{
  "id": "cec305a0-9999-4ccf-b701-6220f8545e37",
  "url": "https://tagesschau.de/investigativ/ndr-wdr/russland-sabotage-wegwerfagenten-100.html",
  "source": "extension",
  "status": "approved",
  "category": "Military & Paramilitary Operations",
  "subcategory": "Unconventional / Paramilitary",
  "incident_type": "Proxy forces, militias, mercenaries (e.g. Wagner-type groups)",
  "country": "United Kingdom",
  "source_reliability": "B",
  "info_credibility": "3",
  "tags": [
    "Russian sabotage",
    "Telegram",
    "Hybrid warfare",
    "Arson",
    "Proxy operations",
    "Espionage",
    "russia–ukraine war"
  ],
  "nodes": [
    "Node 1: Borders",
    "Node 2: 5th Column"
  ],
  "countries": [
    "United Kingdom",
    "Poland"
  ],
  "where_text": "Land",
  "headline": "Investigators identify key coordinators behind Russian sabotage in Europe but ‘Lucky Strike’ remains a phantom",
  "description": "The article details investigations by German media into Russian sabotage operations coordinated via Telegram involving a pseudonymous figure known as \"Lucky Strike.\" Several sabotage acts including arson attacks on a warehouse in London and an attempted refinery bombing in Poland are linked to this network. Investigators have identified other Russian-linked coordinators such as Mikhail M., who organized spying missions in Poland, and Aleksey K., responsible for coordinating firebomb attacks in air freight. \"Lucky Strike\" remains unidentified and possibly multiple persons behind the moniker. Telegram chats reveal recruitment of saboteurs with offers of thousands of dollars, demands for photographic evidence, and instructions to watch spy-themed media for tradecraft. Arrested agents in Poland and the UK received heavy prison sentences. Western intelligence interprets the Telegram recruitment as a new Russian hybrid warfare tactic that allows Moscow to deny involvement and maintain operational flexibility. German intelligence warns Moscow is escalating sabotage risks while trying to improve coordination. The Russian embassy denies any knowledge. The Telegram sabotage network accounts have been disabled by security services. The article includes multiple references to ongoing legal proceedings related to these sabotage acts and intelligence operations targeting allies. It highlights the evolving and covert nature of Russian hybrid threats against European infrastructure and security.",
  "summary_short": "Investigators have identified key coordinators behind Russian sabotage acts in Europe on Telegram, including coordinated arson attacks; the central figure 'Lucky Strike' remains unidentified.",
  "summary_extended": "Investigators from WDR, NDR, and Süddeutsche Zeitung have reconstructed operations of a Telegram-based Russian sabotage network in Europe involving so-called \"disposable agents.\" While Russia-linked actors like Mikhail M. and Aleksey K. are known to have coordinated espionage and sabotage activities in Poland and other countries, the central coordinator known as \"Lucky Strike\" remains unidentified. \"Lucky Strike\" is linked to sabotage attempts across multiple countries, including a warehouse fire in London in March 2024 destroying Starlink components destined for Ukraine and a foiled refinery attack in Poland. Telegram chats show \"Lucky Strike\" recruiting saboteurs, offering payments from $4,000 to $5,000 for arson attacks and demanding photographic proof. Two recruited agents, Dylan E. in London and Serhij S. in Poland, were arrested and sentenced to lengthy prison terms. Western security services interpret this Telegram recruitment method as a new Russian espionage tactic to conduct plausible deniability operations without official ties. German and Lithuanian intelligence warn Moscow is increasing risky operations while aiming for more coordinated sabotage in future. The Russian embassy denies knowledge of the conspiracies. Security services have disabled relevant Telegram accounts and groups. The case exemplifies hybrid warfare tactics involving covert sabotage, remote recruitment, and proxies to destabilize European allies in the context of the Ukraine war.",
  "actor_primary": "Lucky Strike",
  "target_primary": null,
  "location_text": "London, United Kingdom; Breslau (Wrocław), Poland",
  "location_region": null,
  "location_coordinates_lat": 51.5074,
  "location_coordinates_lon": -0.1278,
  "location_precision": "Approximate",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The article clearly describes hostile Russian-directed sabotage activities coordinated through Telegram involving physical arson attacks and espionage in European countries, implicating specific operatives and resulting in arrests and prosecutions.",
  "event_time_utc": "2024-03-20T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "pm24h",
  "created_at": "2026-04-28T13:25:36.128Z",
  "updated_at": "2026-11-10T02:44:17.154Z",
  "reliability_band": "strong",
  "location_precision_band": "approximate",
  "time_precision_band": "within_24h",
  "severity_band": "moderate",
  "attribution_confidence_band": "high",
  "attribution_basis": "single_source"
}

{
  "id": "cec305a0-9999-4ccf-b701-6220f8545e37",
  "url": "https://tagesschau.de/investigativ/ndr-wdr/russland-sabotage-wegwerfagenten-100.html",
  "source": "extension",
  "status": "approved",
  "category": "Military & Paramilitary Operations",
  "subcategory": "Unconventional / Paramilitary",
  "incident_type": "Proxy forces, militias, mercenaries (e.g. Wagner-type groups)",
  "country": "United Kingdom",
  "source_reliability": "B",
  "info_credibility": "3",
  "tags": [
    "Russian sabotage",
    "Telegram",
    "Hybrid warfare",
    "Arson",
    "Proxy operations",
    "Espionage",
    "russia–ukraine war"
  ],
  "nodes": [
    "Node 1: Borders",
    "Node 2: 5th Column"
  ],
  "countries": [
    "United Kingdom",
    "Poland"
  ],
  "where_text": "Land",
  "headline": "Investigators identify key coordinators behind Russian sabotage in Europe but ‘Lucky Strike’ remains a phantom",
  "description": "The article details investigations by German media into Russian sabotage operations coordinated via Telegram involving a pseudonymous figure known as \"Lucky Strike.\" Several sabotage acts including arson attacks on a warehouse in London and an attempted refinery bombing in Poland are linked to this network. Investigators have identified other Russian-linked coordinators such as Mikhail M., who organized spying missions in Poland, and Aleksey K., responsible for coordinating firebomb attacks in air freight. \"Lucky Strike\" remains unidentified and possibly multiple persons behind the moniker. Telegram chats reveal recruitment of saboteurs with offers of thousands of dollars, demands for photographic evidence, and instructions to watch spy-themed media for tradecraft. Arrested agents in Poland and the UK received heavy prison sentences. Western intelligence interprets the Telegram recruitment as a new Russian hybrid warfare tactic that allows Moscow to deny involvement and maintain operational flexibility. German intelligence warns Moscow is escalating sabotage risks while trying to improve coordination. The Russian embassy denies any knowledge. The Telegram sabotage network accounts have been disabled by security services. The article includes multiple references to ongoing legal proceedings related to these sabotage acts and intelligence operations targeting allies. It highlights the evolving and covert nature of Russian hybrid threats against European infrastructure and security.",
  "summary_short": "Investigators have identified key coordinators behind Russian sabotage acts in Europe on Telegram, including coordinated arson attacks; the central figure 'Lucky Strike' remains unidentified.",
  "summary_extended": "Investigators from WDR, NDR, and Süddeutsche Zeitung have reconstructed operations of a Telegram-based Russian sabotage network in Europe involving so-called \"disposable agents.\" While Russia-linked actors like Mikhail M. and Aleksey K. are known to have coordinated espionage and sabotage activities in Poland and other countries, the central coordinator known as \"Lucky Strike\" remains unidentified. \"Lucky Strike\" is linked to sabotage attempts across multiple countries, including a warehouse fire in London in March 2024 destroying Starlink components destined for Ukraine and a foiled refinery attack in Poland. Telegram chats show \"Lucky Strike\" recruiting saboteurs, offering payments from $4,000 to $5,000 for arson attacks and demanding photographic proof. Two recruited agents, Dylan E. in London and Serhij S. in Poland, were arrested and sentenced to lengthy prison terms. Western security services interpret this Telegram recruitment method as a new Russian espionage tactic to conduct plausible deniability operations without official ties. German and Lithuanian intelligence warn Moscow is increasing risky operations while aiming for more coordinated sabotage in future. The Russian embassy denies knowledge of the conspiracies. Security services have disabled relevant Telegram accounts and groups. The case exemplifies hybrid warfare tactics involving covert sabotage, remote recruitment, and proxies to destabilize European allies in the context of the Ukraine war.",
  "actor_primary": "Lucky Strike",
  "target_primary": null,
  "location_text": "London, United Kingdom; Breslau (Wrocław), Poland",
  "location_region": null,
  "location_coordinates_lat": 51.5074,
  "location_coordinates_lon": -0.1278,
  "location_precision": "Approximate",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The article clearly describes hostile Russian-directed sabotage activities coordinated through Telegram involving physical arson attacks and espionage in European countries, implicating specific operatives and resulting in arrests and prosecutions.",
  "event_time_utc": "2024-03-20T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "pm24h",
  "created_at": "2026-04-28T13:25:36.128Z",
  "updated_at": "2026-11-10T02:44:17.154Z",
  "reliability_band": "strong",
  "location_precision_band": "approximate",
  "time_precision_band": "within_24h",
  "severity_band": "moderate",
  "attribution_confidence_band": "high",
  "attribution_basis": "single_source"
}