Russia recruits Ukrainians for sabotage in Europe: new intelligence data.

According to ТСН: Russian special services have intensified recruitment of Ukrainians for sabotage activities in European countries, with the aim of undermining NATO unity and shaping negative attitudes among Europeans towards Ukraine.

This is stated in a new study by the Royal United Services Institute (RUSI), published by Sky News.

Experts emphasize that recruitment takes place through messengers, notably Telegram, as well as gaming platforms. Many of those recruited are unaware of what they are being involved in; they are used as 'disposable agents' for arson, vandalism, and other sabotage.

Motivation and vulnerable groups

Analysts note that such actions engage not only Ukrainians but also citizens of other countries. The biggest motive for recruitment is money. The most vulnerable to this influence are teenagers, migrants, and elderly people who have military experience.

The report also emphasizes that Russia has changed its tactics, abandoning traditional methods from the Cold War era. Now a remote model is used — cheap, anonymous, and difficult to investigate. Experts consider this the 'gig economy era' in Russian subversions.

Payment for tasks ranges from hundreds to thousands of euros and is often transferred in cryptocurrency, making it difficult for investigators to trace funding.

'Hostile actors now outsource inexpensive tasks to disposable individuals (or 'one-day agents') recruited online,'

experts note.

The Kremlin previously denied Western accusations of a large-scale sabotage campaign. However, according to researchers, 34 acts of arson and serious sabotage linked to Russia were recorded in Europe in 2024. In comparison, there were 12 in 2023 and only two in 2022.

The authors of the study urge NATO and the EU to urgently enhance responses, including defining a unified concept of 'sabotage' and employing anti-terror mechanisms to monitor illegal financing.

Checking NATO's 'red lines'

Experts believe that even minor incidents cannot be considered in isolation. They indicate a broad campaign aimed at increasing the 'cost' of supporting Ukraine and testing the limits of NATO countries' patience, as well as undermining trust in Western security systems.

This concerns both large-scale operations, such as damage to underwater cables, and simpler actions — arson, vandalism, or reconnaissance of military and civilian objects.

'While individual incidents may seem minor or opportunistic, together they indicate the emergence of a broader campaign aimed at increasing the cost of supporting Ukraine, testing NATO states’ red lines, and undermining public trust in Western national security systems,'

the message states.

According to the report, following the mass expulsion of Russian diplomats and spies from Europe, Moscow has increasingly turned to intermediaries and 'disposable agents', many of whom are Ukrainians.

Analysts warn that perceiving such incidents merely as actions of individual Ukrainians is dangerous, as this may provoke anti-Ukrainian sentiments in Europe — one of the goals of Russian sabotage.

For instance, Poland, which often becomes a victim of hybrid attacks, illustrates this issue.

'Many of those detained on charges related to sabotage, from 2023 to 2025, were citizens of Ukraine — an event interpreted not as evidence of coordination by Ukraine but as part of a deliberate Russian strategy to exploit the presence of Ukrainian migrants to provoke public distrust and political tension,'

analysts emphasize.

A glaring example was the explosion on a railway line in Poland, an important supply route for aid to Ukraine. Authorities report that two suspected Ukrainians fled to Belarus, while several others were detained. The Prime Minister of Poland characterized this incident as 'an unprecedented act of sabotage.'

Previously, the Security Service of Ukraine (SBU) reported on a new tactic of Russian special services, who impersonate Ukrainian law enforcement and recruit citizens.

The enemy increasingly disguises itself as Ukrainian law enforcement agencies to deceive citizens and compel them to perform criminal tasks for the aggressor state. This is the so-called 'operation under a false flag.'

'A particularly insidious tactic is using trust in Ukrainian law enforcement to achieve hostile goals,'

Actions of Russian special services aimed at destabilizing the situation in Europe once again confirm how vital military support from international partners is for Ukraine. In light of rising threats, Western countries need to collaboratively seek effective solutions to prevent the realization of the aggressor's plans.