Students recruited via Telegram, amateur saboteurs and hitmen: How Russia outsources its operations in Europe

On the night of March 20, 2024, unusually humid and mild in London, three people in their twenties pulled up at an industrial estate in the east of the city in a cherry-red Kia Picanto. They went inside, set fire to a warehouse, and filmed the blaze on a cellphone. The video of the flames consuming the premises ended up in the hands of another 20-year-old, Dylan Earl, who was reached via the Telegram messaging app by the Russian paramilitary organization Wagner, linked to the Kremlin, which had in turn recruited others to do the dirty work. One of the burned units contained humanitarian aid and Starlink satellite equipment destined for Ukraine. According to the British investigation, the three young men who lit the fuse did not know they were actually working for Russia.

Moscow’s espionage in Europe has traditionally been associated with diplomats, bureaucrats, undercover intelligence officers and clandestine agents. Many of those actors remain. But since Vladimir Putin launched the war in Ukraine in February 2022, European governments have expelled hundreds of Russian officers, tightened counterintelligence measures, and severed some of the Kremlin’s valuable tentacles that it is now desperately trying to rebuild.

Russia is adapting parts of its operations in Europe to that new reality, several intelligence officials specializing in Moscow’s networks told this newspaper, and academic reports show similar trends. Rather than routinely sending its own agents — primarily from its military intelligence service, the GRU — and the units it has traditionally relied on, Moscow is outsourcing many of those activities. That ranges from recruiting students at universities worldwide to gather information, to sabotage, plots, or cybercriminal activity. Moscow denies the accusations.

A study by the International Centre for Counter-Terrorism (ICCT) and the think tank Globsec counted 151 known cases of sabotage, arson, attempted attacks, and other operations linked to Russia in Europe. That figure covers only February 2022 to February 2026, although the institution warns the real total is likely higher. Researchers identified 172 people involved in those cases; 95% had no formal ties to Russian intelligence services.

Jan Pad’ourek, former deputy head of Czech foreign intelligence and now a professor at CEVRO University in Prague, explains that Moscow has reinvented its modus operandi and now relies more heavily on collaborators recruited blindly through various social media platforms. This outsourcing follows a simple model: for example, they use Telegram channels to contact people going through personal or social difficulties, or even known criminals, offering well-paid jobs. Initially they assign a simple task — such as photographing a specific location — and pay a sum in cryptocurrency once the task is completed and the photo sent. Later, they raise the stakes, eventually requiring those recruited to carry out acts of sabotage.

In the summer of 2025, a Czech court sentenced a 26-year-old Colombian national to eight years in prison for setting fire to three Prague public buses in a depot and for planning another arson attack. Authorities say the man — who started the blaze, filmed it and then left — was commissioned via Telegram with a promised payment of $3,000.

Lithuania has an open case against six people for attempting, in 2024, to set fire to facilities storing mobile stations for radio-frequency spectrum analysis that were to be sent to Ukraine. The country’s prosecutor’s office says the operation, which failed, was coordinated from Russia by people linked to the GRU.

The criminal connection

“Russian services are currently focusing more on the underworld, motivating and assigning tasks to individuals from that milieu,” Pad’ourek, who served as the Czech foreign intelligence’s official representative in Moscow, Kyiv, and Washington, stresses. “It’s an effective, simple and cheap method that also enables rapid execution. The Russian services assume no responsibility for these people; if they are discovered, they are left entirely to their own devices. Many of the people deceived in this way are not even aware they are working for Russia.”

Furthermore, another veteran official from a European agency who is still active and spoke on condition of anonymity says Russia’s intelligence services — which since Soviet times have had some links to organized crime — are increasingly turning to criminal organizations or people with criminal records for their hybrid operations in Europe. “At times, for significant cases, they provide information and logistics from Moscow or even involve an agent to verify,” the former Czech official notes.

Pad’ourek says that may be the case of Maxim Kuzminov, the Russian pilot who defected to Ukraine with a military helicopter and ended up exiled in the Spanish city of Villajoyosa, where he led a conspicuously lavish life with the reward he had received from Kyiv. He was shot dead in an underground parking garage in February 2024. Investigators suspect Russian intelligence, especially the GRU, because of how the operation was planned and executed, but the case has been provisionally closed for lack of conclusive evidence.

In a confidential note on threats to the European Union that EL PAÍS reviewed, EU institutions warn that state actors are using criminal networks as intermediaries for some of their hybrid operations in Europe. Europol has issued a similar alert in its reports.

The point is not that there is a single European criminal network subordinated to the Kremlin. The evidence instead points to ad hoc, pragmatic relationships: when a service needs someone who can move around a country, gather information, intimidate a person or commit an act of sabotage, it can turn to intermediaries who have access to people willing to do it.

According to the 2026 Lithuanian report, the GRU remains at the heart of these outsourced operations in most cases. The report notes that Russian military intelligence units specializing in sabotage and assassinations continue to plan and coordinate kinetic operations in Europe and that Moscow is seeking to increase the threat they pose. Among Moscow’s targets, the report warns, are not only infrastructure and logistics centers, but also individuals who support Ukraine and opponents of Putin’s regime living abroad.

The Kremlin has targeted dissidents for years, including on foreign soil. Opponents living abroad, especially in eastern Europe, regularly receive warnings from European authorities to exercise extreme caution. Two weeks ago, Washington charged five people who allegedly worked for Russian intelligence with planning to “carry out attacks and assassinations worldwide, including in the United States.” The State Department speaks of alleged plots involving surveillance, recruitment, and targeted killings. Recently, dissident and former world chess champion Garry Kasparov revealed that U.S. and Lithuanian security services had warned him that his life was in danger.

Russia also targets journalists. In 2025, the United Kingdom sentenced six Bulgarian nationals to between five and 10 years in prison for spying for Moscow. Among other activities, the network monitored the U.S. Patch Barracks military base in Stuttgart between 2020 and 2023, where they believed Ukrainian troops were being trained; they also followed investigative journalists Christo Grozev, a Bulgarian, and Roman Dobrokhotov, a Russian. British authorities say the cell even discussed kidnapping them and in some cases hinted at the possibility of murder.

The group was led by Orlin Roussev, an IT specialist. According to the British prosecution, Roussev received orders from Jan Marsalek, the former Wirecard executive whom investigators linked to Russian intelligence. Working for them was a team that included, among others, a beautician, a laboratory technician, a painter and decorator, and a mixed martial arts fighter.

In that operation, police seized from their homes 221 phones, 495 SIM cards, 258 hard drives and other storage devices, 55 cameras, 33 audio recorders, 11 drones, and 75 passports and identity documents. There were also listening devices, tracking systems, and materials to hide cameras. One camera was found concealed inside a Minions toy.

Outsourcing has not removed the GRU from operations, but in some cases it may have distanced the service from the final link. Russian military intelligence can decide the target and coordinate a mission while intermediaries, recruiters, and low-level operatives carry it out, a European officer summarizes. “It’s an architecture designed to create distance. The longer the chain, the less each participant knows about who is really behind the operation,” she adds.

In August, German authorities found an explosive-laden drone in a restricted area of Leipzig Airport, near a Ukrainian plane used to transport military material. The device did not detonate, but the investigation revealed it was not an isolated incident: there were several drones and prior reconnaissance tasks. In September, the German government concluded that Russia was behind the attempted attack. Investigative reporting by German outlets WDR, NDR, and Süddeutsche Zeitung speaks of a chain of intermediaries but points to the GRU as the operation’s logistical backer.

In that layer of spies, saboteurs, or hitmen that form the new tentacles the Kremlin uses in Europe, the person who places the explosive can be far removed from the one who decided the target. Intermediaries, recruiters, and operators who know only part of the mission can stand between them. Russian military intelligence can remain at the far end of that chain, providing instructions, logistics, or contacts while others assume the risk on the ground. The classical spy has not disappeared. In some operations, they simply no longer need to be there when the fuse is lit.

Sign up for our weekly newsletter to get more English-language news coverage from EL PAÍS USA Edition