It was a crude and violent assault, but as a bloody message, it was chillingly effective. An attacker ambushed Leonid Volkov, a close adviser to the late Russian opposition leader Alexei Nalvany, outside his home on the outskirts of Vilnius, Lithuania. The time was 10.06pm on Tuesday night as he arrived, after having filmed an anti-Putin video in time for this weekend’s election. The assailant smashed open the car window and blasted Volkov with teargas, and repeatedly struck him with a hammer – about 15 times – breaking his left arm and bloodying his left leg before fleeing the scene. It was, Volkov said in the aftermath, “an obvious, characteristic, typical, gangster-style greeting from Putin” and the assault reflected an emerging truth: Russian intelligence operations in Europe are back. On Thursday, Lithuanian intelligence said the plot “seems to be the work of the Russian special services”, though Darius Jauniskis, the director of state security, said Moscow had apparently using a hired hand to carry out the attack itself. Since the invasion of Ukraine, more than 400 and up to 600 Russian intelligence officers have been expelled from embassies around Europe. Rebuilding the network at speed is said by analysts to have required Moscow to tap into organised crime to help carry out its dirty work. A month earlier, Maksim Kuzminov, a Russian helicopter pilot who defected to Ukraine, was found dead with half a dozen shotgun wounds, on the Costa Blanca. He had moved to Spain in the hope of starting a new life. Although firm evidence was absent, Spanish intelligence concluded that he had been slain on Russian orders, probably by hired killers. After the shooting, they had run over his body and subsequently burned out their getaway car, before almost certainly fleeing the country. Late last month, a sixth Bulgarian, Tihomir Ivanchev, a painter and decorator, was arrested and charged in the UK on suspicion of committing espionage. He is expected to stand trial this autumn, alongside five fellow nationals. All are accused of spying for Moscow in collaboration with Jan Marsalek, a former executive of the German company Wirecard, who is wanted by Interpol after fleeing to Russia following its collapse in 2020. Significantly, unlike prewar plots, Russia is showing a willingness to lean toward claiming responsibility. In the aftermath of the 2018 poisoning of the Skripals in Salisbury, efforts to deny involvement, however risible, were made by the two men accused. After Kuzminov’s death became public, Sergei Naryshkin, the director of Russia’s SVR foreign intelligence service, said the defector was “a moral corpse”. It reflects a remarkable turnaround. The plan for Ukraine had been to rely heavily on the FSB domestic intelligence service to recruit turncoats who would be willing to support the Russian invasion once troops crossed the border in February 2022. Whatever the FSB promised it could do, it failed spectacularly. Ukrainian resistance was fierce, not just on the battlefield, but across society. For a time, Sergei Beseda, the head of its fifth service, responsible for Ukraine, was detained – but then released back into his post as before. Andrei Soldatov, a Russian investigative journalist and intelligence expert now living in the UK, said the recovery in intelligence operations reflects Moscow’s belief that it is now engaged in an explicit struggle with the west. “They are in a warm war,” he argued, and in effect the Kremlin “was really good in changing its analysis” after what was meant to be a special operation to capture Ukraine failed. As Nato weapons have entered Ukraine in significant quantities, Moscow believes it is the start of “a big war” between west and east that was always inevitable, said Soldatov. It is also a reaction to what happened with previous plots. The exposure of the hacking of Democrat party emails in the run-up to the 2016 US presidential election by GRU military intelligence was once seen to be an embarrassment, given that destabilisation operations are not supposed to be detected, but following the election of Donald Trump, it came to be seen as a positive. “From the Russian point of view, it made Putin a kingmaker in the most powerful country in the world,” Soldatov said. Morale in the Kremlin has dramatically improved since the failure of Ukraine’s counteroffensive. The fear was that Kyiv would break through, or at least look like it was winning on land, but its troops only gained a few miles despite being supplied with western tanks, armoured vehicles and artillery. But with the war also still largely stalemated, other theatres of conflict have become more important. In Russia’s case, that includes the secret domain. Analysts report a greater professionalism in Russian operations. Jack Watling, a senior research fellow at the Royal United Services Institute thinktank, and two colleagues last month published an analysis of how the GRU has restructured operations after Ukraine. Key to their plans is reforming the operations of its 161 Centre, responsible for destabilisation abroad, along cold war lines to better train agents, known as “illegals”, who will be deployed into Europe under deep cover. “They are returning to some of the methods of the 1970s and 1980s,” Watling said. Some techniques used are elementary, with personnel no longer bringing mobile phones to the unit’s headquarters. A new subdivision, Unit 54654, has a focus on recruiting “cleanskins” – individuals with no prior security associations and generating cover stories to place individuals on the long-term spying missions that have been so highly prized in Moscow since Soviet times and the theft of atomic secrets by Klaus Fuchs from the Manhattan Project. The changes in strategy are typical of how Russia approaches wars, said Soldatov. “Remember that in every war, the Russian army and the Russian agencies come into the war in a very bad shape. We talk about that in 1914, 1941 and even Afghanistan. Then gradually, just because of sheer numbers and because they don’t care about casualties, they get into shape. I think that is what is happening now.”