Vladimir Putin’s spy network is reportedly exploiting a grey area in Nato’s legal framework with a subtle campaign of “hybrid war”, officials say.

The network of clandestine Russian agents are suspected of buying up hundreds if not thousands of sensitive properties near military and civilian sites across several countries in Western Europe.

They are said to be transforming these otherwise unremarkable buildings into potential surveillance hubs, safe houses and weapons depots  – with fears many are already stocked with weapons and sleeper agents awaiting orders. 

Experts warn Britain could be vulnerable following suspicious property purchases near MI6 headquarters in Vauxhall.

The acquisitions, as well as others near the United States embassy at Nine Elms, have reportedly been investigated.

Read more: UK hits Russia with largest wave of sanctions yet on fourth anniversary of Putin’s war in Ukraine

Read more: Putin no longer able to recruit Russian troops quickly enough to replace those dying on battlefield

Speculation has mounted that Russians may also buy, or have already bought, remote properties near Trident’s submarine base in Faslane, west Scotland, subsea cable landing points in Shetland, and the RAF Akrotiri base in Cyprus.

Concerns have also been raised about suspicious Russian purchases in Nordic countries. 

Charlie Edwards, a senior fellow for strategy and national security at the International Institute for Strategic Studies, told the Telegraph: “For over a decade, Russian entities have systematically purchased properties in Finland, Sweden and Norway in close proximity to military bases, ports and strategic supply lines.” 

Russian acquisitions near naval bases and strategic waterways in Sicily, Crete, mainland Greece, and sensitive sites in Paris and Geneva, have also sparked concerns.It comes as Moscow is accused of launching under-the-radar attacks on transport, energy and communications infrastructure across Europe. 

Train derailments and arson attacks amid the invasion of Ukraine have also been linked to the Kremlin – with officials saying these could be “test runs” for larger-scale attacks. 

This is all part of a “hybrid” strategy to target Europe without triggering NATO’s Article 5, insiders say. 

“A sabotage campaign is less likely to produce consensus around Article 5,” one official told the Telegraph. 

“Critical national infrastructure is acutely vulnerable to malicious state activity. 

“Allowing Russian nationals to invest largely unimpeded in strategic real estate is a significant threat vector that urgently needs addressing,” another told the newspaper.

Defence experts told LBC last month that drone incursions, undersea cable sabotage and relentless cyberattacks have become part of Putin’s new kind of conflict, a “hybrid war” fought in the shadows, without formal declaration, but with very real consequences.

Speaking exclusively to LBC, Eugen Ciemnyjewski, CEO of EUROATLAS, a company developing autonomous undersea drones to protect Europe’s critical subsea infrastructure, says we are “leaving an Achilles’ heel wide open.”“We’ve seen Putin’s shadow fleet used for nefarious purposes in the seas around Europe,” he explains.

“They’ve evaded sanctions, but more dangerously, they’ve been surveilling and allegedly severing undersea infrastructure.”If the seabed is one front, cyberspace is another – and it’s already under fire.

Joe Jones, CEO of cyberattack simulation firm Pistachio, told LBC the chaos caused by recent hacks should be a wake-up call.In the UK, attacks like the one that crippled Jaguar Land Rover’s operations show just how quickly digital sabotage can wreak havoc. “They can cause billions in losses, bankruptcies, the theft and weaponisation of personal data – and as we saw with the NHS, even death.

”The attraction for hostile states is obvious. “Being able to bring an economy or an industrial base to its knees without firing a single shot is invaluable,” Jones says.

Many of the attacks traced back to Russia aren’t always officially directed by the Kremlin, but originate from hackers operating with its tacit approval. “There’s plausible deniability built in,” he explains.

“They don’t need direct orders to serve the same strategic purpose.”