From arson to cyber attacks, the UK faces an unprecedented threat from Russia
cancel email WhatsApp link share Share bookmark Save
share cancel email WhatsApp link bookmark
A Nato unit dedicated to combating the growing threat from Russia’s hybrid warfare is working with British security services to investigate a string of suspected sabotage attacks on UK soil, The i Paper can reveal.
While the alliance traditionally focuses on conventional military threats, a taskforce is currently drawing up a list of suspected Russian hybrid attacks in Europe, according to a Nato official and a UK intelligence source. These threats include arson, cyber hacks and sabotage of critical undersea communication cables.
Russia has increased these “grey zone” assaults against Nato members following its full-scale invasion of Ukraine.
On Tuesday, three men from south London were found guilty of being part of a plot by Russian mercenary outfit, the Wagner Group, to recruit young Brits and carry out an arson attack at an east London business delivering aid to Ukraine.
A Nato official told The i Paper: “Their [Russia’s] goal is to destabilise opponents, cause panic and fear among the general public and weaken authority and trust with governments.
“Its easy to respond to someone firing a missile at us because we can see it and understand it but when you have acts conducted by low-level criminals with multiple levels removed from a state, it is very difficult to respond effectively.
“What we have seen is that hybrid attacks don’t happen in isolation. They are conducted in co-ordination with other events, cyber campaigns for example, to portray a nation or government as weak.”
The Nato unit forms part of the alliance’s innovation, hybrid and cyber division, headed by Nato deputy secretary James Appathurai. It focuses on risks to energy security, undersea cables, and emerging technologies such as artificial intelligence.
The Nato division is working alongside member states, including the UK, to build resilience to these methods.
“We are also looking at what if we get a hybrid attack that leads to a mass casualty event,” the Nato source said. “If a cyber attack or something else causes the death of multiple people, how do we scale up our response and retaliation to this and how does it fit in with the constitution of Nato.”
A UK intelligence source said Russia has “sowed so much doubt” into the minds of the public around sabotage attacks, that with each fire, explosion, drone incursion or hack, suspicions automatically turn to the Kremlin.
Sabotage: the prevailing issue for Europe
The UK is also believed to be working closely with Lithuanian and Polish officials who have taken a lead in setting up units specifically aimed at Russian sabotage attacks.
Lithuania’s former foreign minister, Gabrielius Landsbergis, was a driving force behind his country’s initiative on the issue. During his tenure in government he took a key role in investigations into a Russian plot to plant explosives in the supply chain of logistics giant DHL.
The former minister told The i Paper that Russia’s sabotage first “started as a test” but has now become “the prevailing issue in the region”.
Gabrielius Landsbergis says he grew concerned that nations were playing ‘whack-a-mole’ with Russian recruits (Photo: Mindaugas Mikulėnas)
“The people who do the work, they are disposable, they are very cheap,” he said. “They still take a lot of resources from the country where the operation took place in order to catch them.”
Landsbergis added that during his time in government he grew concerned that nations were playing “whack-a-mole” with Russian recruits.
“We might be running after some Belarusian or Ukrainian guy and you have police, you have intelligence, you have prosecutors trying to figure out what’s happening and at the same time they [Russia’ can recruit ten more of people like this and think of ten more operations like this,” he said. “Because it’s so easy now to, via Telegram channels, via technology, to reach out and recruit.”
On Tuesday, a jury found three men, Nii Kojo Mensah, Jakeem Rose and Ugnius Asmena, guilty of committing aggravated arson on an east London warehouse.
During a four-week trial at the Old Bailey, the jury heard how a county lines drug dealer, Dylan Ear, was radicalised by a slurry of pro-Kremlin propaganda on Telegram. He accused Ukraine of killing innocent people while praising Vladimir Putin’s regime for preventing “genocides of ethnic Russians”.
He began talking to Wagner operatives using an account called “Privet Bot” and soon conjured up a plan to set fire to units at Cromwell Industrial Estate in Leyton, east London – destroying around £100,000 worth of humanitarian aid destined for Ukraine.
A group of young British men have been found guilty of working for state-backed Russian mercenaries to start a fire at an industrial estate in Leyton, east London, in March 2024 (Photo: LFB)
Earl recruited a number of other Brits for the operation, including Jake Reeves, who pleaded guilty to taking money from the Wagner Group, and Ashton Evans who was found guilty of knowing about terrorist acts but failing to disclose the information.
Commander Dominic Murphy, head of the Met’s counterterrorism command, said the case was a “clear example” of a Kremlin-linked group using proxies to carry out criminal activity on their behalf. He said Earl and Reeves had “willingly acted as hostile agents” for Russia.
By exploiting social media platforms such as Telegram, Russian operatives are able to recruit low-level criminals from diaspora groups, paying them in cryptocurrency to carry out everything from photographing military shipments to setting fires.
Ken McCallum, the director-general of MI5, warned last year that Russia is on a “sustained mission” to sow mayhem across Britain and Europe. Addressing journalists, he described Russian intelligence operatives orchestrating “arson, sabotage, and more dangerous acts carried out with increasing recklessness” since the UK threw its weight behind Ukraine.
Since that warning, multiple individuals have been arrested in connection with sabotage attacks on the UK – none of them Russian nationals, but all suspected of acting on Moscow’s behalf.
A Russian intelligence unit, once part of the notorious Wagner Group, sits at the heart of this recruitment drive. Operatives working under the guise of Telegram accounts start by offering easy tasks – such as taking pictures of buildings for quick cash – and gradually escalate their demands to include surveillance of weapons shipments or sabotage of supply lines.
Many of those recruited remain unaware of who they are working for, believing they are completing menial tasks. Payments are made online in cryptocurrency, leaving little trace.
Unlike traditional spies, these disposable recruits can be quickly replaced. And if caught, the Kremlin can spin their arrest as a Western overreach, or worse, as evidence of humiliating internal instability.
The chair of the Joint Committee on National Security Strategy has been raking over details of the UK’s approach to hybrid attacks for months. Labour MP Matt Western says the UK needs to wake up to how “critical” this issue is.
He said: “It is easier to have these people do these things than to have a standing military do it.
“The variety and nature of these incidents is becoming greater and they are, as one intelligence officer put it, just testing the waters. I think they are also testing our mettle.
“We need a whole of government approach to this, to work across all departments and we need to take these security issues extremely importantly.”
Security minister Dan Jarvis told The i Paper that “those acting on Russia’s behalf” would face the “full force of the law”.
He said: “Another proxy group acting for Russia has been brought to justice, thanks to the work of our criminal justice system.
“National security is the foundation of our Plan for Change, and these convictions should serve as a clear warning to those seeking to undermine our national security or the safety of the UK.”
theipaper on July 13rd, 2025 at 07:36 UTC »
A Nato unit dedicated to combating the growing threat from Russia’s hybrid warfare is working with British security services to investigate a string of suspected sabotage attacks on UK soil, The i Paper can reveal.
While the alliance traditionally focuses on conventional military threats, a taskforce is currently drawing up a list of suspected Russian hybrid attacks in Europe, according to a Nato official and a UK intelligence source. These threats include arson, cyber hacks and sabotage of critical undersea communication cables.
Russia has increased these “grey zone” assaults against Nato members following its full-scale invasion of Ukraine.
On Tuesday, three men from south London were found guilty of being part of a plot by Russian mercenary outfit, the Wagner Group, to recruit young Brits and carry out an arson attack at an east London business delivering aid to Ukraine.
A Nato official told The i Paper: “Their [Russia’s] goal is to destabilise opponents, cause panic and fear among the general public and weaken authority and trust with governments.