In Hungary, the Russian hybrid-warfare operation that destroyed Poland’s largest shopping center barely received any attention, yet it was far from an isolated case: over the past year and a half, more than 500 (!) similar incidents have occurred across Europe.
At around 3:30 a.m. on May 12, 2024, Poland’s largest shopping complex caught fire and was almost completely destroyed. Behind the tragedy stood Russia’s expendable agents.
Russian intelligence set fire to and destroyed Warsaw’s largest shopping center, Marywilska 44, last year. Polish authorities officially confirmed this last week after a year-long investigation. No one was injured, as the fire broke out overnight, but 90% of the premises was destroyed.
Several perpetrators have already been detained, while others—identified but still at large—are actively being pursued.
As for the details: the fire in the early morning hours of May 12, 2024, consumed the goods of more than 800 vendors, and an additional 2,000 people lost their jobs. Since then, the Polish National Prosecutor’s Office, together with the Warsaw police and the internal security agency, has carried out an extensive investigation to clarify all circumstances of the incident.
From the start, there were suspicions that Russian services were behind the arson. On the eve of the first anniversary of the fire, Prime Minister Donald Tusk officially confirmed this. “We now know for certain that the great fire on Marywilska Street was the result of arson committed by Russian services. The operation was coordinated by a person residing in Russia,” the Prime Minister wrote on X.
On Monday, May 12—the exact anniversary—investigators revealed even more than Tusk’s message. They determined that the fire at the Marywilska 44 market hall was an act of arson carried out by members of an organized criminal group acting on behalf of the intelligence services of the Russian Federation. “The goal of the group’s activities was to carry out arson attacks on large facilities in EU countries,” the Prosecutor’s Office spokesperson said.
A Continental Pattern
The arson is part of a broader, intensifying pattern of Russian hybrid warfare aimed at undermining European security through espionage, sabotage, and targeted attacks—while so far avoiding direct military confrontation or triggering a NATO response.
Across the continent, an increasing number of fires and attacks targeting symbolic or strategic infrastructure have been linked to saboteurs acting on behalf of Russia. European intelligence agencies reported more than 500 such incidents between 2024 and early this year, at least 100 of which have been directly attributed to Russian agents or proxies.
Notably, in the same month as the Marywilska fire, Russian operatives were behind arson at a Berlin metal-processing plant belonging to Diehl, one of the key defense companies supplying weapons and ammunition to Ukraine.
Ambiguity of Accountability
These operations are characterized by plausible deniability: actions coordinated remotely, Russian officers remaining safely inside Russia, while their operational reach in Europe is extended through intermediaries.
Unlike the highly trained intelligence officers of the Cold War, today’s contract saboteurs are ordinary civilians—often unaware that they are working for the Russian Federation.
Who Are the Saboteurs?
These so-called “disposable agents” are recruited through encrypted platforms such as Telegram and paid to carry out arson, vandalism, or unrest. In a recent arson case in Poland, one agent received only a four-digit fee for the job.
Because the perpetrators are contacted anonymously, Russia can carry out covert operations across the continent with minimal traceability. Even when attackers are detained, establishing a clear link to Russia is often extremely difficult—or impossible.
Uncertainty Around Retaliation
These attacks remain below the threshold of open conflict and have not triggered measures under NATO’s Article 5, which obliges all member states to defend any ally subjected to armed attack.
Instead, Europe’s response has so far been largely diplomatic. In May 2024, Poland restricted the movements of Russian diplomats and closed a second Russian consulate, citing national security threats. But cutting diplomatic channels is symbolic, reactive, and uneven across countries. More forceful retaliation, however, risks military escalation or a broader conflict.
In the new era of hybrid conflict, fire and sabotage have become tools of geopolitical signaling, intended to test and undermine NATO’s principles of solidarity—blurring the line between war and peace not only in Ukraine but across all of Europe.
How NATO responds to these patterns will be a defining moment for alliance cohesion, requiring more coordinated counter-operations, potential adjustments to NATO doctrine, improved identification tools, and—above all—greater political will from member states.
This article was produced with the financial support of the European Union. The views and statements expressed herein reflect the position of the author(s) and do not necessarily represent the official stance of the European Union or the European Education and Culture Executive Agency (EACEA). Neither the European Union nor EACEA can be held responsible for them.
