Russian spy services have built a network of "Trojan horse" properties across Western Europe as infrastructure for coordinated sabotage, intelligence officials from three European agencies told the Telegraph. Covert Russian teams have acquired summer houses, warehouses, churches, and even islands near military and civilian sites across more than a dozen countries. Some of these locations may already contain explosives, drones, weapons, and operatives prepared for deployment during a crisis, officials fear.
Cabins, churches, and islands near military bases
Russia's intelligence services are suspected of acquiring sensitive real estate near military installations across Europe, exploiting weak legal frameworks, the Telegraph reported. Acquisitions include cabins overlooking Norway's Bardufoss air base — with mountain hangars protecting F-35s — and properties near naval bases in Bergen, Crete, Sicily, and mainland Greece, according to The Telegraph sources.
The Russian Orthodox Church bought a prayer house in 2017 overlooking Bergen's Haakonsvern naval base, where officials warned Russians could disrupt signals and control drones. In Sweden's Västerås, a Russian Orthodox church guarded by attack dogs and ringed by fencing and cameras appeared near a strategically important airport in 2023. Swedish intelligence later concluded it could serve as an espionage platform, and the priest overseeing it had received a medal from Russia's SVR agency.
In Finland, a company called Airiston Helmi quietly bought 17 properties near Turku, including Sakkiluoto island. A 2018 commando raid found piers, a helipad, barracks-style buildings with satellite dishes, cameras, and camouflage netting — plus surplus navy landing craft. Russian owner Pavel Melnikov received a suspended fraud sentence.
Since 2022, officials say Moscow has largely abandoned such grandiose projects, instead replicating the model "in miniature but at scale" — turning hundreds, perhaps thousands, of otherwise unremarkable buildings across Europe into listening posts, safe houses, and potential weapons depots, the Telegraph reported.
Past sabotage as "test runs"
Moscow-linked sabotage — arson attacks in London and Warsaw, parcel bombs, assassination plots, and attempted train derailments — has increased sharply since Russia's full-scale invasion of Ukraine. Some intelligence officials fear these are "test runs." The Kremlin may seek to stage deniable attacks on a grander scale to paralyze transport, communications, and energy networks — while complicating any invocation of NATO's Article 5.
"A sabotage campaign is less likely to produce consensus around Article 5 than a conventional Russian military operation," one intelligence officer said. "Deniability makes attribution harder."
MI6's new head Blaise Metreweli warned in December that Britain is "operating in a space between peace and war," with Russia "testing us in the grey zone with tactics just below the threshold of war."
Switzerland, Britain, and Europe's fractured response
Russian operatives reportedly used properties near a Swiss institute that investigated the Salisbury poisonings to intercept Wi-Fi and track weapons experts. In Britain, authorities have also examined suspicious acquisitions near MI6 headquarters and the US embassy. Security experts fear Russia may target properties near the Trident submarine base at Faslane or subsea cable landing points in Shetland.
Finland imposed a near-blanket ban on Russians buying real estate in July, with similar legislation introduced or considered in Latvia, Lithuania, and Estonia. But a proposed EU-wide ban collapsed — Cyprus reportedly objected despite Russian acquisitions near British bases on the island.
German intelligence has warned that Moscow seeks to test NATO's Article 5 defense pact as part of a broader strategy to push the alliance back to 1990s borders.
