/nginx/o/2024/07/02/16195982t1h5b8f.jpg)
The Latvian Defense Intelligence and Security Service (MIDD) provided guidance on identifying potential Russian spies and saboteurs.
In its annual report, the Latvian Defense Intelligence and Security Service (MIDD) outlines that the tasks of espionage and sabotage groups include surveillance of critical infrastructure and military facilities, military units, and other law enforcement agencies; execution of subversive activities; elimination of socially significant individuals; studying societal conditions in the target country; and inciting unrest against the existing government, according to Latvia's national broadcaster LSM.
The potential appearance of Russian agents is described as follows: "Paramilitary, sports, or tourist clothing combined with special equipment elements (backpacks, harnesses, specialized medical bags), uniform clothing elements, short hairstyles, sloppy or untidy appearance, insufficient hygiene, athletic build; possession of documents from an aggressive state (possibly multiple passports) or foreign currency," explained the MIDD.
Agents often carry food and gear indicating preparedness for survival or special needs in unusual conditions, such as radio equipment, maps, navigation devices, special tools, and possibly weapons.
/nginx/o/2025/05/15/16846639t1h6798.jpg)
Thirdly, their accommodation arrangements may be unusual. "Groups stay in remote areas, near forests and bodies of water, even though their clothing and gear do not suggest leisure activities; accommodation in abandoned buildings, forest clearings (hidden overnight spots), or with solitary or socially marginalized individuals," noted the MIDD.
Also, their behavior in public places can be notable. "Poor or no orientation skills in local areas; moving in military patterns and observing/studying the surroundings; asking locals about their political views or inciting unrest; only one group member speaks the target country's language; unfamiliarity with local dialects (accents, expressions); purchasing large quantities of non-perishable food and goods; potential impersonation of representatives from humanitarian organizations such as the UN, Red Cross, OSCE, or others," clarified Latvian intelligence.
Fifth, they may also be caught performing specific out-of-the-pattern tasks. They show significant interest in critical infrastructure facilities, law enforcement institutions, and military forces—conducting surveillance, questioning locals, and attempting to enter restricted areas.
Nevertheless, it is highlighted in the report that Ukraine's experience demonstrates the Russian special services' adaptability to their environment, and their members might ultimately not visually match the classic profile of espionage and sabotage operatives.
Most Russian sabotage attacks in Europe have been carried out by local individuals hired mainly via Telegram social platform for modest sums of money.
In February 2024, two individuals attempted to set fire to the Museum of the Occupation in Riga, a symbol of Latvia's history under Soviet rule. The perpetrators, linked to Russian interests, were later sentenced to prison. Earlier, in August 2023, a Latvian citizen was detained for allegedly spying for Russia by collecting and transmitting information to a group called "Baltic Antifascists. In December 2023 same year, a Russian citizen was arrested in Latvia for gathering intelligence on critical infrastructure and military facilities.
:format(webp)/nginx/o/2024/02/22/15903809t1hc6b7.jpg)
In early 2024, Estonia's Internal Security Service (KAPO) detained 10 individuals suspected of participating in sabotage and intimidation campaigns orchestrated by Russian special services. These operations aimed to spread fear and destabilize the country. Targets included Interior Minister Lauri Läänemets and a journalist, whose car windows were smashed in separate incidents.
In March, the Tartu County Court sentenced 38-year-old Estonian citizen Andrei Makarov to 15 years in prison for repeatedly providing Russian authorities with information about allied military equipment stationed in Estonia since 2022. The court also found that Makarov set fire to a vehicle with Ukrainian license plates in Tartu last February.
Last year Lithuanian authorities thwarted an attempt by a sabotage group to set fire to a shipment of military aid destined for Ukraine. The operation was intercepted before any damage occurred.
On May 9, 2024, a fire broke out at an IKEA warehouse in Vilnius. Lithuanian prosecutors have accused Russian military intelligence (GRU) of orchestrating the arson, describing it as an act of terrorism. Two Ukrainian citizens, one of whom was a minor at the time, were allegedly recruited to carry out the attack. Reports suggest they were promised €10,000 and a BMW as compensation. That is considerably higher bonus than usually offered for acts of sabotage by the Russian intelligence operatives.
Similarly, a recent investigation by the Polish government concluded that the May 2024 arson attack on the Marywilska shopping center was orchestrated by Moscow's intelligence services. According to the Polish investigation, the attackers were also recruited via Telegram.