Russian intelligence services are actively using recruitment networks on the Telegram messenger to organize terrorist attacks against NATO countries and the European Union. Initially, these channels sought operatives for sabotage activities in Ukraine, but the Kremlin has now expanded the effort into a decentralized proxy campaign across Europe. The goal of this activity is to undermine the European security system.
According to journalists’ estimates, since the beginning of 2026 alone, more than 20 million advertisements disguised as offers for easy part-time jobs and simple technical work with flexible schedules have appeared on Telegram. Most of these posts are published from temporary accounts registered to phone numbers from India, Iran, and Arab countries, according to the Robert Lansing Institute.
In the spring and summer of 2026, the recruitment network expanded into Central Europe and the Baltic states. Following the expulsion of hundreds of Russian intelligence officers after the full-scale invasion of Ukraine, Moscow’s operational capabilities declined. As an alternative, Russian intelligence services began recruiting disposable agents among local residents, migrants, and financially vulnerable individuals through urban employment groups.
For setting fire to NATO military equipment and critical infrastructure, recruiters offer between $1,500 and $3,000. Payments are transferred to cryptocurrency wallets or intermediary accounts 15 minutes after a video report is submitted. At the same time, a mandatory verification procedure is used: the operative must record a code word on video against the background of the burning target.
To conceal its direct involvement in the terrorist campaign and avoid international responsibility, the Kremlin uses a false-flag strategy, involving foreign citizens and locally recruited operatives. This complicates coordinated decision-making within NATO and the EU.
The level of Russian aggression in Europe has already reached a critical threshold: hybrid attacks are occurring more frequently than once every two days. These include arson attacks, vandalism, cyberattacks, explosions, and assassination attempts.
The scale of coordination through Telegram indicates that arson attacks on locomotives in Poland, the destruction of NATO equipment in Lithuania, and espionage activities in Latvia are not isolated incidents but components of a single coordinated campaign. This is also suggested by the complete standardization of wording, instructions, and payment methods.
In Lithuania and Latvia, recruiters have focused on destroying NATO military equipment, offering $1,500 in exchange for photographic or video evidence. In Latvia, in May 2026, law enforcement recorded an attempted arson attack on the office of the Ukrainian community organization "Viche" in Riga using Molotov cocktails. The perpetrators were promised $3,000 in cryptocurrency after sending photos of the target and video footage of preliminary reconnaissance.
Notably, instructions were transmitted through Telegram channels that had previously coordinated attacks on European power generators supplied to Ukraine.
In Poland, in June 2026, hundreds of identical Russian-language advertisements appeared in regional groups in Wrocław and Warsaw offering $3,000 for setting fire to humanitarian aid collection points, political party offices, volunteer recruitment centers, railway infrastructure, mobile phone towers, and vehicles with Ukrainian license plates. Coordinators required the use of the Timestamp Camera application to verify the exact time and location of the actions.
In addition, at the beginning of 2026, Czech authorities dismantled an espionage network involved in smuggling electric detonators on passenger buses, which led to an arson attack on a defense facility in Pardubice that produced drones for the Armed Forces of Ukraine.
Beyond cyberattacks, Russia is using commercial civilian transport and civilian postal services to smuggle explosives into Europe, creating a direct threat to industrial and energy infrastructure.
Pressure on the Kremlin has increased due to the growing effectiveness of Ukrainian long-range precision strikes, forcing Moscow to demonstrate power beyond the battlefield. The purpose of expanding sabotage networks is to destabilize the situation in the EU, intimidate societies, disrupt logistics supporting Ukraine, and pressure Western governments to reduce assistance to Kyiv.
At the same time, the choice of low-cost attacks costing only several thousand dollars illustrates the asymmetric economics of hybrid warfare: minimal expenditures can cause millions of dollars in damage, divert law enforcement resources, and undermine public trust in government institutions.
