Russian military intelligence has increased hybrid warfare sabotage campaigns across Europe, recruiting disposable agents for attacks including arson, bombings, and reconnaissance in UK, Poland, Lithuania, and Latvia.

Military & Paramilitary OperationsUnconventional / ParamilitaryProxy forces, militias, mercenaries (e.g. Wagner-type groups)

AggressorDefense

Summary

A report by the RUSI think tank exposes a significant rise in Russian hybrid warfare sabotage operations across NATO countries since the invasion of Ukraine, with Russia recruiting 'disposable agents' many from Ukraine and other European countries to perform acts ranging from graffiti to murder. These agents are paid between £10 for minor vandalism to £7,000 for murder. Recent attacks include arson at Poland's largest shopping centre, explosions on a critical Poland-Ukraine rail link, sabotage of electrical infrastructure in the UK, booby-trapped parcels in Germany, and the downing of a DHL cargo plane in Lithuania. Recruitment occurs remotely via encrypted platforms such as Telegram and Viber, demonstrating a shift to a 'gig-economy era' of sabotage that is cost-effective and deniable. The campaign aims to disrupt support for Ukraine and test NATO's red lines, with at least 110 incidents linked to Russia since 2022. The UK Ministry of Defence emphasizes increasing defence spending and investment in drone and counter-drone systems to prepare for high-intensity conflicts expected in Europe.

Classification

Confidence: High

The article explicitly describes the increase in Russian military intelligence-led sabotage attacks across Europe, targeting NATO allies via proxy disposable agents (aggressor activity). It also details UK government responses to increase defence spending and enhance military readiness, especially in drone and counter-drone systems, supporting defense preparation classification.

Source URL

https://thesun.co.uk/news/37904025/putins-payments-russian-sabotage-agents-uk-europe-revealed

Open source

Provenance

Publisher: extension
Submitted: Feb 1, 2026, 00:14 UTC
Last updated: Nov 4, 2026, 08:35 UTC
Event time: Jan 14, 2026, 00:00 UTC

Published as a Defense Preparations signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "dd84bc80-93b1-443f-ac80-a49faf74f8e8",
  "url": "https://thesun.co.uk/news/37904025/putins-payments-russian-sabotage-agents-uk-europe-revealed",
  "source": "extension",
  "status": "approved",
  "category": "Military & Paramilitary Operations",
  "subcategory": "Unconventional / Paramilitary",
  "incident_type": "Proxy forces, militias, mercenaries (e.g. Wagner-type groups)",
  "country": "United Kingdom",
  "source_reliability": "C",
  "info_credibility": "3",
  "tags": [
    "Russian sabotage",
    "hybrid warfare",
    "RUSI report",
    "disposable agents",
    "NATO allies",
    "Poland",
    "Lithuania",
    "Latvia",
    "United Kingdom",
    "cyber recruitment",
    "Telegram",
    "encrypted communications",
    "arson",
    "railway sabotage",
    "drone warfare",
    "military intelligence",
    "russia–ukraine war"
  ],
  "nodes": [
    "Node 1: Borders"
  ],
  "countries": [],
  "where_text": "Land",
  "headline": null,
  "description": "Russian military intelligence has intensified a sabotage campaign across Europe using remotely recruited 'disposable agents' who conduct low- to high-level attacks including graffiti, reconnaissance, arson, bombings, and murder. Payments vary by task complexity, with major operations like murder fetching up to £7,000. Recent incidents include a major arson attempt at a Warsaw shopping centre, sabotage of a strategic Poland-Ukraine railway in November 2025, the downing of a DHL plane near Vilnius, and establishment of booby-trapped parcels in Germany. Recruitment leverages encrypted messaging apps, enabling deniable and distributed sabotage activities. The goal appears to be increasing the cost of Western support for Ukraine and probing NATO's limits. The UK government acknowledges a defence spending shortfall but aims to bolster drone capabilities and military readiness.",
  "summary_short": "Russian military intelligence has increased hybrid warfare sabotage campaigns across Europe, recruiting disposable agents for attacks including arson, bombings, and reconnaissance in UK, Poland, Lithuania, and Latvia.",
  "summary_extended": "A report by the RUSI think tank exposes a significant rise in Russian hybrid warfare sabotage operations across NATO countries since the invasion of Ukraine, with Russia recruiting 'disposable agents' many from Ukraine and other European countries to perform acts ranging from graffiti to murder. These agents are paid between £10 for minor vandalism to £7,000 for murder. Recent attacks include arson at Poland's largest shopping centre, explosions on a critical Poland-Ukraine rail link, sabotage of electrical infrastructure in the UK, booby-trapped parcels in Germany, and the downing of a DHL cargo plane in Lithuania. Recruitment occurs remotely via encrypted platforms such as Telegram and Viber, demonstrating a shift to a 'gig-economy era' of sabotage that is cost-effective and deniable. The campaign aims to disrupt support for Ukraine and test NATO's red lines, with at least 110 incidents linked to Russia since 2022. The UK Ministry of Defence emphasizes increasing defence spending and investment in drone and counter-drone systems to prepare for high-intensity conflicts expected in Europe.",
  "actor_primary": "Russian military intelligence",
  "target_primary": null,
  "location_text": "UK, Poland, Lithuania, Latvia, France, Germany, London, Warsaw, Vilnius, Rivne",
  "location_region": null,
  "location_coordinates_lat": null,
  "location_coordinates_lon": null,
  "location_precision": "Regional",
  "is_aggressor_signal": true,
  "signal_type": "DEFENSE_PREP_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The article explicitly describes the increase in Russian military intelligence-led sabotage attacks across Europe, targeting NATO allies via proxy disposable agents (aggressor activity). It also details UK government responses to increase defence spending and enhance military readiness, especially in drone and counter-drone systems, supporting defense preparation classification.",
  "event_time_utc": "2026-01-14T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "unknown",
  "created_at": "2026-02-01T00:14:48.519Z",
  "updated_at": "2026-11-04T08:35:32.139Z",
  "reliability_band": "strong",
  "location_precision_band": "regional",
  "time_precision_band": "unknown",
  "severity_band": "moderate",
  "attribution_confidence_band": "high",
  "attribution_basis": "single_source"
}

Public assessmentReliability: StrongSeverity: ModerateAttribution: HighSingle sourceTime: UnknownLocation: Regional

Source reliability

Info credibility

Event time

Jan 14, 2026, 00:00 UTC

Event time confidence

unknown

Location

UK, Poland, Lithuania, Latvia, France, Germany, London, Warsaw, Vilnius, Rivne

Primary actor

Russian military intelligence

Country

United Kingdom

Tags

Russian sabotage, hybrid warfare, RUSI report, disposable agents, NATO allies, Poland, Lithuania, Latvia, United Kingdom, cyber recruitment, Telegram, encrypted communications, arson, railway sabotage, drone warfare, military intelligence, russia–ukraine war

Nodes

Node 1: Borders

Loading signal...

{ "id": "dd84bc80-93b1-443f-ac80-a49faf74f8e8", "url": "https://thesun.co.uk/news/37904025/putins-payments-russian-sabotage-agents-uk-europe-revealed", "source": "extension", "status": "approved", "category": "Military & Paramilitary Operations", "subcategory": "Unconventional / Paramilitary", "incident_type": "Proxy forces, militias, mercenaries (e.g. Wagner-type groups)", "country": "United Kingdom", "source_reliability": "C", "info_credibility": "3", "tags": [ "Russian sabotage", "hybrid warfare", "RUSI report", "disposable agents", "NATO allies", "Poland", "Lithuania", "Latvia", "United Kingdom", "cyber recruitment", "Telegram", "encrypted communications", "arson", "railway sabotage", "drone warfare", "military intelligence", "russia–ukraine war" ], "nodes": [ "Node 1: Borders" ], "countries": [], "where_text": "Land", "headline": null, "description": "Russian military intelligence has intensified a sabotage campaign across Europe using remotely recruited 'disposable agents' who conduct low- to high-level attacks including graffiti, reconnaissance, arson, bombings, and murder. Payments vary by task complexity, with major operations like murder fetching up to £7,000. Recent incidents include a major arson attempt at a Warsaw shopping centre, sabotage of a strategic Poland-Ukraine railway in November 2025, the downing of a DHL plane near Vilnius, and establishment of booby-trapped parcels in Germany. Recruitment leverages encrypted messaging apps, enabling deniable and distributed sabotage activities. The goal appears to be increasing the cost of Western support for Ukraine and probing NATO's limits. The UK government acknowledges a defence spending shortfall but aims to bolster drone capabilities and military readiness.", "summary_short": "Russian military intelligence has increased hybrid warfare sabotage campaigns across Europe, recruiting disposable agents for attacks including arson, bombings, and reconnaissance in UK, Poland, Lithuania, and Latvia.", "summary_extended": "A report by the RUSI think tank exposes a significant rise in Russian hybrid warfare sabotage operations across NATO countries since the invasion of Ukraine, with Russia recruiting 'disposable agents' many from Ukraine and other European countries to perform acts ranging from graffiti to murder. These agents are paid between £10 for minor vandalism to £7,000 for murder. Recent attacks include arson at Poland's largest shopping centre, explosions on a critical Poland-Ukraine rail link, sabotage of electrical infrastructure in the UK, booby-trapped parcels in Germany, and the downing of a DHL cargo plane in Lithuania. Recruitment occurs remotely via encrypted platforms such as Telegram and Viber, demonstrating a shift to a 'gig-economy era' of sabotage that is cost-effective and deniable. The campaign aims to disrupt support for Ukraine and test NATO's red lines, with at least 110 incidents linked to Russia since 2022. The UK Ministry of Defence emphasizes increasing defence spending and investment in drone and counter-drone systems to prepare for high-intensity conflicts expected in Europe.", "actor_primary": "Russian military intelligence", "target_primary": null, "location_text": "UK, Poland, Lithuania, Latvia, France, Germany, London, Warsaw, Vilnius, Rivne", "location_region": null, "location_coordinates_lat": null, "location_coordinates_lon": null, "location_precision": "Regional", "is_aggressor_signal": true, "signal_type": "DEFENSE_PREP_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "The article explicitly describes the increase in Russian military intelligence-led sabotage attacks across Europe, targeting NATO allies via proxy disposable agents (aggressor activity). It also details UK government responses to increase defence spending and enhance military readiness, especially in drone and counter-drone systems, supporting defense preparation classification.", "event_time_utc": "2026-01-14T00:00:00.000Z", "end_time_utc": null, "event_time_confidence": "unknown", "created_at": "2026-02-01T00:14:48.519Z", "updated_at": "2026-11-04T08:35:32.139Z", "reliability_band": "strong", "location_precision_band": "regional", "time_precision_band": "unknown", "severity_band": "moderate", "attribution_confidence_band": "high", "attribution_basis": "single_source" }