Russia has escalated a campaign of disruption across Europe involving espionage, sabotage, and cyberattacks, while European governments consider how to respond, according to sources.
Since the full-scale invasion of Ukraine in 2022, European governments have expelled hundreds of suspected Russian intelligence officers, with a Ukrainian intelligence assessment citing approximately 700 expulsions over a five-year period. These diplomatic expulsions forced Russian handlers to alter their tactics, leading to a heavy reliance on decentralized networks, criminal intermediaries, and cyber platforms.
The most consequential operational evolution involves the mass digital recruitment of disposable agents through channels like Telegram. According to the Lansing Institute, more than 20 million recruitment advertisements appeared on the messaging platform over the course of 2026. These posts typically offer payouts ranging from $1,500 to $3,000 to carry out arson, sabotage, and attacks against military equipment or critical infrastructure.
How Disposable Proxies Target European Infrastructure
Targets span across Poland, Germany, Latvia, Lithuania, and the Czech Republic. Financially vulnerable individuals, local criminals, and migrants are routinely targeted by unseen handlers who coordinate tasks via encrypted messaging apps and disburse funds through cryptocurrency transactions.
Germany, which serves as a central logistical backbone for NATO and European defense manufacturing, has emerged as a primary focus for these hostile operations. Incidents documented across the continent include reconnaissance of NATO installations, cyber intrusions, and suspected sabotage preparations directed at energy grids and transportation networks. In July 2024, an incendiary package caught fire at an airport in Leipzig, Germany, followed by similar incidents in Poland—events that security officials note are part of a broader, continuous campaign rather than isolated criminal anomalies.
European officials have warned of an imminent escalation of a Russian shadow war on the continent, noting that Russian fighter planes have veered into Polish, Lithuanian, and Estonian airspace to test reaction times. Experts argue that existing Western countermeasures remain insufficient. “Protecting critical infrastructure, strengthening intelligence services and preventing attacks are essential, but deterrence is about more than preventing the next incident,” said Olena Tregub, cofounder and head of Ukraine’s Independent Anti-Corruption Commission, pointing out that Moscow does not yet view the financial or diplomatic costs of these shadow operations as sufficiently high.
The Strategic Dilemma Facing NATO and Washington
The overarching objective of these hybrid operations is twofold: to diminish Western political will for supporting Kyiv and to systematically degrade NATO readiness. By employing deniable criminal proxies, Moscow creates deliberate ambiguities that delay diplomatic responses and complicate collective retaliation among European Union and NATO members.
Meanwhile, political divisions within the Western alliance complicate unified defense planning. The Kyiv Independent noted that the United States withdrew its financial and military support in January 2025 and cast doubt on the future dependability of its satellite assets. With Washington stepping back, European capitals are left shouldering a larger share of regional defense obligations while facing domestic economic pressures and grinding stalemates on the Ukrainian frontlines.
| Operational Metric | Reported Scope / Data Point | Primary Context |
|---|---|---|
| Diplomatic Expulsions | ~700 suspected intelligence personnel | Documented over a five-year window following the 2022 invasion |
| Digital Recruitment | 20 million+ Telegram advertisements | Recorded throughout 2026, offering bounties for sabotage |
| Direct Financial Bounties | $1,500 to $3,000 per task | Paid via cryptocurrency to decentralized local agents |
Intelligence sharing and infrastructure hardening continue to improve, yet establishing an effective deterrence framework requires imposing concrete economic and strategic costs that alter Moscow’s calculus before lower-level disruptions metastasize into open regional conflict.
