Holy Fronts and Shadow Fleets: How Russia Uses Innocent Cover to Spy Across Europe
Executive Summary
Across Europe, Russia is expanding an intelligence campaign that blends openly visible activity with covert intent. Churches, charity groups, commercial shipping, online recruits, and seemingly ordinary civilians are being used to observe, influence, and test European security systems. These cases show a consistent pattern of exploiting openness and deniability rather than relying on traditional espionage alone.
Intelligence Analysis
Russia’s intelligence activity in Europe has entered a phase defined less by secrecy and more by calculated visibility. Instead of relying primarily on classic undercover officers operating in deep cover, Moscow is increasingly using overt, low-cost, and plausibly deniable methods to gather information, shape perceptions, and probe security responses. The goal is not only intelligence collection, but also normalization of Russian presence, erosion of trust, and constant pressure on European societies.
One of the most striking recent examples unfolded in Sweden, where members linked to a Belarusian religious convent supportive of the Kremlin were allowed to sell handicrafts inside multiple churches. Presenting themselves as harmless nuns, the women raised funds while projecting an image of acceptance inside a NATO country. Swedish church authorities later warned that the convent had ties to Russian military intelligence and supported Russia’s war effort in Ukraine. While there is no evidence the women engaged in classic spying, their presence served a broader purpose: demonstrating that pro-Kremlin actors could operate openly inside Western institutions built on trust.
This episode highlighted a key feature of modern Russian operations. The activity itself was legal and visible. The strategic value came from how it could be framed. Images of pro-Russian religious figures welcomed in Swedish churches support Moscow’s narrative that Western societies are divided, naïve, or quietly sympathetic to Russia despite official policies. The effectiveness of this approach lies in its ambiguity. By the time authorities react, reputational and political damage may already be done.
Sweden’s experience was not isolated. Church officials have also raised concerns about requests from Russian Orthodox institutions to use or build facilities near sensitive infrastructure. In one notable case, a Russian Orthodox church was constructed near a strategically important airport used for contingency operations. Swedish intelligence services later assessed that the location could enable surveillance of air traffic and infrastructure. The project had been approved before Russia’s full-scale invasion of Ukraine, underscoring how long-term these positioning efforts can be.
Germany provides another window into Russia’s evolving approach. In early 2026, German authorities arrested individuals accused of passing sensitive information to Russian intelligence, including details related to military aid for Ukraine and industrial sites. Investigators said some suspects had maintained contact with Russian diplomatic personnel and used personal networks to access information. Other arrests targeted individuals accused of funding or supporting pro-Russian militias.
German officials have repeatedly warned that Russia recruits people online for simple tasks such as photographing facilities, observing logistics, or delivering packages. These tasks require little training, carry low risk for the recruiter, and create distance between the Kremlin and the activity itself. Even when individuals are arrested, attribution remains difficult, and Moscow can deny involvement.
The maritime domain has become one of the most concerning arenas for this activity. Since Western sanctions were imposed on Russian energy exports, Moscow has assembled a large “shadow fleet” of oil tankers operating under foreign flags. Western and Ukrainian intelligence sources report that some of these ships carry Russian personnel with military or security backgrounds, embedded among otherwise non-Russian crews. Intelligence assessments indicate that these individuals are linked to private security firms with ties to Russian intelligence services.
According to intelligence reporting, some of these personnel have been observed photographing European military installations from sea, monitoring coastal activity, and exerting control over ship operations. In at least one case, the movements of a sanctioned tanker closely coincided with unexplained drone sightings near European airports and military bases. While direct causation has not been publicly proven, the repeated timing and location overlaps have raised serious concerns within European security services.
The strategic advantage of using commercial shipping is significant. These vessels move legally through busy waterways, often near critical infrastructure, and provide mobile platforms that are difficult to monitor continuously. Any suspicious activity can be dismissed as coincidental or attributed to civilian shipping operations. This again reflects Russia’s preference for ambiguity over overt confrontation.
Drone activity has become another hallmark of this gray-zone approach. Across Germany and neighboring countries, hundreds of unexplained drone incidents have been reported near military bases, ports, energy facilities, and airports. In many cases, the operators were never identified. Open-source investigations and intelligence leaks suggest that some incidents may be linked to vessels or individuals with Russian connections.
Beyond organized networks, Russia continues to rely on so-called “sleeping” agents and long-term illegals. One widely reported case involved a woman living in Italy under a false identity for years, cultivating social ties with people connected to NATO facilities. Her exposure came not through traditional counterintelligence work, but through a mundane detail: a cat’s microchip number that linked her back to Russia.
What ties these varied incidents together is not a single command structure, but a shared method. Russia appears to be running a distributed campaign designed to achieve several objectives at once. These include gathering tactical information, mapping vulnerabilities, influencing public perception, and conditioning European societies to persistent low-level intrusion. Each individual operation may appear minor or even absurd, but collectively they create a constant background of pressure.
Importantly, many of these activities fall below the threshold that would trigger a strong political or military response. Arrests are handled as criminal cases. Churches issue warnings. Ships are inspected and released. This suits Moscow’s strategy. By staying just inside legal and political boundaries, Russia forces European governments to respond cautiously, often after the fact.
