Three people were arrested near London earlier this week on suspicion of spying for Russia, in a case that has drawn renewed attention to the escalating threat of foreign intelligence operations across the United Kingdom and Europe. The Metropolitan Police confirmed that on September 17, 2025, two men—aged 41 and 46—and a 35-year-old woman were taken into custody at two separate addresses in Grays, Essex, as part of a counter-terrorism investigation. All three were detained on suspicion of assisting a foreign intelligence service, a charge brought under the National Security Act 2023, and transported to a police station in London. After questioning, the suspects were released on police bail with conditions, pending further investigation.
The arrests, which the Metropolitan Police have directly linked to Russian state interests, highlight mounting concerns among British authorities about Moscow’s ongoing covert activities. According to Commander Dominic Murphy, head of London’s Counter Terrorism Command, the UK is seeing “an increasing number of who we would describe as ‘proxies’ being recruited by foreign intelligence services.” He emphasized that the recent detentions are “not linked” to the separate case of two British men who are currently awaiting sentencing for being recruited by Russia’s Wagner mercenary group to carry out an arson attack at a Ukrainian-linked warehouse in London. That earlier incident caused damage estimated at £1 million (€1.15 million) and is considered one of the most brazen examples of Russian-backed sabotage on British soil in recent years.
Commander Murphy’s warning comes amid a broader Europe-wide surge in Russian espionage and sabotage operations. The day after the Essex arrests, Lithuanian prosecutors announced they had dismantled a Russia-backed network accused of planning arson and explosive attacks in several European Union states. Lithuanian authorities allege that the group—linked to Russia’s GRU military intelligence agency—was behind a series of parcel explosions across the continent in 2024. Homemade incendiary devices, disguised inside vibrating cushions and cosmetics tubes, were shipped via courier services to Britain and Poland. In July 2024, one such package caught fire at a DHL logistics hub in Leipzig before it could be flown to the UK, while another ignited at a warehouse in Birmingham. Two other parcels bound for Poland also caught fire, though one failed to detonate. Investigators revealed that the devices contained thermite, a highly flammable industrial compound.
Authorities in Vilnius connected two of the Lithuanian suspects to an arson attack on an IKEA store in May 2024. In total, 15 individuals from Russia, Lithuania, Latvia, Estonia, and Ukraine are under investigation, with international arrest warrants issued for three of them. Searches in Lithuania, Poland, Latvia, and Estonia uncovered additional incendiary devices, which authorities believe were intended for future attacks. These revelations underscore the scale and sophistication of Russia’s covert networks operating across Europe, often using local recruits or “proxies” to carry out their missions.
The United Kingdom has long accused Russia of orchestrating sabotage and intelligence-gathering operations on its territory and beyond. The Kremlin, for its part, has rejected these allegations and accused the UK of blaming Moscow for “anything bad that happens.” Yet, the evidence of Russian involvement in recent incidents appears substantial. In July 2025, three men were convicted of setting fire to Ukraine-linked businesses in London—an attack British officials said was ordered by the Wagner Group, a private military organization that acts on behalf of the Russian state. The UK government designated the Wagner Group as a terrorist organization in September 2023, reflecting the growing alarm over its activities.
These recent cases are part of a larger pattern. Earlier this year, five Bulgarian nationals were convicted of spying for the Kremlin. At the same time, Latvia’s security service announced the detention of a man accused of passing military intelligence on NATO troops and infrastructure to Russia. The arrests in Essex are just the latest in a series of counter-espionage actions that highlight the persistent threat posed by Russian intelligence agencies, especially the GRU, which MI5 chief Ken McCallum last year described as leading a campaign to “generate mayhem on British and European streets” by using proxies. McCallum warned that the GRU’s reliance on local recruits “further reduces the professionalism of their operations,” making them both more unpredictable and potentially more dangerous.
While the Metropolitan Police have not disclosed the nationalities of the three suspects arrested in Essex, their alleged activities fit a pattern seen elsewhere in Europe. The use of proxies—locals or foreign nationals living in target countries—allows Russian intelligence to maintain a degree of separation from the operations, complicating efforts to trace attacks directly back to Moscow. Commander Murphy cautioned, “Anyone who might be contacted by and tempted into carrying out criminal activity on behalf of a foreign state here in the UK should think again. This kind of activity will be investigated and anyone found to be involved can expect to be prosecuted and there are potentially very serious consequences for those who are convicted.”
The National Security Act 2023, under which the Essex suspects were arrested, was introduced to give British authorities broader powers to counter foreign state threats. The law criminalizes a range of activities, including assisting foreign intelligence services, and allows for more robust investigation and prosecution of espionage-related offenses. The ongoing investigation into the Essex suspects is being led by the Metropolitan Police’s Counter Terrorism Command, reflecting the seriousness with which the UK treats the threat from foreign intelligence operations.
The arrests also coincide with a broader effort among European security services to disrupt Russian intelligence networks. Lithuania’s recent crackdown on the parcel bomb network, Latvia’s arrest of a suspected military informant, and the UK’s own high-profile convictions all point to a coordinated response to what officials describe as a “paradigm shift” in Russian tactics since the invasion of Ukraine in early 2022. Russia’s willingness to use sabotage, arson, and other forms of asymmetrical warfare has forced European governments to bolster their counter-intelligence and counter-terrorism efforts.
As the investigation into the Essex suspects continues, British authorities remain tight-lipped about specific details, citing operational security. Still, the message from law enforcement and intelligence officials is clear: the UK is facing an unprecedented wave of foreign-backed espionage and sabotage, and those tempted to participate face serious legal consequences. For now, the three suspects remain on bail, but the shadow of Russia’s intelligence operations continues to loom large over Britain and its European neighbors.
With each new arrest and conviction, the contours of a clandestine struggle become clearer—one in which the front lines are not just in distant capitals, but right in the heart of British communities.
