U.S. and European officials say they’re seeing a decline in suspected Russian state-backed sabotage acts this year, evidence that President Vladimir Putin’s security services may be reining in a hybrid warfare campaign that’s been blamed for attacks across Europe.

The drop-off in operations, which have involved Russian intelligence agents paying proxies to target civilian infrastructure and individuals, has been attributed to a range of factors, according to the officials, who asked not to be identified discussing sensitive issues. A leading explanation is that Moscow may be tightening its grip on attacks entrusted to unreliable local criminals, some of which had got out of control and risked a major miscalculation, the people said.

There were 11 suspected Russia-backed hybrid incidents in Europe between January and May this year, including the attempted sabotage of fiber-optic cables and cell towers in Sweden, a report by the International Institute for Strategic Studies think tank concluded. That compares to a record high of more than 30 in the whole of 2024, according to the IISS’s dataset of attacks on energy, communications, transport, military, water and undersea targets.

Western officials believe one factor may be that Putin wanted to avoid further antagonizing Donald Trump in the early months of his second term as the U.S. president sought to reach a rapid peace deal in Ukraine. Other possible reasons include potential recruits being deterred from involvement by high-profile trials of saboteurs caught by law enforcement, forcing Moscow to adapt its tactics, and Russia’s GRU military intelligence service redirecting resources to Ukraine in recent months, they said.

Kremlin spokesman Dmitry Peskov didn’t respond to a request to comment. He has previously dismissed reports that Russia carries out sabotage in Europe as “unfounded accusations.”

U.S. officials at the White House and the Office of the Director of National Intelligence didn’t respond to requests for comment.

Western officials say hybrid operations became a key part of Russia’s playbook in the wake of its full-scale invasion of Ukraine in February 2022, as the U.S. and Europe sent Kyiv billions of dollars of weapons to defend itself. With much of Europe expelling Russian spies tied to its embassies in recent years, the people say that Moscow shifted to paying local proxies to carry out acts of violence, sabotage and arson in a campaign of disruption.

The Russian campaign has been viewed as an effort to target Western nations over their support of Ukraine. In contrast to his predecessor Joe Biden, Trump’s military aid for Kyiv has been less reliable. The U.S. recently agreed to continue sending weapons to Ukraine as long as European allies pay for them.

The officials cautioned that the apparent waning of the campaign wasn’t an indication that hybrid attacks had stopped completely or wouldn’t escalate again in future. Sabotage plots remain higher in Eastern European countries than in Western nations, they said.

The decline in incidents may have started in fall 2024 after high-level U.S. officials reached out to their Russian counterparts to warn them against conducting future operations, people familiar with the conversations said, asking not to be identified because the issue is sensitive. The contacts took place amid American fears that Russia would put incendiary devices on cargo planes bound for the U.S., following a fire at a DHL facility in Britain in July 2024.

Hybrid attacks are defined as hostile state-backed threats using both conventional and unconventional military methods, designed to destabilize opponents while blurring the threshold of a declared act of war.

Three U.K. residents were convicted in July of carrying out a March 2024 Russia-backed arson attack on a London warehouse of a firm that supplied goods, including Starlink satellite equipment, to Ukraine. Ken McCallum, head of Britain’s domestic security service MI5, said last year that Russia was on a mission to generate “sustained mayhem on British and European streets.”

In May, Polish Prime Minister Donald Tusk accused Russian intelligence services of orchestrating a 2024 arson attack that almost completely destroyed a shopping center in Warsaw.

Other incidents attributed to Moscow include vandalism, the jamming of GPS signals and a foiled plot to assassinate the CEO of a German arms company.

“Russia is currently waging two wars,” Finnish President Alexander Stubb said last year. “One is a kinetic, conventional war in Ukraine. The other is a hybrid war in Europe and the West with the aim of influencing the tone of public discourse or in some way shake our sense of security.”

Russia may be struggling to maintain strict control over operations, with some cases of sabotage and arson going beyond the aims of those who commissioned them, some of the officials said. That may be due in part to the incompetence and unreliability of petty criminals hired to carry out the actions, they said.

There’s also evidence that some individuals, described as self-starters, have acted on their own initiative in hopes of impressing potential Russian paymasters, again risking erratic outcomes, the people said.

In response, Russia has increasingly ordered local proxies to film themselves carrying out attacks to try to ensure plots unfold as planned, the people said.

The diverting of Russian intelligence resources to Ukraine was revealing of the Kremlin’s struggles to secure breakthroughs on the ground this year, despite Putin’s public narrative that he’s winning the war, the people said. It also suggested Russian resources are stretched.

Changes to the law in countries like the U.K. have increased prison sentences for involvement in such incidents. That has raised the risk for potential recruits, who are often paid only a few hundred euros or pounds by Russian intelligence and have no diplomatic protection if they’re caught.

While plots have declined this year, European governments continue to record regular and serious cases of Russian cyberattacks and more traditional espionage attempts, some of the officials said.

———

(With assistance from Alberto Nardelli.)

©2025 Bloomberg L.P. Visit bloomberg.com. Distributed by Tribune Content Agency, LLC.