Russia’s Shadow Army in Europe: How Small Attacks Serve the Kremlin’s Bigger Goals

Russia does not need to win a single battle against Europe. It is enough for Europe to start hesitating over its own decisions.

In the first article in this series, we examined how Russia uses locally recruited operatives in Europe to carry out sabotage, espionage and influence operations. The second looked at how social media has become the main tool for recruiting them. This time, we ask why this strategy works in the Kremlin’s favour. Why would Moscow devote time and resources to operations whose immediate damage is often limited, whose perpetrators are amateurish, and whose links to Russia are becoming increasingly difficult to conceal?

The answer is uncomfortably simple. A burned building, a severed communications cable or a drone flying over a military base is not necessarily the ultimate objective of the operation. These are tools used to test Europe’s resolve, drain its resources and influence political decisions.

The Hague Centre for Strategic Studies report Europe’s Strategic Trap describes Russia’s below-threshold campaign as selective, rational and logically structured pressure whose primary aim is to reduce Europe’s military and financial support for Ukraine.

The Target Is Not the Cable, but the Decision-Maker

When a communications cable is damaged in the Baltic Sea, attention first turns to infrastructure. When a drone is spotted over a German airport, the discussion focuses on airspace security. When Poland investigates attempted sabotage against railways or logistics hubs, the focus is usually on the specific site involved.

The HCSS report turns this perspective around. According to its authors, the real target of Russia’s below-threshold attacks is not the airport, railway or port. It is the European decision-maker who must choose between supporting Ukraine, protecting national security, managing the budget and responding to domestic political pressure.

In this logic, sabotage is a form of communication. An attack sends the message that supporting Ukraine will not come without consequences. The more European countries send weapons, transport equipment or discuss long-term funding for Ukraine, the more likely the Kremlin is to test where the next weak point lies.

HCSS cites Belgium and Poland as examples. In Belgium, the drone incidents of 2025 were linked to discussions about using frozen Russian assets to support Ukraine. In Poland, the backdrop was a debate over the possible role of European troops in Ukraine. In both cases, the purpose of the drones went beyond merely violating airspace. They demonstrated that Russia could raise the cost of a political decision.

This pressure does not need to be dramatic. The Kremlin does not have to stage a major explosion or an attack causing casualties every time. Quite the opposite: a small attack is often more useful. It creates enough uncertainty to force a response, while remaining below the threshold that would trigger a military reaction from Europe.

In March 2026, the Council of the European Union described Russia’s hybrid campaigns as persistent, coordinated and long-term activities aimed at undermining the security, resilience, democratic foundations and support for Ukraine of the European Union and its partners. The same document specifically mentions sabotage, attacks on critical infrastructure, cyber operations, information manipulation, election interference and the weaponisation of migration.

This marks an important shift. Europe no longer treats these incidents as isolated crimes, but as different tools within the same campaign.

A Cheap Attack, an Expensive Defence

For Russia, the advantage of small-scale attacks lies in the imbalance of costs. Finding a local recruit, giving them an assignment and promising payment is cheap. If the person is caught, the Kremlin loses little. The recruiter often remains hidden behind intermediaries, temporary accounts or anonymous payment methods. If the operation succeeds, its impact may be far greater than the immediate damage caused.

Europe, however, must treat every incident with the utmost seriousness. A suspicious drone over an airport means an investigation, disruption to air traffic, additional equipment, new procedures and political pressure. Damage to an undersea cable brings repair costs, a heavier burden on naval and border guard resources, insurance issues, an international investigation and the need to protect dozens of similar connections.

Regarding undersea cables in the Baltic Sea, Geopolitical Monitor notes that the attacker’s costs may be limited to hiring a third party, while repairing the damaged infrastructure can cost millions or even tens of millions of euros and take months. The same report describes the persistent dilemma posed by grey-zone attacks: an overly forceful response may increase the risk of escalation, while a weak response invites further attempts.

HCSS calls this Europe’s strategic trap. Russia chooses the time, place and method. Europe must defend every potential target, all the time. If air bases become better protected, the pressure shifts to ports. Once ports receive additional protection, attention moves to railways. When the railways are under surveillance, the energy system can be tested instead.

This model wears down the defender. Not through a single attack, but through the accumulated effect of dozens or hundreds of small incidents.

Why Limited Damage May Be Enough

The impact of a small attack lies not only in what it destroys, but in what it sets in motion afterwards. First comes the investigation. Then new security measures. Next, a political debate over whether the country was adequately prepared. After that come another budget decision, another legislative change and another discussion about whether the state is properly protected. Every step consumes money, time and attention.

All three are limited resources. One of the HCSS report’s central arguments is that European defence, societal resilience and support for Ukraine all depend on the same economic base. If Russian attacks force Europe to invest ever more heavily in protecting its own infrastructure, the pressure may fall on the same budgets that fund military assistance to Ukraine.

This is the logic behind the Kremlin’s strategy. If these attacks help create the impression that supporting Ukraine brings ever more threats to Europe’s own streets, ports and airports, maintaining that support becomes politically more costly. The Kremlin does not need to persuade Europeans that Russia is right. It is enough to make them feel that the price of supporting Ukraine is becoming too high.

This is psychological and political pressure, not a conventional military victory. Russia does not need to break through Europe’s defences. It needs to erode Europe’s willingness to take risks.

The Grey Zone Favours the Weaker Side

Russia is not militarily stronger than NATO. The combined economic, technological and military capabilities of the European Union and NATO exceed those of Russia. In a conventional direct confrontation, the balance of power would be unfavourable to the Kremlin. Below-threshold activity changes that equation.

HCSS explains this through the stability-instability paradox. Nuclear deterrence reduces the likelihood of direct war between major powers, while at the same time giving a nuclear-armed state more room to operate at lower levels of violence. When Russia carries out limited sabotage or violates airspace, NATO does not respond with military force because the risk of escalation outweighs the significance of the individual incident.

The Kremlin exploits this space. The attacks remain limited enough to be described as crimes, accidents, the work of local radicals or incidents requiring further investigation. At the same time, they are frequent and targeted enough to shape the broader sense of insecurity.

The Council of the European Union defines hybrid threats as actions deliberately designed to be difficult to detect and defend against while remaining below the threshold of armed conflict. This creates a convenient operating space for Russia, allowing it to cause meaningful harm while limiting its accountability.

For Estonia, This Is Not a Theoretical Question

Estonia is not merely an observer in this story. The annual review of the Estonian Internal Security Service (KAPO) describes how Russia’s hostile activities are intended to weaken social cohesion in Estonia, divide the country from its allies and undermine public trust in the government. According to KAPO, Russian propaganda has largely shifted to social media, where algorithms and artificial intelligence amplify it and local individuals further spread hostile narratives.

The same annual review also describes the recruitment of so-called disposable agents through social media. KAPO cites the recruitment campaign to vandalise the Sinimäed memorial and the arson attack on the Slava Ukraina restaurant. The purpose of targeting such symbolic sites is not merely to damage property, but to create anxiety and deepen divisions within society. This fits precisely the same logic that HCSS describes at the European level. Physical damage is a means. The real objective is political and psychological impact.

When a site with symbolic value is attacked, the outcome is not measured solely by the financial cost of the damage. What matters is whether the incident creates anxiety, intensifies confrontation, fills the public sphere with accusations and suspicions, and helps the adversary carry its message into mainstream media. KAPO notes that the adversary considers reaching mainstream media a sign of success, because it lends greater credibility to hostile messages and amplifies their spread.

Such incidents cannot therefore be viewed merely as items in the crime news. They are part of a broader attempt to make society react at a pace and on issues chosen by the adversary.

How Can Europe Escape This Trap?

The sharpest part of the HCSS report concerns Europe’s response. According to its authors, better protection alone is not enough. If every attack leads to another layer of defence but does nothing to increase Russia’s costs, the Kremlin retains the initiative. Europe defends; Russia chooses the next target.

The report proposes four lines of action:

• prevent Russia from influencing political decisions related to support for Ukraine;
• disrupt the command and financing of Russian intelligence and sabotage networks in Europe;
• limit Russia’s ability to carry out below-threshold attacks;
• make the cost of such attacks significantly higher for Russia.

The most forceful proposal is to reverse the logic of pressure. According to the report’s authors, every Russian below-threshold attack should result not in less support for Ukraine, but in more. This would make each new attack strategically harmful to the Kremlin rather than beneficial.

This is not merely a technical security recommendation. It is also a question of strategic communication.

If Russia’s aim is to show that supporting Ukraine makes life in Europe less secure and more expensive, Europe’s response must send the opposite message: pressure will not reduce support for Ukraine, but will increase the price Russia has to pay. Otherwise, the Kremlin will retain every incentive to continue. Each small attack may be a cheap test of whether Europe is beginning to hesitate.

Small Attacks, a Big Question

Russia’s shadow army is dangerous not only because a recruited operative may set fire to a warehouse or photograph a military train. It is dangerous because its activities force European societies to live in a state of constant uncertainty. Is the next drone merely a coincidence? Was the damaged cable an accident? Was the arson attack the work of a local criminal, or part of a larger operation? Is Russia really behind every incident, or are we beginning to see the Kremlin even where it is not involved?

The last question is especially important. Exaggerated fear can also serve Russia’s interests. If society begins to interpret every accident as a Kremlin operation, uncertainty grows even without a new attack. Yet if Russia’s involvement is consistently underestimated, the broader pattern remains invisible. This is why both levels must be considered at once. The evidence in each individual case must be precise, but the wider picture must not be lost.

The first two articles in this series examined how Russia organises such operations and whom it recruits to carry them out. Their broader purpose should now also be clear. The Kremlin does not always need a major attack to achieve a major effect. Sometimes limited damage is enough, provided it makes the adversary more afraid, forces it to spend more and causes it to hesitate longer over its decisions.

Europe’s greatest risk is not merely that another cable may be severed or another saboteur may carry out an assignment. The greater danger is that small attacks begin to shape major political decisions.