Loading signal...
Signal
Submitted
Mar 11, 2026, 07:42 UTC
Finnish Security and Intelligence Service warns of Russian recruitment of Finnish proxies for sabotage activities abroad in 2025, with serious legal consequences for participants.
In 2025, Russian sabotage linked to state actors in Europe decreased compared to 2024 but continued via proxy actors recruited mainly through social media such as Telegram. The Finnish Security and Intelligence Service notes the risk of Finnish citizens being recruited, especially individuals with criminal or disadvantaged backgrounds or pro-Russian sympathies. Recruitment involves intermediary layers to conceal Russian intelligence links, offering small paid tasks escalating from minor graffiti to arson. Proxy saboteurs operate internationally, sometimes crossing European borders. Russian military intelligence (GRU) supervises these operations closely. Evidence such as video recordings is required for payments. Western security services quickly investigate sabotage, increasing risk of apprehension for proxies, who are considered disposable by Russia and receive no support if caught. Punishments abroad include long prison sentences for offenses like foreign state benefit or terrorism, and Finnish authorities have limited consular assistance abilities. Finland has not been a direct target of sabotage yet, but the threat persists.
Confidence: High
The event clearly describes Russian intelligence recruiting Finnish nationals as proxies for sabotage abroad, detailing operational methods and legal consequences. This constitutes hostile aggressor activity. No specific defense preparation actions are described.
Source URL
https://supo.fi/en/how-to-recruit-a-saboteur
Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.
{
"id": "b9633c7a-4d48-4425-95fc-0673479066f8",
"url": "https://supo.fi/en/how-to-recruit-a-saboteur",
"source": "extension",
"status": "approved",
"category": "Military & Paramilitary Operations",
"subcategory": "Unconventional / Paramilitary",
"incident_type": "Proxy forces, militias, mercenaries (e.g. Wagner-type groups)",
"country": "Finland",
"source_reliability": "A",
"info_credibility": "3",
"tags": [
"Russian sabotage",
"proxy recruitment",
"russian intelligence operations",
"GRU",
"Finland",
"influencing activities",
"vandalism",
"arson",
"Telegram",
"counterintelligence",
"foreign proxies"
],
"nodes": [
"Node 2: 5th Column"
],
"countries": [],
"where_text": "Land",
"headline": "Finnish Security and Intelligence Service warns of Russian proxy recruitment of Finnish saboteurs abroad",
"description": "The Finnish Security and Intelligence Service (Supo) has observed a risk of Finnish citizens being recruited for Russian influencing activities abroad, particularly as proxy saboteurs. In 2025, Russian sabotage activities targeting Europe decreased compared to 2024 but still included acts like arson, graffiti, and posters, mainly orchestrated by Russian military intelligence (GRU) using proxy actors recruited via social media platforms such as Telegram. These proxies, often unaware of the illegality or their recruiters' identities, perform acts ranging from small-scale vandalism to arson under strict Russian intelligence supervision. Finnish citizens may be recruited, often those with criminal or disadvantaged backgrounds or pro-Russian attitudes, and could be sent abroad to participate in sabotage. The recruitment process includes initial small tasks to test reliability, provision of detailed instructions, permissions for actions, and filming of sabotage acts to provide evidence for payment. Western intelligence promptly investigates such acts, with proxies considered disposable by Russia and left without support if caught. Perpetrators face serious criminal charges abroad, including offenses benefiting a foreign state or terrorism, with potential prison sentences and limited consular support.",
"summary_short": "Finnish Security and Intelligence Service warns of Russian recruitment of Finnish proxies for sabotage activities abroad in 2025, with serious legal consequences for participants.",
"summary_extended": "In 2025, Russian sabotage linked to state actors in Europe decreased compared to 2024 but continued via proxy actors recruited mainly through social media such as Telegram. The Finnish Security and Intelligence Service notes the risk of Finnish citizens being recruited, especially individuals with criminal or disadvantaged backgrounds or pro-Russian sympathies. Recruitment involves intermediary layers to conceal Russian intelligence links, offering small paid tasks escalating from minor graffiti to arson. Proxy saboteurs operate internationally, sometimes crossing European borders. Russian military intelligence (GRU) supervises these operations closely. Evidence such as video recordings is required for payments. Western security services quickly investigate sabotage, increasing risk of apprehension for proxies, who are considered disposable by Russia and receive no support if caught. Punishments abroad include long prison sentences for offenses like foreign state benefit or terrorism, and Finnish authorities have limited consular assistance abilities. Finland has not been a direct target of sabotage yet, but the threat persists.",
"actor_primary": "Russian intelligence services",
"target_primary": null,
"location_text": "Finland",
"location_region": null,
"location_coordinates_lat": 61.92411,
"location_coordinates_lon": 25.748151,
"location_precision": "Regional",
"is_aggressor_signal": true,
"signal_type": "HYBRID_SIGNAL",
"is_hybrid_war_signal": true,
"classification_complete": true,
"hybrid_signal_complete": true,
"classification_confidence": "High",
"classification_rationale": "The event clearly describes Russian intelligence recruiting Finnish nationals as proxies for sabotage abroad, detailing operational methods and legal consequences. This constitutes hostile aggressor activity. No specific defense preparation actions are described.",
"event_time_utc": "2025-01-01T00:00:00.000Z",
"end_time_utc": null,
"event_time_confidence": "pm24h",
"created_at": "2026-03-11T07:42:00.198Z",
"updated_at": "2026-11-10T02:44:05.780Z",
"reliability_band": "strong",
"location_precision_band": "regional",
"time_precision_band": "within_24h",
"severity_band": "moderate",
"attribution_confidence_band": "high",
"attribution_basis": "independent_sources"
}Source reliability
A
Info credibility
3
Event time
Jan 1, 2025, 00:00 UTC
Event time confidence
pm24h
Location
Finland
Primary actor
Russian intelligence services
Country
Finland
Tags
Russian sabotage, proxy recruitment, russian intelligence operations, GRU, Finland, influencing activities, vandalism, arson, Telegram, counterintelligence, foreign proxies
Nodes
Node 2: 5th Column
Signal
Submitted
Mar 11, 2026, 07:42 UTC
Finnish Security and Intelligence Service warns of Russian recruitment of Finnish proxies for sabotage activities abroad in 2025, with serious legal consequences for participants.
In 2025, Russian sabotage linked to state actors in Europe decreased compared to 2024 but continued via proxy actors recruited mainly through social media such as Telegram. The Finnish Security and Intelligence Service notes the risk of Finnish citizens being recruited, especially individuals with criminal or disadvantaged backgrounds or pro-Russian sympathies. Recruitment involves intermediary layers to conceal Russian intelligence links, offering small paid tasks escalating from minor graffiti to arson. Proxy saboteurs operate internationally, sometimes crossing European borders. Russian military intelligence (GRU) supervises these operations closely. Evidence such as video recordings is required for payments. Western security services quickly investigate sabotage, increasing risk of apprehension for proxies, who are considered disposable by Russia and receive no support if caught. Punishments abroad include long prison sentences for offenses like foreign state benefit or terrorism, and Finnish authorities have limited consular assistance abilities. Finland has not been a direct target of sabotage yet, but the threat persists.
Confidence: High
The event clearly describes Russian intelligence recruiting Finnish nationals as proxies for sabotage abroad, detailing operational methods and legal consequences. This constitutes hostile aggressor activity. No specific defense preparation actions are described.
Source URL
https://supo.fi/en/how-to-recruit-a-saboteur
Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.
{
"id": "b9633c7a-4d48-4425-95fc-0673479066f8",
"url": "https://supo.fi/en/how-to-recruit-a-saboteur",
"source": "extension",
"status": "approved",
"category": "Military & Paramilitary Operations",
"subcategory": "Unconventional / Paramilitary",
"incident_type": "Proxy forces, militias, mercenaries (e.g. Wagner-type groups)",
"country": "Finland",
"source_reliability": "A",
"info_credibility": "3",
"tags": [
"Russian sabotage",
"proxy recruitment",
"russian intelligence operations",
"GRU",
"Finland",
"influencing activities",
"vandalism",
"arson",
"Telegram",
"counterintelligence",
"foreign proxies"
],
"nodes": [
"Node 2: 5th Column"
],
"countries": [],
"where_text": "Land",
"headline": "Finnish Security and Intelligence Service warns of Russian proxy recruitment of Finnish saboteurs abroad",
"description": "The Finnish Security and Intelligence Service (Supo) has observed a risk of Finnish citizens being recruited for Russian influencing activities abroad, particularly as proxy saboteurs. In 2025, Russian sabotage activities targeting Europe decreased compared to 2024 but still included acts like arson, graffiti, and posters, mainly orchestrated by Russian military intelligence (GRU) using proxy actors recruited via social media platforms such as Telegram. These proxies, often unaware of the illegality or their recruiters' identities, perform acts ranging from small-scale vandalism to arson under strict Russian intelligence supervision. Finnish citizens may be recruited, often those with criminal or disadvantaged backgrounds or pro-Russian attitudes, and could be sent abroad to participate in sabotage. The recruitment process includes initial small tasks to test reliability, provision of detailed instructions, permissions for actions, and filming of sabotage acts to provide evidence for payment. Western intelligence promptly investigates such acts, with proxies considered disposable by Russia and left without support if caught. Perpetrators face serious criminal charges abroad, including offenses benefiting a foreign state or terrorism, with potential prison sentences and limited consular support.",
"summary_short": "Finnish Security and Intelligence Service warns of Russian recruitment of Finnish proxies for sabotage activities abroad in 2025, with serious legal consequences for participants.",
"summary_extended": "In 2025, Russian sabotage linked to state actors in Europe decreased compared to 2024 but continued via proxy actors recruited mainly through social media such as Telegram. The Finnish Security and Intelligence Service notes the risk of Finnish citizens being recruited, especially individuals with criminal or disadvantaged backgrounds or pro-Russian sympathies. Recruitment involves intermediary layers to conceal Russian intelligence links, offering small paid tasks escalating from minor graffiti to arson. Proxy saboteurs operate internationally, sometimes crossing European borders. Russian military intelligence (GRU) supervises these operations closely. Evidence such as video recordings is required for payments. Western security services quickly investigate sabotage, increasing risk of apprehension for proxies, who are considered disposable by Russia and receive no support if caught. Punishments abroad include long prison sentences for offenses like foreign state benefit or terrorism, and Finnish authorities have limited consular assistance abilities. Finland has not been a direct target of sabotage yet, but the threat persists.",
"actor_primary": "Russian intelligence services",
"target_primary": null,
"location_text": "Finland",
"location_region": null,
"location_coordinates_lat": 61.92411,
"location_coordinates_lon": 25.748151,
"location_precision": "Regional",
"is_aggressor_signal": true,
"signal_type": "HYBRID_SIGNAL",
"is_hybrid_war_signal": true,
"classification_complete": true,
"hybrid_signal_complete": true,
"classification_confidence": "High",
"classification_rationale": "The event clearly describes Russian intelligence recruiting Finnish nationals as proxies for sabotage abroad, detailing operational methods and legal consequences. This constitutes hostile aggressor activity. No specific defense preparation actions are described.",
"event_time_utc": "2025-01-01T00:00:00.000Z",
"end_time_utc": null,
"event_time_confidence": "pm24h",
"created_at": "2026-03-11T07:42:00.198Z",
"updated_at": "2026-11-10T02:44:05.780Z",
"reliability_band": "strong",
"location_precision_band": "regional",
"time_precision_band": "within_24h",
"severity_band": "moderate",
"attribution_confidence_band": "high",
"attribution_basis": "independent_sources"
}Source reliability
A
Info credibility
3
Event time
Jan 1, 2025, 00:00 UTC
Event time confidence
pm24h
Location
Finland
Primary actor
Russian intelligence services
Country
Finland
Tags
Russian sabotage, proxy recruitment, russian intelligence operations, GRU, Finland, influencing activities, vandalism, arson, Telegram, counterintelligence, foreign proxies
Nodes
Node 2: 5th Column