{
  "id": "04891627-6cc4-4284-bdfa-ee0584aa94ac",
  "url": "https://theguardian.com/world/ng-interactive/2025/may/04/these-people-are-disposable-how-russia-is-using-online-recruits-for-a-campaign-of-sabotage-in-europe?CMP=Share_iOSApp_Other",
  "source": "extension",
  "status": "approved",
  "category": "Military & Paramilitary Operations",
  "subcategory": "Unconventional / Paramilitary",
  "incident_type": "Proxy forces, militias, mercenaries (e.g. Wagner-type groups)",
  "country": "Poland",
  "source_reliability": "A",
  "info_credibility": "3",
  "tags": [
    "Russia",
    "GRU",
    "Sabotage",
    "Arson",
    "Hybrid warfare",
    "Telegram recruitment",
    "Cryptocurrency payments",
    "Poland",
    "Wrocław",
    "russia–ukraine war",
    "GRU Unit 29155",
    "Disinformation",
    "5th Column",
    "Proxy operatives"
  ],
  "nodes": [
    "Node 1: Borders",
    "Node 2: 5th Column"
  ],
  "countries": [],
  "where_text": "Land",
  "headline": "Russia uses online recruits for a campaign of sabotage across Europe",
  "description": "Since 2023, Russian intelligence services have conducted a campaign of sabotage, arson, and disinformation across Europe using online-recruited operatives paid in cryptocurrency. These recruits, often unaware of working for Moscow, are directed remotely from Russia to target shopping malls, industrial centers, and civilian infrastructure in countries including Poland, Lithuania, Britain, France, and Estonia. Polish security detained a Ukrainian refugee named Serhiy S in Wrocław in late January 2024, arresting him before he could carry out an arson attack ordered by a supposed Kyiv businessman 'Alexei,' later identified as a GRU officer. The sabotage campaign escalated after Russia’s 2022 full-scale invasion of Ukraine and today involves one-time operatives discarded if captured, contrasting prior use of trained GRU unit 29155 operatives. Recent activities include suspicious fires, arson attacks on Ukraine-linked businesses, anti-NATO propaganda, and covert surveillance targeting humanitarian and military logistics. Western officials remain wary of further escalation and ambiguity surrounding the limits Russia might cross.",
  "summary_short": "Russian intelligence remotely recruits online operatives across Europe for arson and sabotage, including a thwarted 2024 Polish attack, marking a new hybrid warfare front.",
  "summary_extended": "Moscow’s intelligence services have launched a diffuse campaign of sabotage and arson in Europe since 2023, recruiting mainly through Telegram and paying in cryptocurrency. Operatives like Serhiy S, a Ukrainian refugee arrested in Wrocław in January 2024 before executing an arson attack, illustrate the modus operandi whereby GRU controllers remain in Russia while directing these foot soldiers. Targets vary from shopping centers and warehouses to Ukraine-supporting businesses, and activities include posting anti-NATO propaganda and installing surveillance cameras on military supply routes. This tactic follows older sabotage doctrines of Soviet-era agencies and the more focused operations by GRU unit 29155, now hampered by diplomatic expulsions. The campaign aims to sow insecurity and discord by targeting soft civilian infrastructure rather than high-value assets. Recent suspicious fires and sabotage incidents in Lithuania, Poland, Estonia, France, and the UK are attributed to this offensive. Western intelligence fears escalation amid uncertain Kremlin oversight and warns of continued risks as the Ukraine war persists.",
  "actor_primary": "GRU officer 'Alexei'",
  "target_primary": null,
  "location_text": "Wrocław, Poland",
  "location_region": null,
  "location_coordinates_lat": 51.1079,
  "location_coordinates_lon": 17.0385,
  "location_precision": "Approximate",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The article provides detailed, explicit descriptions of Russian GRU-directed sabotage operations using online recruits across multiple European countries, with named suspects, dates, and methods, establishing clear aggressor activity.",
  "event_time_utc": "2025-01-27T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "exact",
  "created_at": "2026-04-03T07:38:00.061Z",
  "updated_at": "2026-11-07T17:55:58.562Z",
  "reliability_band": "strong",
  "location_precision_band": "approximate",
  "time_precision_band": "exact",
  "severity_band": "moderate",
  "attribution_confidence_band": "high",
  "attribution_basis": "single_source"
}

{
  "id": "04891627-6cc4-4284-bdfa-ee0584aa94ac",
  "url": "https://theguardian.com/world/ng-interactive/2025/may/04/these-people-are-disposable-how-russia-is-using-online-recruits-for-a-campaign-of-sabotage-in-europe?CMP=Share_iOSApp_Other",
  "source": "extension",
  "status": "approved",
  "category": "Military & Paramilitary Operations",
  "subcategory": "Unconventional / Paramilitary",
  "incident_type": "Proxy forces, militias, mercenaries (e.g. Wagner-type groups)",
  "country": "Poland",
  "source_reliability": "A",
  "info_credibility": "3",
  "tags": [
    "Russia",
    "GRU",
    "Sabotage",
    "Arson",
    "Hybrid warfare",
    "Telegram recruitment",
    "Cryptocurrency payments",
    "Poland",
    "Wrocław",
    "russia–ukraine war",
    "GRU Unit 29155",
    "Disinformation",
    "5th Column",
    "Proxy operatives"
  ],
  "nodes": [
    "Node 1: Borders",
    "Node 2: 5th Column"
  ],
  "countries": [],
  "where_text": "Land",
  "headline": "Russia uses online recruits for a campaign of sabotage across Europe",
  "description": "Since 2023, Russian intelligence services have conducted a campaign of sabotage, arson, and disinformation across Europe using online-recruited operatives paid in cryptocurrency. These recruits, often unaware of working for Moscow, are directed remotely from Russia to target shopping malls, industrial centers, and civilian infrastructure in countries including Poland, Lithuania, Britain, France, and Estonia. Polish security detained a Ukrainian refugee named Serhiy S in Wrocław in late January 2024, arresting him before he could carry out an arson attack ordered by a supposed Kyiv businessman 'Alexei,' later identified as a GRU officer. The sabotage campaign escalated after Russia’s 2022 full-scale invasion of Ukraine and today involves one-time operatives discarded if captured, contrasting prior use of trained GRU unit 29155 operatives. Recent activities include suspicious fires, arson attacks on Ukraine-linked businesses, anti-NATO propaganda, and covert surveillance targeting humanitarian and military logistics. Western officials remain wary of further escalation and ambiguity surrounding the limits Russia might cross.",
  "summary_short": "Russian intelligence remotely recruits online operatives across Europe for arson and sabotage, including a thwarted 2024 Polish attack, marking a new hybrid warfare front.",
  "summary_extended": "Moscow’s intelligence services have launched a diffuse campaign of sabotage and arson in Europe since 2023, recruiting mainly through Telegram and paying in cryptocurrency. Operatives like Serhiy S, a Ukrainian refugee arrested in Wrocław in January 2024 before executing an arson attack, illustrate the modus operandi whereby GRU controllers remain in Russia while directing these foot soldiers. Targets vary from shopping centers and warehouses to Ukraine-supporting businesses, and activities include posting anti-NATO propaganda and installing surveillance cameras on military supply routes. This tactic follows older sabotage doctrines of Soviet-era agencies and the more focused operations by GRU unit 29155, now hampered by diplomatic expulsions. The campaign aims to sow insecurity and discord by targeting soft civilian infrastructure rather than high-value assets. Recent suspicious fires and sabotage incidents in Lithuania, Poland, Estonia, France, and the UK are attributed to this offensive. Western intelligence fears escalation amid uncertain Kremlin oversight and warns of continued risks as the Ukraine war persists.",
  "actor_primary": "GRU officer 'Alexei'",
  "target_primary": null,
  "location_text": "Wrocław, Poland",
  "location_region": null,
  "location_coordinates_lat": 51.1079,
  "location_coordinates_lon": 17.0385,
  "location_precision": "Approximate",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The article provides detailed, explicit descriptions of Russian GRU-directed sabotage operations using online recruits across multiple European countries, with named suspects, dates, and methods, establishing clear aggressor activity.",
  "event_time_utc": "2025-01-27T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "exact",
  "created_at": "2026-04-03T07:38:00.061Z",
  "updated_at": "2026-11-07T17:55:58.562Z",
  "reliability_band": "strong",
  "location_precision_band": "approximate",
  "time_precision_band": "exact",
  "severity_band": "moderate",
  "attribution_confidence_band": "high",
  "attribution_basis": "single_source"
}