Radio “Free Europe” in a lead article analyzes who are the people carrying out acts of violence in several European countries. REL further writes about who the people are that carry out these acts in European countries, from Poland, Germany and France, Albania all the way to Great Britain? It is mainly about “ordinary people,” explains Rekawek from the International Centre for Counter-Terrorism. “Or perhaps not so ordinary, because sometimes it involves former criminals, people from extremist circles or football hooligans,” he adds.
Types of “single-use” agents
Until recently, Russian covert operations in Europe were carried out mainly by intelligence officers, explain a GLOBSEC and International Centre for Counter-Terrorism study.
The study also emphasizes that Russia began to expand its hybrid campaign in Europe after the annexation of Crimea in 2014. From the explosion of 50 tons of munitions stored in the Czech Republic, to the attempted coup in Montenegro and the attempt to kill former Russian double agent Sergei Skripal in England, after which Russian diplomats were expelled. According to the study on hybrid warfare, published last year, around 600 Russian operatives have been expelled from Europe since 2018.
“And, undoubtedly, you no longer have these people in local communities, you don’t have them on the ground. Therefore, these activities must be carried out online,” explains Kacper Rekawek, adding that the desire to earn money and knowledge of the Russian language play a role in their recruitment.
People who tomorrow may transport parcels, set fires, or simply paste posters and make graffiti, are found in places where they seek work, on websites and on Telegram. It also happens, explains Rekawek, that a person is recruited who then must recruit others.
What is happening with the recruitment of “ordinary people” for incidents across Europe resembles what the so-called Islamic State (IS) did about a decade ago, says the Polish researcher.
“Because ten years ago we were talking about how IS used friends and family to recruit people into its network. Exactly this is happening now,” says Rekawek. Something similar happened in the case of the 2024 fire at a warehouse in London, where aid for Ukraine was stored.
According to British prosecutors, the fire was organized by the Wagner group, specifically Dylan Earl, who voluntarily contacted the group via Telegram and offered his help. He then recruited other men in Britain to organize and carry out the attack. For this attack, they were sentenced last year to a total of 29 years in prison, while the fire organized on behalf of Russia caused damage of nearly one million pounds.
Several fires were also set in Poland. Thus, in April 2024, a shop selling equipment was burned, while Polish prosecutors stated that the attack was carried out on behalf of Russian intelligence services.
How many attacks have been carried out by “single-use” agents?
According to Czech Foreign Minister Jan Lipavsky, more than 100 “suspicious incidents” that can be attributed to Russia were recorded in 2024 alone.
Since early 2022, when Russia launched its invasion of Ukraine, until the beginning of 2026, GLOBSEC researchers have recorded more than 150 incidents linked to Russia. Rekawek says the number is now close to 180.
In addition, in Germany alone, 320 attempted possible sabotage operations were recorded last year. However, as GLOBSEC emphasizes, clearly determining responsibility remains a challenge, as perpetrators are rarely identified. Russia regularly denies accusations that it employs “disposable” agents to carry out incidents across Europe…. Further, REL clarifies that although “disposable” agents operate across Europe, most attacks have been recorded in Poland. Behind it come France, Lithuania, Germany, Albania and the United Kingdom.
“To this end, they were found through acquaintances, through recruitment and maintaining contacts via Telegram, offering rewards and being paid in cryptocurrency,” Lithuanian prosecutors stated.
According to Eurojust data, the investigation that involved Germany, Lithuania, Poland, the Netherlands and the United Kingdom identified a total of 22 suspected persons in Lithuania and Poland, who are suspected of acting in the interest of Russian military intelligence.
Several cases are currently in court. Among them is the case of Aleksandar Bezrukavj, a Russian citizen extradited to Poland from Bosnia and Herzegovina.
According to the indictment, which Radio Free Europe obtained from the Warsaw Court, Bezrukavj was part of a group and had special responsibility for preparing test shipments to the United States and Canada.
Arrest warrants have currently been issued internationally for five of them, including Alexander Casianin, who holds dual Russian and Moldovan citizenship.
The case involving the Moldovan citizen is also being investigated in France, over vandalism and graffiti against Ukraine. Iurie Manic was arrested in Romania, but was allowed to await trial at liberty, after France did not take him into custody within the set deadline.
In France, he faces up to five years in prison, because in the summer of 2024 he recruited other Moldovans to paint graffiti depicting coffins with the message “French soldiers in Ukraine.”
In most cases, the motive of the individuals also called “disposable” agents is money and, less often, pro-Russian views. However, as Rekawek adds, we do not know what people who engage for payment think.
For example, a study by the International Centre for Counter-Terrorism identifies 172 individuals who took part in these incidents across Europe. Of them, 95 percent are ordinary citizens with no connection to Russian security agencies. Their motive is making money and, sometimes, pro-Russian sympathy, the study states.
As Rekawek explains, in the case of persons recruited in Serbia, “little goodwill” is required, but in any case it is about money.
“I don’t know to what extent there has been any ideological connection,” Rekawek adds. “If you are a Russian intelligence service and want to recruit people for tasks of this level, it is easier to do this in Belgrade than, for example, in Tallinn, Helsinki or Warsaw. I suppose this plays a role, but I would still say that the decisive factor is money.”
Payments range from seven euros to 10,000 euros, the study has shown. The amount increases depending on the risk. “For graffiti or posters, a few euros can be earned, while arson or sabotage can bring thousands of euros,” the study “Crime as a Tool of Hybrid Warfare in Europe” states.
In the case of the group that, on the orders of Russian intelligence, incited unrest in France and Germany, the Supreme Court judgment in Smederevo, which Radio Free Europe journalists have reviewed, states that, in addition to covering travel expenses – including renting vehicles, buying bus and plane tickets, and accommodation in hotels – group members were promised payment for each “job” carried out: 500, 1,000 or 1,500 euros.
The judgment against the convicted person in Subotica, who had agreed to transport a drone for payment, showed that he was to receive 500 euros. According to the judgment, which Radio Free Europe has reviewed, the convicted person had managed to transport the equipment to the designated location.
Espionage, a category of its own
While investigations and trials continue for dozens and hundreds of cases of various types of attacks recorded in European cities, researcher Kacper Rekawek says there is “no final victory” against “disposable” agents.
“You can hinder the networks by interfering with their communications. But if Russia really wants to recruit someone for a low-level task, it will do so.”
What can be done is to limit these campaigns, to slow them down.
In their report, GLOBSEC and the International Centre for Counter-Terrorism recommend a series of measures for national governments and EU institutions, aimed at strengthening Europe’s resilience. These include preventing recruitment, limiting incentives for organized crime and strengthening institutional resilience, REL writes, among other things.