 

What is the Kremlin’s broad aim? “To engage in an ongoing, global confrontation with the West using the tools of subversion, sabotage, and deception,” write Borogan and Soldatov. 

There’s no neat or easy way to combat this increasingly reckless campaign. Attacks such as railway sabotage were once part of all-out war; now they are part of all-out pre-war. European states will not launch military attacks in response, as Russia is all too aware. The response is limited to the counter-shadow war work of NATO intelligence agencies and whatever European governments can muster as deterrence. Notably, the attacks have brought little comment or condemnation from the US — a recent European think tank report was titled “Alone we stand”. 

The attacks are only likely to rise, meaning that — at some point — European leaders will have to explain to voters that their options are limited. That may create a public backlash — a key target of recent disruption has been major European airports in Copenhagen, Munich, and Brussels. If that happened during the summer holiday season, the effects would be multiplied. A passenger train derailment could cause multiple deaths and injuries. 

A German military historian has warned that the next three years are the most dangerous, and the threat of escalation remains alive. 

War may be creeping up on Europe, little by little. Just because it is fought in the shadows doesn’t mean it will stay there forever.