Study: Russian intelligence increasingly using disposable, online-recruited operatives for sabotage in Europe
A joint European broadcasters' investigation has found that Russian intelligence services are relying less on professional agents and more on easily replaceable people recruited online to carry out sabotage across Europe, many of whom don't fully know who they're working for.
An investigation by the European Broadcasting Union, conducted jointly by DW, LRT, RTVE and ČT, has revealed how Russian intelligence services are increasingly turning to so-called "disposable agents" — people given a single task who often have no full understanding of who is actually directing them. Researchers examined a network linked to sabotage attacks in the Czech Republic, Poland, Romania and Lithuania in 2024, drawing on leaked documents and interviews with dozens of investigators and intelligence officials.
Who these operatives are
Many of those recruited are young, financially vulnerable people looking for work in Europe, found through social media, job listing platforms and volunteer forums. Some were tasked simply with surveilling locations, while others were told to set fire to or damage infrastructure and businesses supporting Ukraine.
Link to Russian military intelligence
Authorities in Lithuania, Poland and Romania have tied part of the network's operations to Russia's military intelligence service. One investigative trail led to a Latin American dance studio in northwestern Russia, which researchers say became an important contact point. DW's reporting described how several people of Latin American origin were connected to a chain of arson and sabotage across Poland, the Czech Republic, Romania and Lithuania, where investigators also probed a plot to set fire to suppliers of military equipment.
In March this year, Eurojust announced a joint investigation involving Germany, Lithuania, the Netherlands, Poland and the United Kingdom into self-igniting parcels, identifying 22 suspects in Lithuania and Poland believed to be working for Russian military intelligence. In 2024, packages sent from Lithuania caught fire in Germany, Poland and the UK, including one that ignited at a sorting center in Leipzig airport shortly before being loaded onto a plane.
Why this approach is used
The model gives intelligence services distance from the final perpetrator, with communication passing through intermediaries and encrypted platforms; recruitment often happens via Telegram, while payments are split through cryptocurrency intermediaries or cash. Data from a counter-terrorism research center shows more than 150 Russia-linked sabotage incidents recorded across Europe between 2022 and early 2026, and NATO has also publicly noted the growing scale of such hostile activity.
