Wagner and Hybrid Threat: What the London Fire Teaches Us

On March 20, 2024, a warehouse at the Cromwell Industrial Estate in East London went up in flames. The storage facility was no random target: it contained aid supplies and Starlink satellite equipment destined for Ukraine. Eight fire trucks and sixty firefighters were needed to bring the fire under control; the damage amounted to approximately £1 million.¹ Last month, London's Old Bailey sentenced three young men to years in prison for this attack. They acted on behalf of the Wagner Group, a Russia-backed militia considered a terrorist organization in the UK.¹ It was the first time Britons were prosecuted under the new National Security Act 2023, specifically designed to combat foreign interference.¹ What this incident shows: the tactics of hybrid warfare are not limited to conflict zones, but reach into the heart of Western European cities.

Hybrid warfare in the backyard

The London fire is part of a broader pattern. Russia combines military pressure with less visible means: cyberattacks, disinformation, espionage, and also sabotage of physical targets.² The method was alarmingly simple. Via Telegram, a Wagner contact recruited young Britons without a political agenda. For money, they carried out assignments ranging from arson to plans for kidnapping a Russian dissident in London.¹ This use of local intermediaries allows state actors to deny their involvement while the impact is significant.² The Dutch government identified sabotage in a Parliamentary letter at the end of 2024 as one of the most urgent threats to our vital infrastructure.³ The MIVD confirmed in 2025 that Russian interest in Dutch energy assets, such as North Sea wind farms and gas storage, is demonstrable.²

‍

For the Netherlands, this is not a distant concern. Our country is a logistical crossroads of Europe and therefore vulnerable.

• Energy: The NCTV stated in 2024 that sabotage of energy supply poses the greatest risk to societal disruption.³ Our dependence on offshore wind and gas storage makes us an attractive target for states seeking to exert pressure.
• Logistics: Ports and airports are not just trade routes, but also links in military and humanitarian supply. Disruption can directly affect allied support.
• Manufacturing and defense industry: Production locations essential to the defense sector or for delivering critical components are of interest to foreign actors. Attacks or infiltration can lead to supply chain standstills and loss of strategic capability.

The incident in London shows that small groups, with relatively simple means, can cause considerable damage. For Dutch organizations, this means that security does not stop at their own gate. Supply chain partners, suppliers, and logistical hubs are also part of the threat landscape.

‍

Incidents like those in London require more than observation. Organizations need systematic resilience. Three building blocks are essential here:

• Threat assessments: Knowing which actors have your sector in their sights, which methods they use, and how scenarios develop. Proximities already supports organizations with sector-specific threat assessments, for example for network operators, which can be directly translated into policy and measures.⁴
• Intelligence & monitoring: Early detection of abnormal behavior around critical locations or in the supply chain can prevent incidents. Proximities offers monitoring at multiple levels, from geopolitical signals to observation around A-locations, so organizations can respond proactively.⁵
• Crisis management: Not paper plans, but trained teams and scenarios. In case of sabotage or kidnapping, what counts is how quickly an organization can scale up. Proximities helps companies form crisis teams and test playbooks in realistic simulations.⁵

This combination of anticipating, monitoring, and practicing makes the difference between vulnerability and robust resilience.

‍

A New Reality

The fire in London shows that hybrid threats are not stopped by national borders. The fact that a foreign actor managed to hit a target linked to Ukraine through local intermediaries provides sufficient reason to re-examine our own vulnerabilities. The question for Dutch leaders is therefore clear: which of our processes or chain partners would be the first target in a London-like scenario, and are we sufficiently prepared for it?

‍

‍

1. BBC News – Three men found guilty of Wagner-linked arson attack in London, July 8, 2025.
2. MIVD Annual Report 2025.
3. Parliamentary Letter on Resilience to Hybrid Threats, December 6, 2024; NCTV Threat Assessment 2024.
4. Proximities – Threat Assessment Methodology (Product documentation hybrid warfare, 2025).
5. Proximities – Intelligence & Monitoring, Crisis Management (Product documentation hybrid warfare, 2025).

‍