Russian spies are increasingly recruiting Ukrainians to carry out acts of sabotage in Europe to undermine NATO and attempt to turn public opinion against Ukraine, according to new research.
Kremlin-linked intelligence officers are accused of seeking to woo potentially unwitting individuals via messaging apps such as Telegram or gaming sites to become “disposable agents”, tasked with conducting arson, vandalism and other hostilities.
Other nationalities are also recruited.
The research report, published by the Royal United Services Institute (RUSI) thinktank, said money is a key motivator, with teenagers, migrants and older people with experience of serving in the Soviet military seen as ripe for recruitment.
‘Gig-economy of sabotage’
Payment – ranging from hundreds to thousands of euros – is often promised in cryptocurrency, making the source of funding hard for investigators to trace.
“The methods used to recruit and task saboteurs have shifted from Cold War-era reliance on trained intelligence operatives to a model characterised by remote, freelance and highly deniable assignments: the ‘gig-economy era’ of Russian sabotage,” the report – entitled “Responding to Russian Sabotage Financing” – said.
“Hostile actors now outsource low-cost tasks to disposable individuals (or ‘agents for a day’) recruited online.”
The Kremlin has previously denied Western allegations of a growing campaign of sabotage and other hybrid hostilities.
But the number of acts of Russia-linked arson and serious sabotage across Europe is reported to have risen to 34 in 2024, up from 12 the previous year and just two in 2022.
The authors of the RUSI report said this tactic of deliberately deniable activity carried out under the threshold of conventional war has “evolved into a systematic and geographically targeted threat”.
They urged NATO and the EU urgently to improve their response to deter future acts of sabotage.
This includes agreeing a definition of what constitutes sabotage and drawing on counterterrorism powers to track illicit funding channels.
Putting NATO ‘red lines’ to the test
The report also said governments must view individual incidents – regardless of how minor – as being part of a much graver pattern of activity against Western allies.
“While individual incidents may appear low-level or opportunistic, collectively they suggest the emergence of a broader campaign designed to raise the cost of supporting Ukraine, test the red lines of NATO states and erode public trust in Western national security systems,” it said.
Suspected Russian sabotage covers a range of actions from major operations such as damaging undersea cables to much more simple attacks against military and civilian targets, including starting fires and vandalism but also reconnaissance activities.
‘Disposable agents’
This low-level activity is the focus of the report, which drew on the insight of individuals from law enforcement, academia, and journalism as well as policy experts.
With many Russian intelligence officers expelled from Europe in the wake of Russia’s full-scale invasion of Ukraine, the RUSI report found that Russian spies “increasingly rely on intermediaries and ‘disposable agents’, many from Ukraine, to execute sabotage tasks.”
“If such incidents are treated purely as the actions of individual Ukrainians, this could fuel anti-Ukrainian sentiment and erode public support for Kyiv – a strategic aim of sabotage operations,” it said.
The report said recruited Ukrainians include those who were “unaware of the true nature of their tasks”.
Listen to The World with Richard Engel and Yalda Hakim every Wednesday
Read more from Sky News:
Chinese hackers blamed for sabotage
Why UK’s undersea cables are vulnerable
British men recruited by Russia and China
It cited the experience of Poland – a frequent target of suspected Russia-linked hybrid attacks.
“Many of those detained on sabotage-related charges from 2023 to 2025 were Ukrainian nationals – a development interpreted not as evidence of Ukrainian coordination but as part of a deliberate Russian strategy to exploit the presence of Ukrainian migrants, with the aim of provoking public distrust and political tension,” it said.
Be the first to get Breaking News
Install the Sky News app for free
One of the most recent examples of hostile action that the Polish authorities have attributed to Russian intelligence is an explosion in November 2025 on a railway line that provides a key route to transport aid to Ukraine.
Officials reported that two Ukrainian nationals suspected of involvement fled to Belarus, while several others were detained.
The Polish prime minister described the incident as an “unprecedented act of sabotage”.
