Russia is using online messaging apps and cryptocurrency payments to recruit “disposable” agents for low-cost sabotage operations throughout Europe, a report has said.
It is particularly keen to involve cash-strapped Ukrainian refugees, who may not be aware they are working for the Kremlin, in an attempt to undermine public support for Kyiv at a critical moment in the almost four-year-long war, according to the report by the Royal United Services Institute (Rusi) think tank in London.
The Kremlin’s operations have included arson, attacks on civilian infrastructure, vandalism and other acts of sabotage aimed at sowing “fear and confusion” in western societies and probing for weakness in the defence of civilian infrastructure. The report said the number of such incidents in Europe rose three-fold between 2023 and 2024 and that sabotage remained a “key tool” of Russian hybrid warfare.
Rusi said: “The methods used to recruit and task saboteurs have shifted from Cold War-era reliance on trained intelligence operatives to a model characterised by remote, freelance and highly deniable assignments: the ‘gig-economy era’ of Russian sabotage.
“Low-level operatives are commonly recruited via encrypted messaging apps, such as Telegram, and paid small sums, often in cryptocurrency.” Recruits are offered a few dollars for acts such as graffiti and up to $10,000 for more serious crimes. “In several cases, saboteurs were not paid at all, underscoring their disposability,” Rusi said. Ukrainians are paid a fraction of the sums that people in western Europe receive.
In November, Poland charged three Ukrainians, two in absentia, with an explosion on a railway line that was a key route for transporting aid to Ukraine. There has been a rise in anti-Ukrainian sentiment in Poland, which has taken in large numbers of refugees from the war-torn country.
In November Donald Tusk, the Polish prime minister, announced that a railway track on the Warsaw-Lublin had been destroyed by an explosive device
EPA/PRZEMYSLAW PIATKOWSKI
Stirring tensions and eroding support for Ukraine “is part of the logic of low-level [Russian] sabotage, even when the physical damage itself is limited”, said Kinga Redlowska, an expert on illicit finance and security who co-authored the report.
The railway blast, which Poland said was orchestrated by Moscow, occurred after Daniil Bardadim, a Ukrainian teenager who had fled Russia’s invasion, was accused of involvement in an arson attack that destroyed a shopping centre in Warsaw in 2024. He was also found guilty in November of detonating a device at an Ikea store in Lithuania and sentenced to three years in prison. He could face life behind bars if convicted of the attack in Poland.
The Marywilska 44 shopping centre in Warsaw, Poland was set alight in 2024
DARIUSZ BOROWICZ/AGENCJA WYBORCZA/ REUTERS
Bardadim, who was 17 at the time of the incident in Lithuania, is believed to have been offered a BMW car and around £8,000 by a shadowy group to set off the device in Ikea. He received instructions via Telegram and Zangi, a Chinese messaging app, investigators said. There is no evidence that he supported Moscow’s war against his homeland. The Lithuanian prosecutor said that if he had been recruited by Russian agents, it is likely that he “did not comprehend the ultimate objective”. No one was killed or injured in either the Ikea or the shopping centre fires.
The Rusi report, the first in-depth study of how Russia has financed its wave of attacks, called for a legal definition of sabotage to be adopted by European Union and Nato member states in Europe, improved enforcement and international co-operation, and stronger oversight of over-the-counter crypto to cash exchanges.
“Europe has been relatively slow to recognise these incidents as part of a co-ordinated sabotage campaign,” Redlowska said. “Money moves quickly, especially via crypto and informal cash services, while legal and cross-border co-operation processes move slowly. Even failed or low-impact attacks still achieve Russian objectives by creating fear, draining security resources and testing response thresholds.”
The report also urged campaigns to raise awareness of the Kremlin’s tactics among recent migrants, the diaspora and teenagers, the groups that are said to be the most frequently targeted by Russian recruiters, as well as rewards for whistleblowers.
• Russia’s war in Ukraine drags on for longer than fight against the Nazis
Vincent Severski, a former Polish intelligence officer, estimated that financial gain was the primary motivation for 95 per cent of recruits.
In February, a Ukrainian man identified as Serhiy S was sentenced to eight years in prison for planning arson attacks in Wroclaw, Poland’s third-largest city. He admitted receiving online instructions for the attacks, but said he had no intention of carrying them out and was planning to cut all contact with the alleged Russian agent after he had received an advance payment.
Other acts of sabotage attributed to Moscow include an arson plot that targeted warehouses owned by a Ukrainian businessman in London and the jamming of GPS systems used by airports in the Baltic region. European security agencies believe the operations are co-ordinated by the GRU, the Russian military intelligence service.