Investigators identify key coordinators behind Russian sabotage in Europe but ‘Lucky Strike’ remains a phantom

Investigators from WDR, NDR, and Süddeutsche Zeitung have reconstructed operations of a Telegram-based Russian sabotage network in Europe involving so-called "disposable agents." While Russia-linked actors like Mikhail M. and Aleksey K. are known to have coordinated espionage and sabotage activities in Poland and other countries, the central coordinator known as "Lucky Strike" remains unidentified. "Lucky Strike" is linked to sabotage attempts across multiple countries, including a warehouse fire in London in March 2024 destroying Starlink components destined for Ukraine and a foiled refinery attack in Poland. Telegram chats show "Lucky Strike" recruiting saboteurs, offering payments from $4,000 to $5,000 for arson attacks and demanding photographic proof. Two recruited agents, Dylan E. in London and Serhij S. in Poland, were arrested and sentenced to lengthy prison terms. Western security services interpret this Telegram recruitment method as a new Russian espionage tactic to conduct plausible deniability operations without official ties. German and Lithuanian intelligence warn Moscow is increasing risky operations while aiming for more coordinated sabotage in future. The Russian embassy denies knowledge of the conspiracies. Security services have disabled relevant Telegram accounts and groups. The case exemplifies hybrid warfare tactics involving covert sabotage, remote recruitment, and proxies to destabilize European allies in the context of the Ukraine war.