Sergei Beseda’s retirement was a low-key affair. After decades of service to Russia’s intelligence apparatus, his was a career that ended in catastrophe.
As head of the FSB’s Fifth Service, responsible for operations within the former Soviet Union, the veteran spymaster who stood down last week received much of the blame for the failure to adequately prepare the ground before the invasion of Ukraine in February 2022.
There were those in the West who sought to draw from this episode the idea that Russian intelligence was a paper tiger that for too long had basked in the fearsome reputation of its Soviet and Tsarist forebears.
As the two years since have shown, however, they were wrong. From that moment of crisis, Russia’s security services have regrouped and responded with a renewed confidence.
Once beset by infighting, the three security agencies — the FSB, the GRU and the SVR — are now working with each other more than at any time since the Second World War, analysts say. And as those such as Beseda are being shown the door, a younger generation of ambitious spymasters is ascending the ranks.
Advertisement
Whether it be daylight assassinations or attempted coups, both the scale and the scope of Russia’s covert operations abroad have now reached a level not seen since the height of the Cold War. Nearly every week a new covert operation bearing Russian fingerprints is uncovered.
“And those are just the ones we know about,” said Oleksandr Danylyuk, a former special adviser to the head of Ukraine’s foreign intelligence service. “Those operations that come to light are just a tiny fraction of the total number. It’s not necessarily that they are operating in a different way but the scale has grown hugely.”
As both a corollary and a testament to that, recruitment among the security service is known to have gone into overdrive, said Danylyuk, an associate fellow of the Royal United Services Institute, adding that there was a heavy focus on students, both at home and abroad in countries sympathetic to Russia, such as Serbia.
According to Ukrainian sources, the GRU, Russia’s military intelligence service, has significantly expanded its special operations branch, known as Unit 29155, since the beginning of the full-scale invasion. It is estimated that the unit has grown from about 500 officers in 2022 to as many as 2,000 today.
Specialising in state-sponsored murder and political destabilisation, Unit 29155 officers have been implicated in Russia’s most brazen overseas operations of the past decade, including the poisoning of Sergei and Yulia Skripal in Salisbury and an attempted pro-Serbian coup in Montenegro.
Advertisement
Indicative of the regard with which the unit’s activities are held, was the recent promotion of its enterprising former leader Andrei Averyanov, to the role of deputy head of the GRU, responsible for co-ordinating all unconventional warfare operations across Europe.
• Russian spies pose as diplomats to attack Europe, says Nato
The use of cover operations runs deep in the bloodstream of Russian foreign policy, going back to the time of the nascent Bolshevik government which quickly embarked upon a campaign of political agitation across Europe as a means of exporting the revolution, with uprisings orchestrated in Estonia, Romania and Germany throughout the 1920s.
In the years since, Russian leaders have cleaved to a doctrinal belief that unconventional warfare is a necessary condition for the advancement of the country’s standing in the world.
Since the invasion of Ukraine, however, that task has become more and more difficult following the expulsion of up to 600 Russian intelligence officers masquerading under diplomatic cover in European capitals.
Advertisement
Rebuilding the network at speed is believed to have required Moscow to rely increasingly on foreign nationals and in particular those within the criminal underworld.
According to Andrei Soldatov, an expert on the intelligence service, Bulgarians and Serbians have proved to be some of the most willing conspirators. “Russia has a natural advantage across eastern Europe when it comes to recruitment of foreigners because of their longstanding ties with those countries,” he said.
“But they are recruiting on an unprecedented level in Bulgaria and Serbia, both because of the fact that there are strong organised crime groups in those countries and due to a high level of political support for Russia there.”
Sabotage on Nato’s eastern flank
There are a series of mysterious fires in buildings across Poland. Someone attempts to bludgeon the exiled Russian opposition activist Leonid Volkov with a hammer outside his home in Lithuania. There is only one obvious thing that connects these apparently disparate incidents: an increasingly uninhibited campaign to sow uncertainty and disorder along Nato’s eastern flank.
The Kremlin’s “active measures” against central and northern Europe over the past few months are so broad in scope that it is sometimes difficult to discern an underlying strategy: the removal of buoys marking the Russian-Estonian border in the River Narva; hundreds of attempted acts of sabotage against transport infrastructure; a hastily withdrawn suggestion from the Russian defence ministry that it might unilaterally revise the country’s maritime frontiers in the Baltic sea.
Advertisement
Since December Russia has also been jamming GPS signals across the southern Baltic, disrupting an RAF plane carrying Grant Shapps, the British defence secretary, and forcing Finland’s national airline to suspend flights to a city in Estonia.
Three clear patterns have emerged from the chaos. The first is a pronounced rise in volume across the spectrum, from espionage and electromagnetic interference to petty vandalism. Second, since most of the Russian intelligence officers previously operating under diplomatic cover have been expelled, the agencies have often resorted to getting local proxies to do their dirty work.
“There does appear to be this spike in what is going on and what is being planned after what may have been a period when Russia was fully absorbed with Ukraine,” says Keir Giles, an author and Russia scholar at the Chatham House think tank in London.
The practice of hiring bored, disgruntled or cash-strapped Europeans to carry out the disruption has allowed Moscow to pursue its aims on an industrial scale without exposing its own spies to the risk of detection. “That means in effect there’s no downside,” Giles says . “There’s no reason for them not to do this, because they’re not going to suffer any reputational damage over what they already have and they don’t care if their proxies get rounded up in prison, because it’s no skin off their nose.”
The third and last noticeable change is the military dimension to many of the incidents, whether they involve prying around bases or testing the security around the railways that would be used to carry Nato troops and their equipment to the front line if Russia were to mount a direct attack on the alliance.
Advertisement
Giles argues that Russia is casting around for weaknesses that it could exploit in a future war. “All of this is probing the resilience of European logistics, particularly in Germany and Poland,” he says. “It is looking at the vulnerabilities of the systems that would take Nato reinforcements eastwards in the event of a conflict, because, of course, those are going to be prime targets for Russia to interdict or destroy.”
• For Putin, terror is an absolute necessity
While there have been numerous incidents in Germany, including a suspected arson attack on a factory in Berlin and cyberattacks on the two largest political parties, Poland is the most striking example. The country is not only a nexus of motorways and railways leading to the eastern flank but also the chief conduit for supplies of western military aid to Ukraine.
Despite the deeply ingrained suspicion of Russia that prevails across the Polish population, Moscow’s intelligence agencies appear to have persuaded dozens of people to carry out odd jobs on its behalf. Last month at least nine individuals, including Polish, Ukrainian and Belarusian citizens, were charged with conducting acts of sabotage for Russia.
A few weeks earlier another Pole, identified only as Pawel K, was arrested on suspicion of reconnoitring Rzeszow-Jasionka airport, an arms and logistics hub near the Ukrainian border, with the alleged aim of gathering intelligence for a possible assassination attempt against President Zelensky as he passed through.
Two Polish citizens with alleged links to football hooliganism were also detained in connection with the hammer attack on Volkov, an associate of the late Russian opposition leader Alexei Navalny, in neighbouring Lithuania.
The French Connection: Macron under siege
On a muggy Saturday morning in Paris this month, the sight of three men in scruffy tracksuits — a Bulgarian, a Ukrainian and a German — placing five wooden coffins beneath the Eiffel Tower quickly drew puzzled glances. The coffins were draped with tricolor flags, with a placard on top carrying the words: “French soldier of Ukraine.”
A police bomb squad later found the coffins contained nothing more than plaster and, six hours after they left, the men, plus a van driver, were arrested, claiming they were paid €400 each by an anonymous person for the job. For the Kremlin, the reward may have been much greater: to stir alarm over President Macron’s suggestion that Nato troops could be deployed in Ukraine.
The incident was merely the latest act in an intense hybrid offensive to destabilise France. Evidence linked the coffin stunt — heavily and misleadingly reported by Russian state media — with pro-Palestine graffiti stencilled onto the Paris Holocaust memorial in March and stars of David daubed on city buildings last October, police said. Moldovans working for Moscow are alleged to have been responsible.
These acts are a tiny part of a campaign to undermine the government, stir divisions over immigration and religion, sow confusion and boost the Kremlin-friendly hard right National Rally of Marine Le Pen, the government says. No issue is too insignificant. Last summer’s panic over a supposed bedbug plague in France was partly the result of a Russian disinformation drive, the French government said.
• Exposed: hard-right European politicians ‘on Putin’s payroll’
The Russian offensive opened in 2017 when hackers tried to sabotage Macron’s election by dumping pirated campaign emails, mixed with malicious counterfeits, on the eve of the vote. It has accelerated over the past two years with cyberattacks on ministries and state communications networks and has turned into what officials at the DGSI internal security service called all-out war before this month’s European parliament elections and the coming Paris Olympics.
In February, the security service and Viginum, a state agency that monitors and combats foreign digital interference, warned ministries that Moscow was staging mass cyber assaults and deluging France with fake news through spoof French media and social media “to amplify dissent and internal divisions in French society on all subjects”.
In March a large-scale cyberattack hit the state’s inter-ministerial network. Responsibility for these so-called distributed denial-of-service (DDoS) attacks was claimed by a group of hackers supposedly from Sudan who used Russian and Arabic for their communications. The following week, Macron said: “The Kremlin regime has intensified and hardened its assault on our country with disinformation and cyberattacks.”
David Colon, a propaganda expert at the Paris Sciences Po university, said France is at the heart of a “total war” waged by Putin against democracies. “We are facing the most serious threat that has ever confronted our country,” he told Public Sénat, the parliamentary television channel. Multiple assaults are being carried out through cyberattacks and “submersion of our information environment by content aimed at influencing votes,” he added.
The prospect of Le Pen’s populist Rally gaining government power in snap parliamentary elections starting on June 30 is a windfall for Moscow that must be seen there — at least partly — as the fruit of its covert support, French diplomats say. The Kremlin has only said that Putin is closely watching the election.
Dmitri Medvedev, the former president, has been clearer, calling for “open or secret Russian support” for Le Pen and Europe’s other “anti-system” populists.
Putin’s EU spies hide in plain sight
In the heart of Brussels next to the American embassy, just a couple of hundred yards from Belgium’s equivalent of 10 Downing Street, is the leafy and grand Boulevard du Régent, 31-33.
It is home to the Permanent Mission of the Russian Federation to the European Union. It is also said to be one of Russia’s main spy centres.
The Mission, which is now largely a defunct enterprise after the diplomatic deep freeze that followed Putin’s invasion of Ukraine in 2022, is where Kirill Logvinov, 49 , the “chargé d’affaires”, is still keeping busy.
Belgium’s State Security Service has, according to many sources, identified Logvinov as a spy, a senior intelligence officer of the Russian SVR, or Sluzhba vneshney razvedki, the foreign intelligence service once known as the KGB, operating under what is described as a fig leaf of diplomacy.
“Logvinov is part of an active foreign intelligence corps of the Russian Federation. I certainly have no doubt that this confirmed information is correct,” said Petras Austrevicus, a veteran Lithuanian diplomat and member of the European Parliament’s foreign affairs committee, who accuses the Russian of “malign interference”.
The Belgians, who wanted to expel Logvinov along with 19 others in May 2022, are helpless because only the European Commission and the EU diplomatic External Action Service have the power to take the decision.
After the expulsion of 600 Russian diplomats in 2022, Logvinov’s role, according to sources, is now of major importance, with significant financial resources to recruit agents who have connections through Russia’s diaspora.
Just a 20-minute drive away in his diplomatic limousine, the roof of the Russian embassy in the Brussels suburb of Uccle bristles with satellite communication equipment — more than any other such building in Europe, as the Belgian capital hosts Nato as well as the EU.
The reluctance on the European side comes from the fear that Russia would respond by closing down the EU’s mission in Moscow or by expelling diplomats.
EU fear of Russia feeds into another problem. Both Nato and the Czech Republic, Denmark, Estonia, Latvia, Lithuania, the Netherlands, Poland and Romania have urged the EU to agree to impose travel restrictions on diplomats such as Logvinov.
In a letter, the countries warned that EU diplomatic passports, accredited in one host state, allow Russians, such as Logvinov, to travel across the whole border-free Schengen area “easing malign activities”.
“Intelligence, propaganda or even preparation of sabotage acts are the main workload for a large number of Russian ‘diplomats’ in the EU,” the countries warned. “This measure will significantly narrow operational space for Russian agents.”
The call comes after arrests following shared Nato intelligence and Russian attacks in Britain, Germany, Poland, the Baltic states and the Czech Republic but the EU is dragging its feet, with resistance led by Germany and Austria.
The concerns, echoed by the EU diplomatic service in Brussels, is that Russia would respond by restricting the movement of European diplomats, as has already been done to British and American embassy staff.
The other fear is that Russia would close the EU’s presence in Moscow. “We have absolutely the lowest possible level of diplomatic relations with the Russian Federation,” said Austrevicus.
“In practice Russia has undertaken a hybrid war against the EU and there is a kind of silent denial, at least from some member states. Our response is weak and even dangerous since each and every sign of weakness invites the Russian side to march forward.”
Very deep cover in the North Sea
The Kapitan Sokolov is the pride of a new fleet of Russian steel-hulled trawlers, able to hold a catch of 1,500 tonnes and 80 crew members, commissioned to chug its way to fishing grounds in the North Sea and beyond.
For the first five months of this year, however, the Sokolov, as well as four other Russian trawlers, including one called the Taurus, started to behave unusually. When they were above key electricity and telecoms cables on the sea bed, as well as oil and gas pipelines in the waters of Britain, Belgium, Denmark, Germany, Netherlands and Norway, they slowed down.
They are believed to have done so as part of the Kremlin’s surveillance and sabotage operations in European waters after the invasion of Ukraine. Putin’s espionage has now reached to the bed of Europe’s seas as both oceanographic research vessels and fishing boats are tasked with mapping, or even perhaps placing explosives on, a vital network of cables and pipelines.
The prime target, especially since Russia’s invasion of Ukraine in 2022 has been the electricity and telecoms cables as well as oil and gas pipelines. “Today espionage is more difficult to detect. Where in the past research vessels or military ships were mainly used, we now see non-military ships more often,” said Thomas De Spiegelaere, of Belgium’s Maritime Security Unit.
Nato officials have expressed “strong suspicions” that Russia has already mined critical undersea infrastructure based on intelligence from the companies that run key oil and gas rigs, pipelines, electricity connectors and telecoms cables.
According to Belgian security services, no evidence has been found of the mining North Sea cables in the waters of Belgium or the Netherlands. But evidence of sabotage against the UK, apparently still classified in Britain, was found. “No sabotage has yet been established on Dutch or Belgian cables, but explosives were found on a British cable at the beginning of the Ukraine crisis,” said De Spiegelaere.
Research using maritime logs by the Belgian newspaper De Tijd has shown that over 160 non-military Russian ships have carried out 945 suspicious actions over the past ten years. No fewer than 749 of the 945 suspicious manoeuvres took place within a radius of one kilometre of pipelines in the North Sea.
• Who really blew up Nord Stream pipelines? The 4 key theories
Another 72 suspicious actions took place around power cables and the remaining 124 around telecom cables in what is thought to be a huge mapping operation. Russian knowledge of where cables and pipelines are exposed is crucial if they want to sabotage energy connections or tap into or manipulate communication cables.
“Russian ships are already suspicious, even if they maintain a very normal sailing pattern. Because every Russian ship, even if it works for a private company, works for the government anyway,” said De Spiegelaere. “Abnormal sailing patterns are not necessarily suspicious. But it is suspicious if this happens above pipelines and cables.”
• Britain, France and Norway search for Russian sub off Ireland
Russians need boats to carry out the espionage missions because satellite imaging does not reach the seabed. Protecting “critical undersea infrastructure” has become a major focus of Nato and European coastal countries after the destruction by sabotage of the Nord Stream gas pipeline in autumn 2022.
“We never thought that these pipes and cables could be sabotaged. We have been more attentive to that,” said De Spiegelaere.
The bad boys of the Balkans
Held under house arrest near Milan on a US extradition warrant after allegedly shipping American military technology to Moscow, Artem Uss snapped his electronic monitoring bracelet in March last year, fled before police arrived and was smuggled back to Russia, reportedly by a team of Serbians.
As an illustration of the brazenness of Russian spies in Italy, the springing of Uss from house arrest last year takes some beating. “The use of a criminal gang from the Balkans made this a typical Russian operation and shows how strong Russian penetration is in Italy — something people don’t pay attention to,” said a source close to the intelligence community.
The Russian Salisbury poisoners flew through Rome’s Fiumicino airport and Milan’s Linate airport,” showing Italy is used as a transit country,” he added.
Last September Giorgia Meloni, the Italian prime minister, was fooled by a prank call from two Russian comedians posing as African diplomats. “Assuming they had help, how did they know when she would be available to speak?” said the source, who declined to be named. There have been counter-espionage successes, notably the arrest in 2021 of Italian navy official Walter Biot, who was caught in a Rome car park handing over secret documents to two Russian diplomats in return for cash.
Italy said the arrest was the result of a long surveillance operation by police and Italy’s intelligence service, but the source argued Biot’s recruitment was also the result of patient Russian spycraft. “To get to Biot they will have checked out dozens of possible recruits,” he said. Moscow is also keeping up a regular drumbeat of disinformation about the Ukraine war, spread through social media and preying on a widespread opposition in Italy to supporting Kyiv in its bid to oust Russia.
The uncertainty among many Italians about standing up to Moscow derives from a longstanding suspicion of Nato and the strength of the Communist Party in Italy during the Cold War, said Mattia Caniglia, the associate director at the Atlantic Council’s Digital Forensic Research Lab.
“Italians are seeing fake quotes online telling them not to support the war, which are attributed to Italian actors Roberto Benigni and Sophia Loren, while a copy of the site of Italian daily La Repubblica was created including an article on how Putin was standing up to twisted western ideology,” said Caniglia.
Such fakery was part of a Russian disinformation campaign in Europe dubbed Doppleganger by EU officials. “In May alone 275 covert, sponsored posts about Ukraine reached three million people in France, Germany and Italy,” said Caniglia.
Moscow was also amplifying real statements by Italian politicians like Matteo Salvini, the leader of the hard right League, which has pumped out posts accusing the EU of being a warmonger which wants to focus on gay rights while forcing Europeans to eat insects. “This provides a great opportunity for Russia and they are very good at exploiting it,” Caniglia said.
A defector’s body riddled with bullets
Maxim Kuzminov’s body was found by a caretaker riddled with half a dozen bullets in an underground garage of a housing complex near Benidorm.
The summer before he was found dead in Spain, Kuzminov had deserted the Russian military by flying to Ukraine with his Mi-8 helicopter.
He was subsequently sentenced to death for “treason” after the relatives of his two crew members who were killed after landing in Ukraine demanded that he pay with his life for his actions. The crew, killed while attempting to flee, were posthumously decorated by Russian authorities.
Yet in Spain, detractors of the government of Pedro Sánchez, the prime minister, criticised it for a failure to condemn Russia over the death as evidence that Madrid has a Putin problem. This has been further heightened by alleged secret links between Catalan separatists, who helped Sánchez retain power, and Moscow.
King Felipe VI’s recent visit to the Baltic states, for example, was aimed at reassuring the region of his country’s support in the face of the Russian threat. However, the failure to send a minister with him overshadowed the diplomatic mission.
On the eve of Felipe’s visit, a Spanish judge opened an investigation to determine if Moscow’s links with Catalan separatists such as Carles Puigdemont, an exiled fugitive from Spanish justice and ally of Sánchez, constitute treason.
The government views such judicial moves as attempts to thwart Sánchez’s granting of a highly controversial amnesty for Puigdemont and others involved in a failed 2017 secession bid. But Russia’s alleged activities in Spain and the government’s lack of action over them have raised eyebrows outside the country.
“Russian interference in Spanish territory is an uncomfortable issue for the government,” said Manuel Torres, a political analyst for the Elcano Royal Institute in Madrid. “Although the security apparatus attaches great importance to it, the political level prefers to keep a very low profile in order to avoid conflicts with its political partners.”
Advisers close to Puigdemont held discussions with Moscow about possible Russian help with Catalan separatist efforts to break away from Spain, according to a European intelligence report quoted by the New York Times in 2021. It did not conclude what help, if any, the Kremlin provided. However, according to the newspaper, which said it had seen the report but did not disclose which country had produced it, the Russian officials whom a Puigdemont aide met were involved in Moscow’s operations to destabilise the West.
The visits took place two years after the Catalan regional government, then led by Puigdemont, failed in its bid for independence, when it held an illegal referendum on seceding from Spain. The aide and Puigdemont confirmed the trips to Moscow but said they were for routine meetings with foreign officials and journalists.
El Pais, a left-wing newspaper close to Sánchez, has urged the government to “respond forcefully to Moscow” over Kuzminov’s death. No official reaction has been made public, however, apart from a statement saying the assassination was under investigation.
Reporting by Tom Ball, Charles Bremner, Oliver Moody, Bruno Waterfield, Tom Kington and Isambard Wilkinson
