Since Russia's full-scale invasion of Ukraine in 2022, European countries have expelled at least 750 Russian diplomats accused of espionage.
NATO says it has been the largest counterintelligence operation in the West since the Cold War.
In early May, six Bulgarian spies were jailed in the United Kingdom for feeding sensitive information to Russia.
NATO's deputy assistant secretary-general James Appathurai said Russia had a "higher risk appetite" towards espionage in 2025, and he believed the nation had increased its spying output.
Richard Moore, head of MI6, the UK's foreign intelligence agency, said Russia was on a "mission to generate mayhem".
"We have recently uncovered a staggeringly reckless campaign of Russian sabotage in Europe," he said.
Dennis Desmond, a former special agent with the US Defense Intelligence Agency, said the arrests and charges the world saw were just the "tip of the iceberg".
He said for every Russian spy caught, there was a much larger, much scarier number still operating.
A shift in Russia's intelligence network
Russia's security and espionage network falls into three branches — the Federal Security Service (FSB), the Foreign Intelligence Service (SVR) and the Main Directorate of the General Staff of the Armed Forces (GRU).
In 2022, according to a Royal United Services Institute (RUSI) report, Russia changed how it deployed spy operations "to prepare for destabilisation" in Europe and further afield.
It found Russia made changes to its spy program in reaction to "the eventual counterintelligence regime" from Ukraine's allies.
The report's primary conclusions were that Russia's special services were actively seeking to expand in order to pose strategic threats to NATO members.
A NATO analysis said it was concerned by the "intensifying campaign of activities which Russia continues to carry out across the Euro-Atlantic area", and that Russia poses a "threat to Allied security".
The RUSI report says the GRU "is restructuring how it manages the recruitment and training of special forces troops" and is "rebuilding" its apparatus to a higher level than before.
A separate report went a step further to say Russia was "conducting an escalating and violent campaign of sabotage and subversion" led by Russian military intelligence (GRU), according to a new CSIS database of Russian activity.
A lot of this escalation is happening in two GRU units — Unit 29155 and Unit 54654.
Recruitment to Unit 29155 focuses on individuals without military backgrounds, trained within the GRU, reflecting a shift towards generating cleanskins — someone not on the radar of any security services — for operations.
Unit 54654 operates differently. It recruits personnel without military contracts and contractors, through front companies to avoid government records.
There are other GRU organisations involved in subversive activities — particularly cyber intelligence — such as Unit 26165, also known as Fancy Bear, and Unit 74455, also referred to as Sandworm.
'Russia has very little to lose'
Since Russia invaded Ukraine in 2022, the European Union, the UK and the United States have all imposed sanctions on it aimed at cutting oil revenues that are funding the war.
The sanctions have led to the rise of a vast "shadow fleet" of tankers helping Moscow keep its crude exports flowing and funding its war plans.
Dr Desmond said the sanctions "don't really hurt Russia" as intended.
"They've already got so many sanctions against them, and Western nations are going to keep making more sanctions, and really that hurts the population, not the government or politicians," he said.
"Russia is going to continue to do what they do through the support of China, North Korea, Iran, Venezuela and other countries who are able to circumvent sanctions and provide support."
He said these sympathetic nations were "assisting Russia intelligence collection" to build what he described as a "giant vacuum" of information that no matter the sanctions or restrictions, Russia will continue to operate.
"Russia has little to lose and everything to gain by collecting that intelligence," he said.
Should Australians be concerned?
"Yes, Australians should be concerned about Russian — and other — spies potentially operating in Australia," Sarah Kendall, an expert in legislative response to espionage said.
ASIO director-general Mike Burgess said in February that "it is conceivable Russia could also target Australia for sabotage".
"The war in Europe prompted a more aggressive and reckless Russian intelligence apparatus to target Ukraine's supporters, including Australia," he said.
Dr Kendall said Russian spies were not only targeting government officials or those with access to classified information.
"They are targeting a wide range of people for a wide range of information, including information that may seem innocuous," she said.
"Because of this, we all have a role to play in security."
We have already seen allegations of Russian spying on Australian soil — Kira and Igor Korolev were charged with spying offences in 2024.
But ASIO says it has increased its counterespionage work since then and uses Australia's strong laws against espionage and foreign interference.
"ASIO's more aggressive counterespionage posture has made it more difficult and expensive for foreign spies to operate in Australia," Mr Burgess said.
Dr Desmond said there could be more spies operating on our shores, and they would be "very difficult to identify".
"They eat, sleep, look like, sound like and act like Australians," he said.
"They engage in clandestine collection operations, they recruit sources and agents, and they conduct sabotage assassinations.
"They basically execute targets within the country of which they reside in."
Patience is Russia's virtue
The Western world is well aware of Russia's increased espionage output over recent years but fear of "uncontained escalation" is stopping the West from properly extinguishing the mounting threat, according to the RUSI report.
The report highlighted to the West that Russia was expanding its influence to "evade containment, and destabilise and disrupt its adversaries".
The report states that spy work is not new in Russia, and no matter how long it takes "they have the patience to keep going".
"They will continue to engage in espionage, they will continue to engage in strategic planning and operations in order to be successful at gaining the information intelligence that they absolutely need," Dr Desmond said.
He said they do this while "simultaneously influencing decision makers abroad through disinformation campaigns" and "influencing political decisions and elections where they can".
In his opinion the West is already at war with Russia — a "cyber espionage war".
"Just because it's not a kinetic shooting war, doesn't mean it isn't war," he said.
