In recent months, taking advantage of pliable politicians and a vulnerable information space, Russia has escalated its hostile actions in Europe in both frequency and intensity. In fact, Russia’s destabilizing actions have become so brazen that simply calling them “foreign interference” does not adequately describe them. Rather, Moscow’s active measures are moving into the physical realm and, in some instances, using violence, perpetuating an increasingly volatile “hybrid warfare” on European soil.

Chaos Commandos

Recent events in France illustrate this escalation. In the run-up to the European Parliament elections in June, a series of seemingly unrelated incidents in Paris all led back to Moscow. In late October 2023, as tensions in the Middle East were flaring up, Stars of David were spraypainted throughout Paris and its suburbs. Social media accounts affiliated with the Russia-linked Doppelgänger operation rapidly amplified news of the tagging. By February 2024, French intelligence had assessed that the Fifth Service of the FSB, in charge of “Operational Information and International Relations”, had directed the entire operation by flying in a Moldovan couple and supplying them with phones, paint, and stencils.

A similar incident took place in May 2024, with red hands spraypainted on the wall of Paris’ Holocaust memorial. News of the defacement spread rapidly across French media as evidence that antisemitism was on the rise in the country. However, French security services have since determined that the culprits were in fact Bulgarians who had quickly fled the country after the tagging. The team included a photographer whose pictures then appeared on Russia-linked sites, leading authorities to suspect that Moscow was the operation’s ultimate sponsor.

In June, mere days before the European vote, and as French President Emmanuel Macron was publicly discussing the possibility of deploying troops in Ukraine, five coffins covered by French flags and a sign that read “French soldiers of Ukraine” were left at the foot of the Eiffel Tower. As in the two previous cases, none of the people arrested over this incident were French and two of them admitted to receiving 400 euros to deposit the coffins. Investigators found that those four men were in contact with one of the Bulgarians who had defaced the Holocaust Memorial the previous month.

Sabotage Online and Off

All three incidents in France had a clear informational dimension and were primarily meant to generate inflammatory content that could then be disseminated online to exacerbate division and polarization. Yet, they still involved Russian-directed commandos conducting kinetic, subversive activities. Elsewhere in Europe, Russia’s activities have moved even further into the kinetic realm. In Germany and Czechia, security services arrested people who were attempting to engage in arson and sabotage. In both cases, European authorities called out Russia for sponsoring these attempts.

In a further display of reckless disregard for European sovereignty and for the basic norms of international conduct, Russian state-sponsored actors have also been attempting assassinations against foreign citizens it thinks are critical to Ukraine’s resistance against Russian aggression. In early July, Western intelligence agencies accused the Kremlin of planning to kill the head of German arms manufacturer Rheinmetall. The German company is a key provider of military equipment to Kyiv and its CEO is “an outspoken proponent of Ukraine’s war efforts”.

Sabotage and assassinations are but the tip of the iceberg of Moscow’s broader campaign to destabilize Europe and to undermine the public trust in their governments’ ability to deliver basic services—first and foremost, security. This year alone, and looking only at the small number of cyber operations prominent enough to have been publicly attributed, pro-Kremlin hackers were behind attacks targeting Germany, Greece, Poland, Switzerland, and Czechia. Most of these attacks were intended to harm European support for Ukraine, whether by spreading leaked military conversations as was the case in Germany, by spreading false information about troop mobilization in Poland, or by disrupting Ukrainian President Volodymyr Zelenskyy’s visit to Davos in Switzerland. However, other attacks seemed solely designed to create chaos, as was the case with a March 2024 attack that affected Greek public transportation, shipping, and banking services.

In the cyber domain, Russia is not the only malign actor. People’s Republic of China (PRC)-sponsored hackers also actively target institutions inimical to Beijing’s interests. In March 2024, the United States denounced a multi-year cyberattack operation against a group of 124 PRC-critical parliamentarians from around the world, many of them based in Europe. that same month, the United Kingdom accused “Chinese state-affiliated actors” of targeting the country’s electoral watchdog and some of its lawmakers. Britain’s cyber security service estimated it was “highly likely” that the information stolen from the Electoral Commission would be used for “large-scale espionage and transnational repression of perceived dissidents”.

Conclusion

While they could seem quite manageable in isolation, these incidents cause considerable disruption in aggregate. They put additional stress on already overburdened security services and contribute to a general climate of insecurity and instability in the minds of ordinary citizens. In the case of the PRC, one can draw parallels to the situation in Taiwan, where the PRC systematically conducts threatening military exercises around the time of Taiwanese elections to ensure voters are under maximum pressure to choose candidates that won’t go against Beijing’s wishes. Meanwhile, Russia’s increasingly kinetic active measures serve a twin purpose: they aim to disrupt Europe’s support to Ukraine and give credence to pro-Russian parties’ arguments that confronting Russian aggression in Ukraine will only result in the entire European continent being dragged into a wider war.

The views expressed in GMF publications and commentary are the views of the author alone.