Russia's Wagner Group, the notorious private military company once deployed across African battlefields, has pivoted to conducting sabotage and destabilization operations inside Europe, according to Western intelligence officials who detailed the shift in interviews with the Financial Times.
The paramilitary organization, now operating under tighter Kremlin control following the death of founder Yevgeny Prigozhin in a 2023 plane crash, has been linked to a series of suspicious incidents across the continent—including arson attacks, infrastructure sabotage, and assassination plots targeting individuals critical of Moscow.
"Wagner has fundamentally changed its mission set," said a senior NATO intelligence official, speaking on condition of anonymity. "They've moved from overt military operations in the Sahel to covert destabilization in Europe. This is hybrid warfare at its most dangerous."
To understand today's headlines, we must look at yesterday's decisions. Wagner Group emerged in 2014 as a deniable instrument of Russian foreign policy, deploying to Syria, Libya, the Central African Republic, and Mali to protect Russian interests while providing Moscow with plausible deniability. At its peak, the group fielded an estimated 50,000 fighters and generated billions of dollars through mining concessions and security contracts.
Prigozhin's attempted mutiny in June 2023—in which Wagner forces briefly seized Rostov-on-Don and marched toward Moscow—exposed the organization's autonomy and threat to Kremlin authority. His subsequent death in a plane explosion widely attributed to Russian intelligence services marked the end of Wagner's independence.
Since then, Wagner's remaining units have been absorbed into Russia's formal military structures and intelligence services, particularly the GRU (military intelligence). However, the organization's networks, expertise, and brand have been repurposed for operations closer to home.
Western officials documented a pattern of suspicious incidents beginning in late 2024. In Germany, arson attacks targeted logistics facilities used to ship military equipment to Ukraine. In Poland, attempts were made to sabotage rail lines critical for NATO reinforcement. In the Czech Republic, a Wagner-linked operative was arrested in connection with an assassination plot against a defence industry executive.
British intelligence assessed that Wagner operatives or their proxies were responsible for at least a dozen incidents across six European countries in 2025, though definitive attribution remains difficult given the clandestine nature of the operations.
The Financial Times reported that Wagner has recruited from refugee populations, criminal networks, and far-right extremist groups to carry out operations that obscure Russian involvement. Payments are made through cryptocurrency and informal channels, further complicating efforts to trace responsibility to Moscow.
"This is classic GRU methodology wrapped in Wagner branding," explained Mark Galeotti, an expert on Russian security services at University College London. "The name still carries weight, it frightens people, and it provides another layer of deniability for the Kremlin."
European security services have struggled to counter the threat. Unlike conventional terrorism, which typically involves radicalized individuals drawn to extremist ideologies, Wagner-linked operations are professional, disciplined, and carefully targeted to maximize political impact without mass casualties that might galvanize public opinion.
The sabotage campaign appears designed to signal to European populations that support for Ukraine carries costs—not through direct military confrontation, which Russia wishes to avoid, but through low-intensity disruption that gradually erodes public patience and political will.
Several EU member states have increased counter-intelligence resources and surveillance of suspected Russian operatives. Germany expelled dozens of Russian diplomats suspected of coordinating sabotage operations. Poland has detained multiple individuals allegedly linked to Russian intelligence.
However, the difficulty of attribution and the use of third-party cutouts means that legal prosecution remains challenging. Many suspects have been released for lack of evidence linking them definitively to Russian state direction.
The Kremlin dismissed the Financial Times report as "Western propaganda." Spokesperson Dmitry Peskov said Russia has "no connection to any illegal activities in Europe" and suggested that incidents were being "falsely attributed to discredit Russia."
The shift to European operations marks a new chapter in Wagner's evolution. Once a blunt instrument for projecting Russian power in lawless regions, it has become a scalpel for undermining Western unity from within. The challenge for European security services is to counter an adversary that operates in the shadows, with limitless resources, and under the protection of a nuclear-armed state.
As one senior European intelligence official put it: "Wagner in Africa was a problem. Wagner in Europe is an existential threat to our security architecture."


