Over 120 episodes of sabotage in Europe between 2024 and 2026, more than 25 in Italy. Behind fires, railway damage and attacks on logistics depots, the shadow of a hybrid strategy attributable to the Wagner galaxy and the direction of Russian military intelligence.
It is no longer a sum of disconnected episodes, but a plot which, observed as a whole, suggests a precise plan. Between 2024 and the first weeks of 2026, over one hundred and twenty events classified as sabotage or suspected damage against critical infrastructures: arson, tampering with railway lines, attacks on logistics depots and warehouses linked to aid destined for Ukraine. Of these, at least forty directly affected strategic railway networks, with prolonged blockages of freight and passenger traffic and a non-negligible economic impact. Italy figures permanently in this list: more than twenty-five episodes in two years, five of which concentrated on the Rome-Naples and Rome-Florence high-speed routes, with delays that in some cases exceeded three hours and an estimate of indirect costs exceeding fifty million euros between repairs, lost revenue and impacts on related industries. A reconstruction published by the Financial Times fits into this scenario, citing Western intelligence sources according to which former recruiters and propaganda specialists linked to the Wagner Group they would have become one of the main operational hubs behind the new wave of hostile actions attributable to the Kremlin on NATO territory.
Wagner, recruitment and new operational network
After the failed mutiny in June 2023 against Russian military leaders and the subsequent death of founder Yevgeny Prigozhin, many observers had hypothesized a definitive downsizing of the structure. In reality, if the combatant component was partly absorbed or reorganized, the human capital built over the years – networks of contacts, persuasion skills, recruitment and manipulation techniques – would not have dissolved. According to the same sources, it would have been reconverted and integrated into a broader strategy. The men who in the past convinced young people from the peripheral Russian regions to leave for the Ukrainian front would have received a different task: to identify economically fragile individuals in Europe, socially isolated or easily approachable through digital channels, willing to carry out disruptive actions in exchange for relatively low compensation.
Not large military operations, but targeted, limited acts, capable of generating an amplified effect. The target is no longer just the front line, but the heart of European infrastructure. Coordinating this reconversion would be the CRANERussian military intelligence, which – according to a Western official quoted by the British newspaper – is exploiting already available skills, enhancing the network built over the years by Wagner as a pragmatic tool, sometimes rudimentary but effective, to project instability while maintaining a margin of political deniability.
Occasional cells and low intensity warfare
The operational model would be that of occasional cells: executors activated for a single task, sometimes paid in cryptocurrencies, disconnected from each other and quickly replaced. The activities attributed to this galaxy range from setting fires against vehicles attributable to political exponents to damaging warehouses containing supplies for Kiev, up to symbolic provocative operations such as the dissemination of extremist propaganda under false ideological attribution. In several cases, European investigations have highlighted recurring methods: night actions, logistical or infrastructural objectives, absence of a coherent political motive on the part of the perpetrators. A “disposable” system that complicates investigations and blurs the line between common crime and coordinated operation.
The ecosystem built around Wagner, moreover, was not limited to the paramilitary dimension. Prigozhin had also overseen the Internet Research Agency, the St. Petersburg facility known for its campaigns misinformation aimed at Western public opinion well before the large-scale invasion of Ukraine. According to the reconstruction of the London newspaper, social profiles connected to that galaxy would have contributed, at the end of 2023, to the recruitment of British citizens involved in hostile actions.
Italy in the silent front of the hybrid war
From that episode, European security agencies began to outline a wider network of intermediaries and facilitators spread across the continent. The picture that emerges is that of one hybrid warfare low intensity, aiming to wear out rather than hit spectacularly. Sabotaging a railway line means impacting the daily lives of thousands of people, slowing down economic flows, fueling perceptions of insecurity. Every stopped train, every burning warehouse, every accumulated delay becomes a message that goes beyond the material damage. It is a test of vulnerability, a test of the resilience of critical infrastructures.
In Italy, where the railway network represents a strategic and symbolic backbone, the concentration of episodes recorded from 2024 to today indicates that the country is fully inserted in this silent front. The authorities speak of a structural threat, no longer episodic. The challenge is not only to identify individual perpetrators, but to strengthen the protection of a complex system that connects territories, economies and societies.
The war in Ukraine continues on the ground, but part of the conflict has moved elsewhere. It runs along European tracks, passes through warehouses and logistics hubs, insinuates itself into the cracks of social fragilities. The numbers accumulated over two years no longer allow these events to be dismissed as coincidences. Rather, they tell of a strategy of indirect pressure that aims to slowly erode the stability of the continent, transforming civil infrastructures into symbolic targets of a geopolitical competition that is increasingly less confined to the eastern borders of Europe.
