Russia’s Trojan horses: How Kremlin turned European real estate into spy network

A holiday cabin in Norway. A warehouse near an airfield. A church with a helipad on a Finnish island. Each one unremarkable on its own. Together, according to European intelligence officials, pieces of a Russian network built over years.

The strategy behind the properties

European intelligence officials have been warning for some time that Russia has been quietly acquiring real estate across the continent—not for investment, but as part of a coordinated hybrid warfare strategy. According to The Telegraph, which spoke to serving and former officers at three European intelligence agencies, Russian spy units are suspected of purchasing strategically located properties in at least a dozen European countries, positioning them as potential launchpads for surveillance, sabotage, and covert operations.

The portfolio is remarkably varied: summer houses and holiday cabins near military bases, abandoned schools, city flats, warehouses, and in at least one case, an entire island. Officials fear that some of these sites may already contain explosives, drones, weapons, and undercover operatives, ready to be activated in a crisis.

The broader context matters here. Acts of sabotage linked to Moscow—arson attacks in London and Warsaw, parcel bombs, assassination plots, attempted train derailments—have surged since Russia’s full-scale invasion of Ukraine. Some in the Western intelligence community describe these incidents not as ends in themselves, but as rehearsals. The real concern is a coordinated attack on transport, communications, and energy infrastructure designed to paralyze European societies without crossing the threshold that would trigger NATO’s Article 5.

“A sabotage campaign is less likely to produce consensus around Article 5 than a conventional Russian military operation,” one intelligence officer told The Telegraph. “Deniability—plausible or otherwise—makes attribution harder, and without certainty, it becomes much trickier to rally support.”

Blaise Metreweli, the new head of MI6, put it plainly in her first public speech: “Russia is testing us in the grey zone with tactics that are just below the threshold of war.”

Finland, Sweden, and the cases that set the pattern

No country has more direct experience with this strategy than Finland, which intelligence officials describe as the original testing ground for what Moscow is now replicating across Europe.

The clearest example is Airiston Helmi, a company that purchased 17 properties around Finland’s Archipelago Sea, many of them close to key maritime routes and telecommunications infrastructure near Turku, home to Finland’s naval command. The most striking acquisition was the island of Sakkiluoto. When Finnish authorities raided it in September 2018, they found nine piers, a helipad, security cameras, motion detectors, camouflage netting, and buildings resembling military barracks, each fitted with satellite dishes and advanced communications equipment. The company had also purchased surplus landing craft from the Finnish navy.

Finland chose not to charge the company’s Russian owner Pavel Melnikov with espionage directly, instead prosecuting him for fraud. He received a suspended sentence. Dmitry Medvedev dismissed the espionage angle, claiming only a “sick mind” could draw such conclusions. Finnish politicians were less amused.

Since 2022, officials say Russia has shifted away from such large, visible projects toward something harder to track: replicating the Airiston Helmi model “in miniature but at scale,” turning hundreds, perhaps thousands, of otherwise unremarkable buildings across Europe into listening posts, safe houses, and potential weapons depots.

Sweden has seen this pattern up close. Insight News Media previously reported on the case of Stanislav Aleshchenko, a Russian businessman wanted in Sweden on suspicion of espionage. Aleshchenko purchased expensive real estate directly adjacent to a secret Swedish naval headquarters, with a direct line of sight to a submarine base. He claimed to be merely visiting his wife, who lived there permanently. Swedish tax authorities established otherwise and fined him nearly 20 million euros for tax evasion. He had previously obtained a Bulgarian “golden passport,” a scheme that, as investigations by the European Commission and OCCRP later confirmed, was riddled with figures connected to the Kremlin.

The Russian Orthodox Church has also attracted scrutiny across the Nordic region. In Norway, a Russian Orthodox congregation purchased the Søreide prayer house in Bergen in 2017, overlooking the Haakonsvern naval base. Officials warned at the time that the location could enable signal disruption and drone operations, as well as provide cover for Russians mapping the area. In the Swedish city of Västerås, a church built in 2023 close to a strategically important airport was later assessed by Swedish intelligence as a potential espionage platform. The priest overseeing it had received a medal from the SVR, Russia’s main foreign intelligence service.

Across Europe and beyond

The pattern extends well beyond Scandinavia. European intelligence agencies have flagged Russian-linked property acquisitions near naval bases and strategic waterways in Sicily, Crete, and mainland Greece, as well as close to sensitive sites in London, Paris, and Geneva. In Switzerland, officials say Russian operatives used properties near a federal chemical protection institute—the same one that investigated the Salisbury poisonings—to intercept Wi-Fi networks and track weapons experts. There has also been a reported spike in Russian purchases near the Large Hadron Collider outside Geneva, raising concerns about potential sabotage to power lines and data cables.

In Norway, cabins linked to Kremlin-connected figures sit close to Arctic military installations, including properties in Målselv Fjellandsby overlooking the Bardufoss air base, which houses F-35 fighters in mountain hangars.

Some of the properties are openly Russian state-owned, operating under the cover of cultural or diplomatic functions. Poland shut Russia’s consulate in Gdańsk last November. Britain stripped a Russian-owned estate in East Sussex of its diplomatic status after neighbors reported surveillance drones being deployed from it. Latvia has closed Soviet-era resorts along its Baltic coast over fears they could serve as staging grounds for covert operations.

“For over a decade, Russian entities have systematically purchased properties in Finland, Sweden, and Norway in close proximity to military bases, ports, and strategic supply lines,” said Charlie Edwards, a senior fellow at the International Institute for Strategic Studies. “What once looked like suspicious commercial activity has evolved into a recognized vector for hybrid warfare, surveillance, and potential sabotage.”

A patchwork response

Finland moved first and most decisively, imposing a near-blanket ban on Russians and Belarusians buying real estate in July 2024, prompting Baltic states to adopt similar restrictions. But the response across Europe remains deeply uneven. A proposed EU-wide ban on property sales to Russian buyers collapsed last year amid resistance from member states worried about economic consequences. Cyprus, which has seen a string of Moscow-linked acquisitions near British military bases on the island, reportedly raised objections.

The result is a patchwork of national laws with significant blind spots, made worse by intelligence agencies that remain reluctant to share sensitive data across borders.

“As long as counter-intelligence remains national, it will fail to address a threat that crosses every national boundary in Europe,” one security official told The Telegraph.

The properties look ordinary. That, as Charly Salonius-Pasternak of the Helsinki-based Nordic West Office noted, was always the idea: “If you spoke like this 15 years ago, people would say you have been watching too many Tom Cruise movies. That has changed. As we saw in Ukraine, there tend to be many operations before the big war starts.”