Russian intelligence services are running a large-scale recruitment network through the Telegram messaging app to enlist saboteurs for attacks on NATO military vehicles and critical infrastructure across the European Union, according to investigative reports published on July 8, 2026.
The network, initially uncovered for recruiting operatives to carry out sabotage in Ukraine, has expanded its focus to EU member states, offering payments ranging from $1,500 to $3,000 for arson attacks on alliance equipment and infrastructure targets. Recruiters disguise the activity as ads for “easy extra income” or “simple technical work” with “stable pay” and “flexible hours,” investigators said.
Journalists estimated that since the beginning of 2026, more than 20 million such advertisements appeared on Telegram. Most were published by disposable accounts registered with phone numbers from India, Iran, and Arab countries.
####Recruitment via Telegram
The recruitment operation targets local residents, migrants, and financially dependent individuals through city-based Telegram channels for employment and services. Payments are made via cryptocurrency wallets or transit bank cards within 15 minutes after the saboteur provides video confirmation of the attack, including a codeword spoken against the burning target, investigators reported.
In Lithuania and Latvia, the network focused on destroying automotive and special equipment of the North Atlantic Alliance. The recruiters offered $1,500 for the complete destruction of a military SUV with proof. In Latvia, a May 2026 attempt to set fire to the office of the Ukrainian community confederation “Viche” in Riga was recorded. Executors were promised $3,000 in cryptocurrency after receiving photos of the target and drone reconnaissance footage. Instructions came from Russian Telegram channels that previously coordinated attacks on European generators in Ukraine, the investigation found.
####Incidents across EU
In Poland, hundreds of identical Russian-language advertisements appeared in regional city chats, including in Wroclaw and Warsaw, in June 2026, offering a $3,000 “fee” for setting fire to humanitarian aid collection points, political party offices, volunteer recruitment centers, railway infrastructure, mobile phone towers, and private cars with Ukrainian license plates. The recruiters used the Timestamp Camera application to verify coordinates and timing of reconnaissance missions.
In early 2026, Czech authorities dismantled a Russian agent network that organized the purchase and smuggling of electric igniters for detonators using regular bus routes. The direct consequence of that terrorist channel was the arson of a defense company producing drones for the Ukrainian armed forces in the city of Pardubice, according to the investigation.
European security services have recorded an unprecedented increase in Russian hybrid activity across the continent, ranging from sabotage and cyberattacks to weapons and explosives smuggling. The Kremlin has deployed a large-scale sabotage network inside the EU, using the recruitment of “disposable agents” and turning European online services into tools for coordinating attacks. The reliance on financially dependent and marginalized individuals minimizes the risk of exposing direct involvement by Russian intelligence, the reports said.
The expansion of the Russian sabotage network’s geography indicates efforts by Moscow to destabilize the security situation across the entire EU. The Kremlin aims to intimidate European societies, block logistics chains, and force the West to reduce aid to Kyiv, the investigative material concluded. The findings underline that Russia remains a security threat to the EU regardless of leadership changes or the outcome of the war in Ukraine.
