Russia’s intelligence services are intensifying efforts to obtain Western defence and dual-use technology as sanctions restrict Moscow’s access to advanced equipment, software and research. The pattern points to a growing overlap between espionage, cyber operations and sanctions evasion.

Russia’s intelligence services are increasing efforts to acquire Western defence technology, industrial equipment and dual-use research as sanctions continue to restrict Moscow’s access to advanced components needed for its war economy.

The development, reported by the Associated Press, is based on accounts from senior European intelligence officials who say Russian agencies are using fake companies, middlemen, cyber spies and hackers to obtain sensitive technology. The targets include defence industries, machine tools, software, space systems, marine technology, Arctic research and quantum-related work.

The issue is not confined to classic espionage. European officials describe a wider Russian effort to compensate for the effects of export controls by combining intelligence operations with procurement networks and cyber access. That makes the problem harder for governments and companies to manage, because the same activity can sit across several categories at once: sanctions evasion, industrial espionage, cyber intrusion and military supply-chain targeting.

According to the AP report, Swedish intelligence officials say Russia is targeting the country’s defence sector and research connected to advanced weapons, including the Gripen fighter jet. They also cite interest in camera and laser technologies that may have civilian uses but could be integrated into weapons systems. Finnish intelligence officials pointed to Russian interest in space, quantum, Arctic and marine technology, as well as software updates for sanctioned machine tools.

This matters for Europe because many of the goods Russia seeks are not conventional weapons. They are often components, production systems, software, sensors, industrial tools and specialist research. Such items can be legally traded in ordinary civilian markets, yet become militarily relevant once redirected into Russia’s defence industry. That is where the enforcement challenge begins.

The European Union has significantly expanded export controls since Russia’s full-scale invasion of Ukraine. The European Commission says the EU has sharpened restrictions on dual-use goods and advanced technologies, targeting sectors of Russia’s military-industrial complex and limiting access to sensitive technologies. In April, the EU’s 20th sanctions package added further export restrictions and strengthened controls on dual-use and advanced technology items.

The intelligence warnings suggest that Russia is adapting rather than abandoning procurement attempts. Where direct supply routes are blocked, the effort can shift to third-country intermediaries, front companies, indirect shipments, illicit purchases or cyber-enabled theft. In practical terms, this puts more responsibility on European exporters, research institutions, logistics firms and software providers to identify suspicious end-users and unusual transaction patterns.

The cyber dimension is particularly significant. Swedish officials cited by AP said Moscow is deploying cyber operations against European firms and critical infrastructure to gather information that could later be used when useful. They pointed to an attempted attack on a Swedish power plant last year, which failed after the intrusion was detected. The official assessment was that the incident marked a shift from reconnaissance and intelligence-gathering towards more risk-tolerant behaviour.

That assessment is consistent with recent warnings from the United Kingdom. In her annual lecture at Bletchley Park on 27 May, GCHQ director Anne Keast-Butler said Russia was targeting the UK and European allies through cyber activity, sabotage and technology theft. The speech placed Russia’s activity within a wider pattern of threats to infrastructure, supply chains, democratic systems and public trust.

The UK’s National Cyber Security Centre has also warned this year that Russian-aligned groups continue to target UK organisations, including local government and operators of critical infrastructure. Although such warnings focused on disruptive attacks rather than technology theft alone, they point to the same strategic problem: European systems that support public services, industry and security are now part of the contest around Ukraine.

For defence planners, the risk is twofold. First, Russia may obtain equipment or knowledge that improves its weapons production, surveillance capacity or battlefield systems. Secondly, the same access routes used to steal information can expose European firms and infrastructure to disruption or coercion. A company that is unaware it has become part of a Russian procurement chain may also be vulnerable to cyber compromise or legal exposure under sanctions rules.

The problem also tests the limits of sanctions policy. Export bans can restrict lawful trade, but they do not automatically stop covert procurement. Enforcement depends on customs authorities, financial monitoring, corporate due diligence, intelligence sharing and criminal prosecution. Russia’s use of intermediaries also means that the decisive transaction may not appear to involve Russia at all.

The consequence is a widening security burden for Europe’s private sector. Defence companies are obvious targets, but smaller manufacturers, machine-tool suppliers, software vendors, university laboratories and logistics firms may also hold technology of interest to Moscow. In many cases, these organisations may not think of themselves as part of Europe’s defence ecosystem.

The latest intelligence warnings therefore point to a broader vulnerability: Europe’s technological edge depends not only on innovation and defence spending, but on the protection of industrial knowledge, research partnerships and export-controlled supply chains. As long as Russia remains under pressure to sustain its war economy, European technology will remain a target.