In 2022-23, Russian agents planned an operation targeting Ukrainian personnel training on Patriot missile systems at a US military base in Germany. Their strategy involved using an IMSI catcher to track Ukrainian crews once they returned to Ukraine, enabling attacks by drones and missiles aimed at killing the crews and damaging Patriot defense systems. Following the 2022 invasion of Ukraine, Russia expanded the use of proxy operatives abroad, recruiting foreigners and low-level criminals paid often in cryptocurrency. One such network conducted arson on a London warehouse shipping Starlink equipment to Ukraine. Russia utilizes proxies pragmatically, maintaining loyalty primarily to trained agents by attempting long-term prisoner swaps, while proxies are considered expendable.

In 2022-23, Russian agents planned an operation targeting Ukrainian personnel training on Patriot missile systems at a US military base in Germany. Their strategy involved using an IMSI catcher to track Ukrainian crews once they returned to Ukraine, enabling attacks by drones and missiles aimed at killing the crews and damaging Patriot defense systems. Following the 2022 invasion of Ukraine, Russia expanded the use of proxy operatives abroad, recruiting foreigners and low-level criminals paid often in cryptocurrency. One such network conducted arson on a London warehouse shipping Starlink equipment to Ukraine. Russia utilizes proxies pragmatically, maintaining loyalty primarily to trained agents by attempting long-term prisoner swaps, while proxies are considered expendable.