Russian sub-threshold attacks on NATO countries are only poised to grow and European railways are especially vulnerable, according to a new report by the Royal United Services Institute.
Russia is likely to target infrastructure, including rail networks, with both physical and cyber attacks. NATO supply chains are also vulnerable at logistics hubs and depots, where cargo is loaded or unloaded, and Russia might try to raise the cost of defending these locations.
Moscow’s goal with these attacks is to increase the cost of supporting Ukraine, highlight the vulnerability of NATO supply chains, fracture Western alliances, and force allies to direct more resources to protect their civilians.
As the name implies, the attacks are designed to slide under the threshold of direct military retaliation. Even so, Russia doesn’t seem to be expecting a direct allied military response, RUSI fellow Emily Ferris found.
“As far as Russia is concerned, as made clear by its officials’ public statements, it is already at war with NATO, which means that it can allocate the finances and personnel required,” Ferris wrote.
“Its non-kinetic operations in Europe have stopped short of open conflict, but... the GRU may have been emboldened to escalate to more serious crimes such as kidnap or assassination.”
According to RUSI, NATO's lessons are to address weaknesses in the rail network and improve network interoperability; recognize Russia's attempts to undermine and sabotage the alliance with probing attacks; and consider alternative mixed systems for supply chains, such as rivers.
Distributed sabotage
Russia’s attacks are scattershot and varied, and don’t necessarily correspond to the level of support any target country gives to Ukraine. The apparent lack of coordination could be both a failure of Russian cells to communicate or a deliberate policy to throw off the scent.
Moscow often employs local assets to do its work, but many actions show the hallmarks of GRU Unit 29155, which specialises in disruptive and cyber operations.
RUSI found that there was a “clear escalation” of attacks suspected of being Russian in origin last year, compared to 2024. An assassination attempt on the CEO of Rheinmetall was one of the most lurid.
In the first half of 2025, Germany and Sweden’s infrastructure was targeted more consistently than other NATO countries’. Finland experienced undersea attacks such as cable interference, while Germany saw attacks on military and transport infrastructure, such as tampering with a water supply by a military base near Cologne Airport.
Energy supplies in Germany, water networks in Denmark and civil aviation (through GPS jamming attempts and attacks on DHL cargo planes) were also key targets of Russia-suspected attacks in 2024 and 2025.
It is difficult to directly attribute many attacks, with some likely the work of other actors.
“It is highly probable that Russia is using these acts… partly as an information-gathering exercise, to determine what the red lines for NATO are in terms of its willingness to attribute attacks to Russia openly and then act on them,” RUSI wrote.
The goal may also be “to embroil NATO partners in legal problems of attribution, and ultimately to prevent consensus among them.”
Undersea cable-cutting
Rail isn’t the only vulnerable target. Allies are also concerned about threats at sea.
The UK and Ireland recently tailed suspicious vessels in their waters, and are paying closer attention to their undersea cables. European navies have been patrolling the Baltic for threats to data and power cables since January 2025, as part of NATO’s Baltic Sentry mission.
Like other sub-threshold warfare, cable sabotage relies on plausible deniability. Allied countries are considering all sorts of measures to scout for possible saboteurs, from crewed ships, to sea drones, to an AI system that can serve as an early warning by analyzing sensor and satellite data, The Arsenal reported in a recent newsletter.
A recent investigation by private intelligence company Dallas found that Russia hopes to develop a strategic global framework, dividing the world into spheres of influence between itself, the US, and China.
Submarines are a big part of this plan. Beyond their role in power projection and nuclear deterrence, submarines are also useful for sabotage.
The Dallas report found that Russia was working on a project dubbed an “actor.” This is a modular vehicle capable of hydroacoustic, hydrological and navigational reconnaissance, with the goal of searching for cables and other infrastructure targets, then providing data for direct strikes.
The vehicle is also meant to carry both aerial and deep sea modules in anonymous cargo containers, while remaining small enough to avoid leaving a thermal signature.
