Radio “Europa e Lirë” in a lead article analyzes who is carrying out acts of violence in several European countries. REL further writes that but who are the people carrying out these acts in European countries, from Poland, Germany and France to Great Britain? It is mainly about “ordinary people”, explains Rekawek. “Or perhaps not so ordinary, because sometimes we are talking about former criminals, people from extremist circles or football hooligans,” he adds.
Types of “disposable” agents
Until recently, Russian covert operations in Europe were carried out mainly by intelligence officers, explain a study by GLOBSEC and the International Center for Counter-Terrorism.
The study also emphasizes that Russia began to expand its hybrid campaign in Europe after the annexation of Crimea in 2014. From the explosion of 50 tons of stored ammunition in Czechia, to the attempted coup in Montenegro and the attempt to kill former Russian double agent Sergei Skripal in England, after which Russian diplomats were expelled. According to the study on hybrid warfare, published last year, around 600 Russian operatives have been expelled from Europe since 2018.
“And, undoubtedly, you no longer have these people in local communities, you don’t have them on the ground. Therefore, these activities must be carried out online,” explains Kacper Rekawek, adding that the desire to earn money and knowledge of the Russian language play a role in their recruitment.
People who tomorrow may transport parcels, set fires, or simply stick posters and make graffiti, are found in places where they seek work, on websites and on Telegram. It also happens, explains Rekawek, that a person is recruited who then must recruit others.
What is happening with the recruitment of “ordinary people” for incidents across Europe resembles what the so-called Islamic State (IS) did about a decade ago, says the Polish researcher.
“Because ten years ago we were talking about how IS used friends and family to recruit people into its network. Exactly this is happening now,” says Rekawek. Something similar happened in the 2024 fire at a warehouse in London, where aid for Ukraine was stored.
According to the British prosecution, the fire was organized by the Wagner group, specifically Dylan Earl, who voluntarily contacted the group via Telegram and offered his help. He then recruited other men in Britain to organize and carry out the attack. For this attack, they were sentenced last year to a total of 29 years in prison, while the fire organized on behalf of Russia caused damage of nearly one million pounds.
Several fires were also set in Poland. Thus, in April 2024, a shop selling equipment was burned, while Polish prosecutors stated that the attack was carried out on behalf of Russian intelligence services.
How many attacks have been carried out by “disposable” agents?
According to Czech Foreign Minister Jan Lipavsky, more than 100 “suspicious incidents” that can be attributed to Russia were recorded in 2024 alone.
Since early 2022, when Russia launched its full-scale invasion of Ukraine, until the beginning of 2026, GLOBSEC researchers have recorded more than 150 incidents linked to Russia. Rekawek says the number is now close to 180.
In addition, in Germany alone, 320 suspected sabotage attempts were recorded last year. However, as GLOBSEC emphasizes, clearly attributing responsibility remains a challenge, as the perpetrators are rarely identified. Russia regularly denies accusations that it employs “disposable” agents to carry out incidents across Europe…. Furthermore, RFE/RL explains that although “disposable” agents operate across Europe, most attacks have been recorded in Poland. It is followed by France, Lithuania, Germany, Albania and the United Kingdom.
“For this purpose, they were found through acquaintances, through recruitment and maintaining contacts via Telegram, offering rewards and being paid in cryptocurrency,” Lithuanian prosecutors stated.
According to Eurojust, the investigation that involved Germany, Lithuania, Poland, the Netherlands and the United Kingdom identified a total of 22 suspected persons in Lithuania and Poland, who are suspected of acting in the interest of Russian military intelligence.
Several cases are currently in court. Among them is the case of Aleksander Bezrukavi, a Russian citizen extradited to Poland from Bosnia and Herzegovina.
According to the indictment, which Radio Free Europe obtained from the Warsaw Court, Bezrukavi was part of a group and had special responsibility for preparing test shipments to the United States and Canada.
International arrest warrants have been issued for five of them, including Alexander Casian, who holds dual Russian and Moldovan citizenship.
The case involving the Moldovan citizen is also being investigated in France, for vandalism and graffiti against Ukraine. Iurie Manic was arrested in Romania but was allowed to remain at liberty pending trial after France did not take him into custody within the set deadline.
In France, he faces up to five years in prison, as during the summer of 2024 he recruited other Moldovans to paint graffiti depicting coffins bearing the message “French soldiers in Ukraine.”
In most cases, the motive of those also called “disposable” agents is money and, less often, pro-Russian views. However, as Rekawek adds, we do not know what people who take on such work for payment think.
For example, a study by the International Centre for Counter-Terrorism identifies 172 individuals who took part in these incidents across Europe. Of them, 95 percent are ordinary citizens with no connection to Russian security agencies. Their motive is making money and, sometimes, pro-Russian sympathy, the study states.
As Rekawek explains, in the case of people recruited from Serbia, “a little goodwill” is required, but it is still ultimately about money.
“I don’t know to what extent there has been any ideological connection,” Rekawek adds. “If you are a Russian intelligence service and want to recruit people for tasks of this level, it is easier to do so in Belgrade than, for example, in Tallinn, Helsinki or Warsaw. I suppose this plays a role, but I would still say the decisive factor is money.”
Rewards paid range from seven euros to 10,000 euros, the study has shown. The amount increases depending on the risk. “For graffiti or posters, a few euros can be earned, while arson or sabotage can bring thousands of euros,” the study “Crime as a Tool of Hybrid Warfare in Europe” states.
In the case of the group that, on the orders of Russian intelligence, incited unrest in France and Germany, the verdict of the Supreme Court in Smederevo, which RFE/RL journalists have reviewed, states that, in addition to covering travel expenses — including renting vehicles, buying bus and plane tickets and accommodation in hotels — group members were promised payment for each “job” carried out: 500, 1,000 or 1,500 euros.
The verdict against the person convicted in Subotica, who had agreed to transport a drone for payment, showed that he was to receive 500 euros. According to the verdict, which Radio Free Europe has reviewed, the convicted person had managed to transport the equipment to the designated location.
Espionage, a category of its own
While investigations and trials continue for dozens and hundreds of cases of various types of attacks recorded in European cities, researcher Kacper Rekawek says there is “no final victory” against “disposable” agents.
“You can hinder the networks by interfering with their communications. But if Russia really wants to recruit someone for a low-level task, it will do so.”
What can be done is to limit these campaigns and slow them down.
In their report, GLOBSEC and the International Centre for Counter-Terrorism recommend a series of measures for national governments and EU institutions, aimed at strengthening Europe’s resilience. These include preventing recruitment, limiting incentives for organized crime and strengthening institutional resilience, RFE/RL writes, among other things.