Investigation: Russia Runs Large-Scale Recruitment Network Across EU for Attacks on NATO Vehicles and Ukrainian Sites

A Russian network of recruiters that used Telegram to find people to carry out sabotage operations in Ukraine has expanded its activities, now recruiting individuals to conduct similar attacks in European Union countries.

According to an investigation by the Vot Tak outlet, the network is offering potential operatives between $1,500 and $3,000 to set fire to NATO military equipment, Ukrainian organizations, and critical infrastructure sites.

In spring 2026, the network began actively recruiting operatives in EU countries. According to journalists, the recruiters disguise their activities as offers for “easy side jobs” or “simple technical work” with “stable pay” and a “flexible schedule.”

In Poland, journalists were offered assignments to set fire to vehicles with Ukrainian license plates, locomotives, mobile communication base stations, and Ukrainian aid collection centers.

Some assignments offered payments of up to $3,000. In another case, a recruiter instructed a potential operative to first gather information about Ukrainian organizations, humanitarian aid collection points, and volunteer recruitment centers. After the target was approved, the person was told to set the building on fire and record the entire incident on video using the Timestamp Camera app. The recruiter also promised $3,000 for this task.

In Latvia, journalists were offered $3,000 to set fire to the office of the “Viche” Confederation of Ukrainian Communities in Riga. The recruiter provided photos of the building and video footage from an earlier reconnaissance of the location.

A payment of $1,500 was offered for setting fire to a NATO vehicle, with an additional $500 for video evidence allegedly showing the launch of Ukrainian drones from Lithuanian territory. Notably, just four days after this conversation, Russia’s Foreign Intelligence Service claimed that Ukraine was preparing to launch drones from the territory of the Baltic states.

Another contact, operating in the Czech Republic, was interested in purchasing electric igniters that could be used as components of improvised explosive devices.

According to the investigation, a month after this conversation, a defense facility in Pardubice, Czech Republic, that produced drones for Ukraine was set on fire. One theory is that Russian intelligence services may have been behind the attack.

On May 12 alone, around 10,000 identical advertisements in Russian and Ukrainian were recorded on Telegram. Most of them contained the contact details of the same recruiter, who used the pseudonym Jan Pol.

After the initial contact, potential operatives are openly informed that the work is illegal. They are then sent a detailed “price list” with payment rates for carrying out sabotage operations.

According to journalists’ estimates, more than 20 million such advertisements appeared on Telegram since the beginning of 2026. Most were posted by disposable accounts registered using phone numbers from India, Iran, and Arab countries.

A separate network was also operating, purchasing old Telegram accounts to post recruitment advertisements. The ads were distributed not only in the Russian- and Ukrainian-language segments of Telegram, but also in groups for users from Poland, Germany, the United States, the UAE, Thailand, and more than 20 other countries.

Militarnyi previously reported that on July 7, 2026, two people were detained at the Serbia–Hungary border who, according to preliminary information, were preparing a sabotage operation in Germany on behalf of Russian intelligence services.