Russian intelligence is running a covert sabotage campaign in Europe using remotely recruited operatives hired online to conduct arson and propaganda to destabilize Western support for Ukraine and sow insecurity.

Military & Paramilitary OperationsUnconventional / ParamilitaryProxy forces, militias, mercenaries (e.g. Wagner-type groups)

Aggressor

Summary

This article reveals an ongoing campaign by Russian intelligence services to conduct sabotage, arson, and disinformation operations across multiple European countries. The operations are conducted through online recruitment of operatives, often hired via Telegram and paid in cryptocurrency, to carry out violent but piecemeal actions such as arson attacks on civilian infrastructure and distribution of propaganda. The campaign targets various European states including Poland, Lithuania, Estonia, Britain, and France, with incidents ranging from shopping mall fires in Warsaw and Vilnius, arson attacks on Ukraine-linked businesses in London, to symbolic acts like placing coffins under the Eiffel Tower in Paris. Recruits are frequently marginalized individuals or refugees who may be unaware that they serve Moscow's interests, motivated primarily by money or blackmail rather than ideology. The operations are directed remotely by GRU officers using fake identities; operatives are disposable, left to face consequences alone if caught. The sabotage wave reflects an evolution from earlier GRU Unit 29155 operations which were more targeted and brazen; now the aim is broader psychological impact to sow discord and insecurity. A notable thwarted plot involved mailing explosive parcels to the US. The campaign exhibits challenges in attribution due to its indirect and covert nature, but Western intelligence maintains strong suspicions of Moscow’s involvement.

Classification

Confidence: High

The article draws on multiple sources including court documents, intelligence official interviews, and investigative journalism. It details ongoing covert operations with direct attribution to Russian intelligence services, specifically GRU, involving hostile sabotage activities in Europe.

Source URL

https://theguardian.com/world/ng-interactive/2025/may/04/these-people-are-disposable-how-russia-is-using-online-recruits-for-a-campaign-of-sabotage-in-europe

Open source

Provenance

Publisher: extension
Submitted: May 19, 2026, 09:27 UTC
Last updated: Nov 8, 2026, 19:09 UTC
Event time: Jan 27, 2024, 00:00 UTC

Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "6aebe355-51fa-44a6-96fa-2f3ef167c3f4",
  "url": "https://theguardian.com/world/ng-interactive/2025/may/04/these-people-are-disposable-how-russia-is-using-online-recruits-for-a-campaign-of-sabotage-in-europe",
  "source": "extension",
  "status": "approved",
  "category": "Military & Paramilitary Operations",
  "subcategory": "Unconventional / Paramilitary",
  "incident_type": "Proxy forces, militias, mercenaries (e.g. Wagner-type groups)",
  "country": "Poland",
  "source_reliability": "C",
  "info_credibility": "3",
  "tags": [
    "Russia",
    "GRU",
    "Sabotage",
    "Arson",
    "european union",
    "Hybrid Warfare",
    "Telegram",
    "Cryptocurrency",
    "Unit 29155",
    "Psychological Warfare",
    "russia–ukraine war"
  ],
  "nodes": [],
  "countries": [
    "Poland"
  ],
  "where_text": "Land",
  "headline": null,
  "description": "This article reveals an ongoing campaign by Russian intelligence services to conduct sabotage, arson, and disinformation operations across multiple European countries. The operations are conducted through online recruitment of operatives, often hired via Telegram and paid in cryptocurrency, to carry out violent but piecemeal actions such as arson attacks on civilian infrastructure and distribution of propaganda. The campaign targets various European states including Poland, Lithuania, Estonia, Britain, and France, with incidents ranging from shopping mall fires in Warsaw and Vilnius, arson attacks on Ukraine-linked businesses in London, to symbolic acts like placing coffins under the Eiffel Tower in Paris. Recruits are frequently marginalized individuals or refugees who may be unaware that they serve Moscow's interests, motivated primarily by money or blackmail rather than ideology. The operations are directed remotely by GRU officers using fake identities; operatives are disposable, left to face consequences alone if caught. The sabotage wave reflects an evolution from earlier GRU Unit 29155 operations which were more targeted and brazen; now the aim is broader psychological impact to sow discord and insecurity. A notable thwarted plot involved mailing explosive parcels to the US. The campaign exhibits challenges in attribution due to its indirect and covert nature, but Western intelligence maintains strong suspicions of Moscow’s involvement.",
  "summary_short": "Russian intelligence is running a covert sabotage campaign in Europe using remotely recruited operatives hired online to conduct arson and propaganda to destabilize Western support for Ukraine and sow insecurity.",
  "summary_extended": null,
  "actor_primary": "GRU military intelligence",
  "target_primary": null,
  "location_text": "Wrocław",
  "location_region": "Lower Silesian Voivodeship",
  "location_coordinates_lat": 51.107885,
  "location_coordinates_lon": 17.038538,
  "location_precision": "Approximate",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The article draws on multiple sources including court documents, intelligence official interviews, and investigative journalism. It details ongoing covert operations with direct attribution to Russian intelligence services, specifically GRU, involving hostile sabotage activities in Europe.",
  "event_time_utc": "2024-01-27T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "pm24h",
  "created_at": "2026-05-19T09:27:00.499Z",
  "updated_at": "2026-11-08T19:09:53.933Z",
  "reliability_band": "strong",
  "location_precision_band": "approximate",
  "time_precision_band": "within_24h",
  "severity_band": "moderate",
  "attribution_confidence_band": "high",
  "attribution_basis": "single_source"
}

Public assessmentReliability: StrongSeverity: ModerateAttribution: HighSingle sourceTime: Same dayLocation: Approximate

Source reliability

Info credibility

Event time

Jan 27, 2024, 00:00 UTC

Event time confidence

pm24h

Location

Wrocław

Region

Lower Silesian Voivodeship

Primary actor

GRU military intelligence

Country

Poland

Countries

Poland

Tags

Russia, GRU, Sabotage, Arson, european union, Hybrid Warfare, Telegram, Cryptocurrency, Unit 29155, Psychological Warfare, russia–ukraine war

Loading signal...

{ "id": "6aebe355-51fa-44a6-96fa-2f3ef167c3f4", "url": "https://theguardian.com/world/ng-interactive/2025/may/04/these-people-are-disposable-how-russia-is-using-online-recruits-for-a-campaign-of-sabotage-in-europe", "source": "extension", "status": "approved", "category": "Military & Paramilitary Operations", "subcategory": "Unconventional / Paramilitary", "incident_type": "Proxy forces, militias, mercenaries (e.g. Wagner-type groups)", "country": "Poland", "source_reliability": "C", "info_credibility": "3", "tags": [ "Russia", "GRU", "Sabotage", "Arson", "european union", "Hybrid Warfare", "Telegram", "Cryptocurrency", "Unit 29155", "Psychological Warfare", "russia–ukraine war" ], "nodes": [], "countries": [ "Poland" ], "where_text": "Land", "headline": null, "description": "This article reveals an ongoing campaign by Russian intelligence services to conduct sabotage, arson, and disinformation operations across multiple European countries. The operations are conducted through online recruitment of operatives, often hired via Telegram and paid in cryptocurrency, to carry out violent but piecemeal actions such as arson attacks on civilian infrastructure and distribution of propaganda. The campaign targets various European states including Poland, Lithuania, Estonia, Britain, and France, with incidents ranging from shopping mall fires in Warsaw and Vilnius, arson attacks on Ukraine-linked businesses in London, to symbolic acts like placing coffins under the Eiffel Tower in Paris. Recruits are frequently marginalized individuals or refugees who may be unaware that they serve Moscow's interests, motivated primarily by money or blackmail rather than ideology. The operations are directed remotely by GRU officers using fake identities; operatives are disposable, left to face consequences alone if caught. The sabotage wave reflects an evolution from earlier GRU Unit 29155 operations which were more targeted and brazen; now the aim is broader psychological impact to sow discord and insecurity. A notable thwarted plot involved mailing explosive parcels to the US. The campaign exhibits challenges in attribution due to its indirect and covert nature, but Western intelligence maintains strong suspicions of Moscow’s involvement.", "summary_short": "Russian intelligence is running a covert sabotage campaign in Europe using remotely recruited operatives hired online to conduct arson and propaganda to destabilize Western support for Ukraine and sow insecurity.", "summary_extended": null, "actor_primary": "GRU military intelligence", "target_primary": null, "location_text": "Wrocław", "location_region": "Lower Silesian Voivodeship", "location_coordinates_lat": 51.107885, "location_coordinates_lon": 17.038538, "location_precision": "Approximate", "is_aggressor_signal": true, "signal_type": "HYBRID_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "The article draws on multiple sources including court documents, intelligence official interviews, and investigative journalism. It details ongoing covert operations with direct attribution to Russian intelligence services, specifically GRU, involving hostile sabotage activities in Europe.", "event_time_utc": "2024-01-27T00:00:00.000Z", "end_time_utc": null, "event_time_confidence": "pm24h", "created_at": "2026-05-19T09:27:00.499Z", "updated_at": "2026-11-08T19:09:53.933Z", "reliability_band": "strong", "location_precision_band": "approximate", "time_precision_band": "within_24h", "severity_band": "moderate", "attribution_confidence_band": "high", "attribution_basis": "single_source" }