Russia's intelligence services have built a pipeline for recruiting saboteurs across Europe using social media - primarily Telegram - to find, task, and pay amateurs willing to carry out everything from arson to reconnaissance of military bases. The Polish Institute of International Affairs detailed this recruitment model in its comprehensive March 2026 report on Baltic Sea Region security, describing the operatives as "disposable agents."
As "Hvylya" reports, citing the PISM analysis, these recruits are typically "young, Russian-speaking individuals living in the EU and able to move freely within the Schengen zone," which gives the problem a cross-border dimension that complicates law enforcement response. According to Latvian security services data cited in the report, the typical profile includes citizens of Ukraine, Belarus, and Russia aged 19 to 40, financially motivated, often with criminal backgrounds and low socioeconomic status.
The tasks assigned through this network vary widely in sophistication. At the lower end are acts of vandalism - painting propaganda slogans and destroying monuments. The spectrum escalates through reconnaissance activities using cameras and drones to scout ports, military bases, and railway lines used for transporting military aid to Ukraine, all the way up to arson using flammable and explosive materials. The financial rewards offered through Telegram channels provide the incentive for individuals who, in the report's characterization, lack "permanent employment or income" and display "a lack of moral values."
Russia's recruitment base extends beyond the Russian-speaking diaspora. The PISM report identifies criminal circles, martial arts clubs, football fan groups, and far-right radicals in both Europe and the United States as part of the Kremlin's talent pool. Lithuanian authorities have flagged a particularly disturbing trend - an increased number of recruitment attempts targeting teenagers.
The "disposable" nature of these agents serves Russia's strategic interest in maintaining plausible deniability. Unlike traditional intelligence operatives, these recruits have no formal training, no institutional ties to Russian services, and are expendable. If caught, the chain of command is difficult to trace back to Moscow. The Schengen zone's open borders compound the problem - an agent recruited in one country can easily execute an operation in another.
The PISM researchers recommend that Baltic Sea Region states strengthen intelligence cooperation and invest in specialized training for border guards, coast guards, and police focused specifically on identifying and neutralizing this type of hybrid threat. Regional cooperation on rapid information exchange is critical, given that "the effects of a hybrid attack against one state" can quickly spill across borders.
Also read: NomenNescio: The Vienna Engineers Documenting Russia's Secret Listening Stations.