Russian intelligence-linked recruiters are using encrypted chats and promises of quick money to find young people willing to carry out sabotage in Ukraine and NATO countries. The method closely resembles the digital recruitment model used by criminal gangs in Sweden.
The tasks can begin with photography, graffiti or surveillance before developing into arson and attacks on infrastructure. Danish public broadcaster DR reported that young Ukrainians in difficult financial situations are among those being approached through Telegram.
In brief:
- Main development: Russian-linked recruiters are offering young people money for sabotage and intelligence gathering.
- Recruitment channel: Telegram and other social media platforms.
- Possible tasks: Photography, graffiti, arson, surveillance and attacks on infrastructure.
- Swedish connection: The method resembles how Swedish gangs recruit minors for violent assignments.
- Current case: An 18-year-old Ukrainian is facing 47 charges in Poland over alleged work for Russian intelligence.
Russian sabotage recruitment moves online
The recruitment often takes place without a personal meeting between the organiser and the person carrying out the task.
Advertisements appear in job-seeking groups or other online channels and may initially describe the work as an easy technical assignment. Once contact moves to a private chat, the recruiter can provide a specific target, instructions and a promised payment.
An investigation reported by The Insider found offers to carry out arson and surveillance in Lithuania, Poland, Latvia and Czechia. Journalists posing as job seekers were offered $1,500 to set fire to a NATO vehicle in Lithuania and $3,000 to attack Ukrainian-linked premises in Poland or Latvia.
The requested targets also included cars, trains, communication towers and sites connected to organisations supporting Ukraine.
The recruiters normally requested photographs or video as proof that an assignment had been completed. Payment was then promised through cryptocurrency or another digital method.
The investigation found that the advertisements were often presented as “easy work” with reliable payment. Accounts used to post the offers could disappear after only a few days, making it harder to identify the people controlling the operation.
Price lists offer money for arson
A DR report reproduced in summary form described price lists circulating through Telegram for different types of vandalism and sabotage.
DR’s Ukraine and Russia correspondent Matilde Kimer said people had reported receiving lists explaining how much they could earn for individual tasks.
According to Kimer, one offer promised $7,000 for setting fire to a military recruitment office in Ukraine. She said attacks on NATO equipment in Poland could also attract significant payments.
These figures are reported offers rather than an official or fixed price list. Different recruiters may promise different amounts, and there is no guarantee that a person completing an assignment will receive the money.
Research and criminal investigations show that some recruits are initially given simple tasks. These may include taking photographs, painting graffiti or locating a particular building.
Later assignments can become more serious. In Ukraine, teenagers have been accused of setting fire to railway signalling equipment, military vehicles and recruitment offices after receiving instructions online.
A Reuters investigation found that more than 240 Ukrainian minors had been investigated or detained for offences against national security. Some said they had not understood who was directing them or the full consequences of their actions.
Method resembles Swedish gang recruitment
The recruitment system has clear similarities to the methods used by criminal networks in Sweden.
The Swedish Police Authority says gangs contact children through social media, telephone calls and encrypted chat services. Young people can be offered money to carry out serious crimes, including shootings and explosions.
Criminal networks also publish advertisements for violent assignments through applications such as Telegram and Signal. In some cases, children are told to recruit other young people.
The gangs may ask recruits to provide identity documents or personal information. This can later be used to threaten them if they refuse to complete an assignment.
Promises of payment are not always kept. Swedish police warn that children may instead face blackmail, threats or pressure against their relatives.
The Russian-linked sabotage model uses many of the same elements:
- contact through encrypted digital platforms;
- an offer of quick payment;
- a specific assignment carried out at a distance;
- photographs or video required as evidence;
- digital payments that hide the organiser’s identity;
- increasing pressure after the first task has been completed.
The similarities do not prove that Russian intelligence services directly copied Swedish gangs. They show that both state-linked organisers and criminal networks are using the same opportunities created by social media, encrypted communication and digital payments.
Polish teenager faces 47 charges
An ongoing case in Poland shows how online recruitment can be used for both sabotage and political influence.
Polish prosecutors have indicted an 18-year-old Ukrainian, named under Polish privacy rules as Illia K. He is accused of committing 47 offences between November 2024 and August 2025.
According to the charges, 45 of the offences involved painting Ukrainian nationalist slogans and symbols on buildings and memorial sites. The targets included monuments dedicated to Polish victims of massacres committed by the Ukrainian Insurgent Army during the Second World War.
Polish authorities say the aim was to increase hostility between Poles and Ukrainians and create social unrest.
Illia K. is also accused of belonging to an organised criminal group and preparing an act of sabotage involving a drone. Prosecutors say he intended to fly it over a car carrying the Polish president during a military parade in Warsaw.
He was arrested before the event took place.
Investigators allege that he received instructions online and was paid in cryptocurrency. They say he acted for financial rather than ideological reasons.
The defendant initially admitted some of the allegations but later pleaded not guilty and used his right to remain silent. The accusations have not yet been tested in a completed trial.
The Associated Press reported that Poland’s Internal Security Agency views the case as an example of Russian attempts to create conflict between Poland and Ukraine.
Young recruits can be treated as disposable
Security analysts often describe people hired for individual tasks as “disposable agents”.
They may have no formal intelligence training and may never meet the person directing them. The organiser can stop contact immediately after the assignment or after the recruit is arrested.
This model reduces the cost and risk for a foreign intelligence service. It also makes it harder for investigators to prove who ordered an individual act.
Young people may be particularly vulnerable when they are unemployed, isolated or struggling to settle in a new country. Recruiters can present the assignment as an easy way to earn money without clearly explaining that it may be classified as sabotage, espionage or terrorism.
The nationality of an alleged offender should not be used to judge a wider community. Russian operations can deliberately use Ukrainian citizens to damage public trust in Ukrainian refugees and weaken support for Ukraine.
Polish authorities say the actions attributed to Illia K. were designed to deepen an existing historical dispute between Poland and Ukraine. The alleged sabotage therefore had a wider political purpose beyond the physical damage caused.
Sweden faces a wider hybrid threat
Swedish authorities have not reported a campaign on the same scale as those described in Ukraine and Poland. However, the Swedish Security Service, Säkerhetspolisen, says Russia has carried out sabotage and other hybrid activities elsewhere in Europe.
The agency warns that similar actions could also take place in Sweden.
“Russia has carried out hybrid activities such as sabotage against countries in Europe. This can also happen in Sweden,” Säpo said when presenting its latest assessment of the security threat.
Säpo has investigated several suspected sabotage incidents, although those particular cases could not be linked to a foreign power.
The agency also warns against drawing conclusions too quickly after fires, technical failures or other unexplained incidents. Incorrect accusations can create fear and social tension, which may itself serve the interests of a hostile actor.
Russia’s possible goals include disrupting infrastructure, consuming police resources and weakening public support for Ukraine. Operations can also be designed to create distrust between different groups living in European countries.
Sweden’s membership of NATO, military support for Ukraine and important infrastructure in the Baltic Sea make the country a relevant target for Russian intelligence gathering and influence activities.
Swedish police list warning signs
Swedish police advise adults to pay attention when a young person suddenly begins using unfamiliar encrypted applications or becomes unusually secretive about a mobile phone.
Other possible warning signs include unexpected digital payments, cryptocurrency accounts, deleted conversations, use of a virtual private network or possession of an unknown phone.
A young person may also be asked to send a photograph of a passport or identity card. Police say this information can later be used for blackmail.
Anyone who suspects that a child is being recruited by a criminal group should contact the Swedish police on 114 14. An immediate threat or an assignment involving weapons, explosives or a planned attack should be reported through the emergency number 112.
