Russia is trying to rebound from last year’s coordinated mass expulsion of Russian intelligence officers operating under diplomatic guise in Europe.

And there’s now growing evidence that Russia’s foreign intelligence service (SVR) and its military intelligence agency (GRU) are aggressively trying to rebuild their human espionage networks — particularly with an eye toward military aid going to Ukraine.

In what Ken McCallum, the head of Britain’s security service MI5, dubbed the “most significant strategic blow” against Moscow in recent intelligence history, more than 400 so-called undeclared intelligence officers have been drummed out of Europe since the invasion of Ukraine, including from France, Belgium and Germany, dramatically reducing the Kremlin’s reach and ability to spy in Europe.

And on Thursday, Finland’s Security and Intelligence Service (SUPO) said the expulsions of Russian intelligence officers, and visa refusals for their replacements, have substantially weakened Moscow’s intelligence operations in the Nordic region.

“The Russian intelligence station [in Finland] shrank to about half of its former size last year,” SUPO Director Antti Pelttari said. “While Russia is still seeking to station intelligence officers under diplomatic cover, it will have to find ways of compensating for the human intelligence shortfall, such as by increasingly adopting other forms of covert operation abroad,” he added.

And European intelligence agencies aren’t resting on their laurels. They understand that Russia’s spy chiefs are trying to find ways to make up for the huge loss of embassy-based spooks who, among other things, were tasked with “talent spotting” locals for recruitment, running moles and other “human assets,” and logistically assisting “active measure” operations, like the 2018 poisoning of Sergei Skripal and his daughter in the U.K.

In an interview with POLITICO, Darius Jauniškis, director of Lithuania’s State Security Department, said “Russian intelligence services are seeking to restore or create new opportunities for their intelligence activities in Europe,” and they are exploring “other intelligence gathering methods: cyber, non-traditional cover, online operations.”

According to Jauniškis, Europe’s critical infrastructure is a key target for Russian intelligence gathering — the priority being to monitor “the production and supply of Western arms to Ukraine” — and Russia has been on recruitment drives where and when it can. “Lithuanian citizens are approached and recruited while traveling to Russia or Belarus,” he said.

Lithuanian security agencies noted in this year’s annual National Threat Assessment that Belarusian intelligence services had also been targeting the Belarusian diaspora — and even Belarusian opposition organizations — to try and recruit, monitor and disrupt their activities. But Jauniškis said they weren’t alone. “We possess information that Russian intelligence services are interested in Belarusian opposition organizations and their members as well.”

Jauniškis’ remarks came just weeks after Poland announced counterintelligence agents had broken up a spy ring working for Russian intelligence, which had been hiding cameras on important rail routes to monitor Western weapon and ammunition deliveries destined for Ukraine.

The Minister of National Defense Mariusz Błaszczak suggested the group had entered from neighboring Belarus and, according to local reports, Belarusian citizens were among those arrested. And even more disconcertingly, Poland’s Interior Minister Mariusz Kamiński said in a news conference that the suspects, who were based near the Rzeszów-Jasionka military airport, were preparing to “sabotage actions aimed at paralyzing the supply of equipment, weapons and aid to Ukraine.”

Darius Jauniškis, director of Lithuania’s State Security Department, said “Russian intelligence services are seeking to restore or create new opportunities for their intelligence activities in Europe”

This threat of sabotage and attacks is clearly on Jauniškis’ mind too. “The Russian military intelligence service regularly collects tactical and operational intelligence information about military and civil strategic infrastructure in Lithuania and countries neighboring Russia: from military units to energy infrastructure,” he said. And, “Ukraine is a good example of how such tactical intelligence can be used to target civilian infrastructure.”

Indeed, European intelligence services suspect a Russian hand behind a series of odd incidences of sabotage last year — including cut ground cables in northern Germany, which are used by train conductors to communicate, and severed undersea cables that supply electricity to a Danish island. Both Norway and Lithuania have reported unauthorized drones being flown near airfields and energy infrastructure as well. And some European intelligence chiefs remain highly worried about Russia activating so-called sleeper agents or “illegals,” spies hidden in target countries, trained to blend in with cover stories and false identities, living apparently innocuous “normal” lives.

Since Ukraine’s invasion, Bulgaria, Slovakia, Albania, the Netherlands, Germany, Sweden and Norway have all arrested Russian agents and moles working for either the GRU or SVR.

Last year, two Russians and a Ukrainian were arrested while trying to enter an Albanian military compound to take photographs. And also in 2022, Bulgarian prosecutors revealed details of an investigation into an army reserve general working in the defense sector, who had been passing classified intelligence to Russia since 2016.

Slovakian counterintelligence arrested army reserve colonel Pavel Buczyk last year as well, alleging he’d been providing Russia with information about Slovakian and Ukraine defense forces — he was paid at least €46,000 for information.

Buczyk was part of a four-man GRU-operated ring, which also included Bohuš Garbár — a writer for a pro-Russian website, who was recruited in 2021 by the then Russian military attaché, and their meetings in parks were caught on video by Slovak counterespionage officers. Among Garbár’s tasks was to search for individuals sympathetic to Russia and help shape a network of agents of influence.

Meanwhile, in September, a court in Hungary sentenced in absentia former European Union lawmaker Béla Kovács — a member of the right-wing Jobbik party who is now exiled in Moscow — to five years in prison for spying for Russia.

However, Hungary is seen by neighboring EU countries as a weak link in collective counterespionage efforts despite this case, as the presence of the Russia-controlled International Investment Bank in Budapest has been a focus of contention since Prime Minister Viktor Orbán agreed it could relocate there in 2019.

The obscure bank, which is now struggling for financial survival, is headed by Nikolay Kosov, whose parents had storied KGB careers during the Soviet era. Hungary’s opposition politicians and former intelligence officials, as well as Western security officials, have all expressed alarm regarding the bank being used as a logistical base for Russian espionage activities — yet, it still enjoys diplomatic immunity, as do its staff and consultants, who are issued with Schengen visas and have free movement within the EU.

Overall, this series of arrests across Europe is certainly testimony to Russia’s determination to gather as much information as it can on defense facilities and NATO military plans, and to trace and cultivate potential recruits, including those who may not handle sensitive material themselves but have access to individuals and organizations that do.

But as Russia’s spies try to rebound in Europe, it’s also testimony to the vigilance of Western security services.

They just must not let down their guard now.