Russia has aggressively relaunched its spy war with the west, and Moscow’s publication of a phone call in which senior German air force officers discussed sending cruise missiles to Ukraine is only the latest chilling example.
“The game of cat and mouse has returned,” said one western intelligence officer. “Russian activities . . . are as high or even higher than during the cold war,” said another. “Russian intelligence is a huge machine and is back doing what it always did,” said a third official.
Almost every week, it seems, another covert operation comes to light, showing how far Russia’s intelligence agencies have penetrated Europe since Moscow launched its full-scale invasion of Ukraine two years ago.
On February 27, Tihomir Ivanov Ivanchev became the sixth Bulgarian to be charged with being part of a suspected Russian spy ring in the UK. Two weeks before that, Maksim Kuzminov, a Russian military pilot who defected to Ukraine last year, was found dead in Spain, his body riddled with bullets — including a shot through his heart.
The week before that, France uncovered a network of 193 websites designed to spread misinformation ahead of European elections this year. And two weeks before that, the European parliament opened a probe into whether a Latvian MEP might be an agent for the Russian secret service.
However it was last weekend’s leaked phone conversation between senior German air force officers that was Moscow’s most explosive propaganda coup so far this year in its continued hybrid war against the west.
The Luftwaffe officers, one of whom compromised security by dialling into the WebEx conversation via an unsecure link, discussed how Kyiv might use German-supplied missiles to destroy the Kerch bridge linking mainland Russia to Russian-occupied Crimea. German officials said the leak, and Moscow’s subsequent accusations that Germany was devising “cunning plans” to attack Russia, were a blatant attempt by President Vladimir Putin to divide Ukraine’s allies.
The apparent step-up in Kremlin-led intelligence operations marks a new confidence among Russia’s spymasters after the humiliating setbacks they faced in early 2022, intelligence officials and analysts said. Most of the interviews took place before the German missile talks were leaked.
First, western agencies stole and publicised Moscow’s plans for Ukraine’s invasion. Once Russian tanks started rolling towards Kyiv, European capitals ejected 600 diplomats, some 400 of whom are believed to be spies. Several Russian “illegals” — agents operating without diplomatic cover — were also uncovered. When Russia’s ground invasion stalled, Putin placed top FSB leaders under house arrest for grossly misjudging Ukrainian resistance.
Since then, Russia’s main intelligence services — GRU military intelligence, the FSB Federal Security Service, and the SVR foreign intelligence agency — have regrouped and revamped their spycraft to improve the chances of Russia’s conventional military operations.
The priorities remain the same as before the war: to steal western secrets, widen divisions within Nato and undermine support for Ukraine. But the methods have become more ingenious to compensate for their disrupted espionage networks in Europe and to circumvent restrictions on Russians working in the continent.
“They [Russia’s secret services] really had to change their modus operandi . . . to resort to other tools,” the second intelligence officer said.
One of the Kremlin’s biggest changes seems to be the increased use of “proxy” intelligence actors. Before the war, western agencies mostly dealt with Russian operations carried out by Russian nationals across Europe. Today, that may no longer be the case.
Russian covert operations now use a range of foreign nationals drawn from politics, business and organised crime — such as the Serbian gang that organised last year’s escape of Artem Uss, a Kremlin-linked businessman arrested in Italy under suspicion of selling US military technology to Moscow.
“[Proxies] may not know that they work for the Russians, they could be criminals or other persons who are paid,” the second intelligence officer said.
The Kremlin has also applied pressure on Russian exiles to co-opt them and other opponents of the regime who fled abroad after the war started.
“We know of cases where Moscow has leaned on émigrés’ relatives who stayed in Russia,” said Andrei Soldatov, an expert on Russia’s security services.
For Russia’s spymasters, conducting operations at a distance by using remote working and freshly recruited proxies has its pluses and minuses, according to intelligence analysts and nine officials interviewed for this article.
On the one hand, there is greater scope for deniability. Proxies can also be effective for operations such as stealing trade secrets, setting up sanctions-evading export schemes or penetrating computer networks. A USB stick plugged into a computer by an office cleaner might, for example, deliver intelligence as valuable as that from a human source cultivated for years by an “illegal” handler.
But operational security can also be slapdash, and proxies can be hard to control without an on-the-ground agent to direct them.
To address that, Russia’s GRU military intelligence unit has begun recruiting “cleanskins”, or agents without any military background, to cross undetected into target countries and establish personal contacts, according to a recent report by the Royal United Services Institute think-tank in London.
“The Russians are still doing a lot of remote handling. But they perceive it as unreliable,” said Jack Watling, one of the report’s co-authors. “The aim now is to develop legitimate cover stories, or legends, so that agents can enter target countries.”
To some extent, the old model of “legal” Russian spies working out of embassies still holds in traditionally neutral countries such as Austria and Switzerland.
Security officials from both countries said there were around 150 known Russian agents still operating there under diplomatic cover. Another intelligence official from a different country estimated that nearly a third of Russia’s intelligence operations across the continent were now run from “the safe hubs” of Vienna and Geneva.
In addition, Russian spymasters have strengthened their bases outside the EU’s passport-free Schengen zone. Turkey and the United Arab Emirates in the Middle East have become important staging posts for Russian intelligence operations in Europe, according to the official.
Several expelled Russian agents have also reportedly relocated to Serbia’s capital Belgrade, which maintains good relations with Moscow.
Russia’s new approach was described by Norway’s domestic intelligence service in its recent annual report: “We expect that Russia will try to compensate for the loss of the intelligence officers [by], among other things, sending more visiting agents.”
In other words, Russia could use more “illegals” — such as José Assis Giammaria, a supposed Brazilian academic who took up a post at a Norwegian university in 2021, but was exposed as an alleged Russian undercover officer the following year, and is now awaiting trial.
It is all but impossible to know how effective Russia’s revamped spycraft methods will prove to be. “In the intelligence world, you are always very aware of how much you do not know,” one western spy cautioned.
On the one hand, Putin’s growing authoritarianism has created an “undercurrent of disaffection” in Russia’s security agencies “and a once-in-a-generation recruiting opportunity,” CIA chief William Burns wrote recently in Foreign Affairs.
Sir Richard Moore, the head of MI6, has said similar. “There are many Russians today who are silently appalled,” he said last year. “Our door is always open.”
But at the same time, the expulsions of Russian diplomats may have made counter-intelligence harder, as western agencies previously knew which diplomats were spies, and could track who they met and potentially recruit them.
“You would invite them round to the house, have drinks, introduce the family, make them realise you are a human being, cultivate trust. It was basic,” said an eighth western agent.
Either way, the operational effectiveness of suspected illegals, such as Giammaira or Sergey Cherkasov, an alleged Russian spy exposed by Dutch intelligence in 2022, is often less than imagined.
“They don’t have the capabilities many think they do,” another official said. “Sleepers work alone, don’t have much access to secret information, and have little support.”
Since the Ukraine invasion, western agencies have also stepped up co-operation, building a network of databases and connections to catch Russian operatives.
“There’s much more international collaboration. It’s become a priority. With counter terrorism, you had to ‘dare to share’. But with Russia and the war in Ukraine the need is more obvious,” the eighth official said.
Even so, Russia’s intelligence machine will sometimes succeed spectacularly — as it did in the 2021 SolarWinds cyber attack that hacked the Pentagon, or with the recent German leak.
“The Russians are such klutzes,” the same intelligence officer said. “But,” the official conceded, “they can also do some very sophisticated operations that, in intelligence terms, are stupendously cool.”