Security services around Europe are on alert to a potential new weapon of Russia’s war – arson and sabotage – after a spate of mystery fires and attacks on infrastructure in the Baltics, Germany and the UK.

When a fire broke out in Ikea in Vilnius in Lithuania this month, few passed any remarks until the Polish prime minister, Donald Tusk, suggested it could have been the work of a foreign saboteur.

Investigators have already alleged potential Russian involvement in an arson attack in east London, an inferno that destroyed the largest shopping mall in Poland, a sabotage attempt in Bavaria in Germany and antisemitic graffiti in Paris.

While there is no evidence that any of these incidents across the continent are coordinated, security services believe they could be part of a systemic attempt by Moscow to destabilise the west, which has backed Ukraine.

They point out that after the cold war, foreign intelligence operations consisted of spies and their handlers, but in the era of social media, vandals can be hired, leaving few connections to other attackers as pay-as-you-go saboteurs paid a few hundred euros or in cryptocurrency.

Such is the emerging concern that these hybrid attacks could be the work of Russia that the issue was raised at a summit of foreign and defence ministers in Brussels this week with Dutch, Estonian and Lithuanian security officials all warning of national vulnerabilities.

One minister, who asked not to be named said, they were deeply worried about “sabotage, physical sabotage, organised, financed and done by Russian proxies”.

Last week, Tusk revealed Polish authorities had arrested nine people in connection with acts of sabotage allegedly committed on the orders of Russian services.

He said the crimes allegedly included “beatings, arson and attempted arson” with investigators looking into whether Russia was involved in the fire in a shopping centre in Warsaw, a claim the Russian embassy described as a conspiracy theory.

A spokesperson for Ikea said investigations were continuing into the source of the fire in Lithuania but it was among the examples, along with an attempted arson attack on a paint factory in Poland, that Tusk cited in his warning of potential foreign interference.

In April, a British man was accused of orchestrating an arson attack on two units linked to a Ukrainian businessman in an industrial estate in Leyton, east London, after allegedly being recruited by Russian intelligence. The Crown Prosecution Service claimed he was “engaged in conduct targeting businesses which were linked to Ukraine in order to benefit the Russian state”.

On Tuesday, the Estonian defence minister, Hanno Pevkur, in Brussels for an EU defence summit, said the country had already been the victim of Russian sabotage.

“They have conducted similar operations in Estonia. They hired 10 people to attack the car of the interior minister and a journalist’s car. This is normal behaviour of Russia. We are sorry to say but we need to understand that Russia is more and more aggressive towards European countries and also Nato countries,” he said.

He was referring to incidents in February when the windows of cars belonging to the interior minister, Lauri Läänemets, and a journalist were smashed.

Six people were arrested shortly afterwards, including Russian nationals and dual Russian-Estonian citizens, the prosecutor said.

In Germany, there are also suspicions of foreign intelligence-driven attacks in addition to a wave of cyber-attacks in 2023 by a hacker group linked to Russian intelligence.

Last month, two German-Russian nationals were arrested on suspicion of plotting sabotage attacks including on a military base in Bavaria. The main suspect has been accused of plotting an explosion, arson and maintaining contact with Russian intelligence.

Investigators in France are considering whether graffiti painted on Paris’s Holocaust memorial last week was ordered by Russian security services.

It has echoes of an attack last year when the Star of David was spray-painted on buildings in and around Paris, prompting fears of a recurrence of Nazi-era attempts to identify the homes of Jewish people. Authorities later said they believed the attack may have been a “demand” of an individual living abroad.

The attacks, European officials fear, add to an already proliferating disinformation campaign. On Wednesday, several schools around Athens were evacuated after a bomb hoax. Police traced to a Russian server and said the stunt was aimed at “disrupting public order”.

EU countries are tracking these events. Lithuania’s national crisis management centre (NKVC) has warned businesses including shopping centres and organisations supporting Ukraine to heighten their vigilance.

Vilmantas Vitkauskas, the head of the NKVC, told reporters two weeks ago: “The threat level is quite high. We urge the public to remain vigilant.”

On Monday, the Dutch national coordinator for security and counter-terrorism warned of the risk of subversive operations in the Netherlands including “espionage and pre-positioning for sabotage of vital infrastructure”.

In Brussels on Tuesday, the Dutch defence minister, Kajsa Ollongren, said Russia was “trying to intimidate” Nato countries, making EU member states vulnerable.

“Yes, we are vulnerable. I think all of us are. We have vital infrastructure. We have seabed infrastructure, we have electricity supplies, water supplies, we’re vulnerable to cyber-attacks.We are seeing now in several European countries that Russia is trying to destabilise us and also to intimidate us.

“I think this has been a way that Russia and also the Soviet Union has worked throughout recent history, really; in the 75 years of Nato I think we’ve seen it often,” she said.

Nato’s secretary general, Jens Stoltenberg, has also pointed the finger at Moscow. “We have seen several arrests across the alliance and different Nato allied countries of people who are accused of arson or sabotage. These are of course ongoing legal processes,” he said. “But what I can say is that we have seen increased Russian intelligence activity across the alliance. Therefore we have increased our vigilance.”