Several Europeans recruited by Russia had set fire to a shopping centre. Some were in their 20s, and all were paid in cryptocurrency.
This story is no longer unusual.
Two days after the incident in Warsaw, Paris woke up to the same reality. Red hands were graffitied on a wall at the Holocaust Memorial. While it may sound harmless, this was a calculated Russian operation to sow division among French society.
The graffiti echoed the infamous image of bloodied hands displayed by one of the attackers after the lynching of two Israeli reservists in Ramallah in 2000, an image that has since become widely associated with antisemitism.
A year later, three Bulgarian men were found guilty of carrying out the graffiti attack. The youngest, aged 28, said it was a decision made during a heavy night of drinking.
The eldest, 42, claimed he just wanted “to help a long-time friend”. The third, a 36-year-old with Nazi tattoos, said he did it for the money (and that his tattoos have nothing to do with it).
Meet Russia's sabotage network
Behind these people is a broader state operation that has expanded since Russia’s full-scale invasion of Ukraine. The Kremlin recruits ordinary people across Europe to perform low-level operations of sabotage, spying, and disrupting social cohesion.
As a report by the Polish outlet Defence24 shows, Russian intelligence services “exploit third-country nationals, diaspora communities, and networks of intermediaries, thereby blurring operational responsibility and hindering counterintelligence responses”.
“I find it concerning how easy it is for a state like Russia to find citizens of our countries who are willing to work for an opponent of ours in return for some money”, Bar Schuurman, professor of terrorism and political violence at Leiden University, told us.
His research found that Russia mostly targets men in their mid-30s. Most of them come from Moldovan, Ukrainian, and Bulgarian communities, although recruits are drawn from all over the world: Schuurman identified 28 nationalities among those involved, including Latvian, Dutch, Polish, and German citizens.
Their motivations vary. Some are ideologically sympathetic to Russia, while others are attracted by the prospect of easy money. In 26% of the cases analysed, the agent had a criminal record. About one in six are recruited from right-wing extremist pools.
Still, targeted individuals differ by country, according to Aleksandr Olech, editor-in-chief of Defence24.
“In Poland and the Baltic States, the focus tends to be on individuals embedded locally, often with access to institutions, infrastructure, or information ecosystems,” he told us.
”In Western Europe, especially in France, there is a visible emphasis on exploiting polarisation – for example, reaching out to groups that feel politically or socially marginalised, including segments of younger Muslim communities,” he continued.
How they get you
Russian recruiters rely on digital platforms, especially Telegram, to connect with potential agents abroad.
Contact can be very direct, especially when some degree of affinity is already established: this was the case in Italy in 2024, when an entrepreneur contacted the Russian Federal Security Service FSB (the country's main internal intelligence and security agency) via Telegram, saying he “wanted to collaborate in the name of peace.”
Russian intelligence officers then asked him to map video-surveillance systems in Milan, install dashcams on taxis, collect pictures of military sites, and establish safe houses for Russian citizens.
Together with a business partner, he received the equivalent of €2,000 in cryptocurrency as an advance payment before starting the operation, which Italian authorities immediately shut down.
This modus operandi is widespread. A Belgian journalist reported last year that he was initially offered USD 50 in cryptocurrency to place 10 stickers in Brussels’ EU quarter.
He described how an apparent bot allocated him more tasks, such as identifying pro-Ukrainian accounts online and compiling the email addresses of 30 Belgian journalists. Telegram removed the pro-Russian hacking channel he had been using after the report was published.
However, recruitment is not always organised through one-to-one contact. Telegram channels can also connect large networks of sympathisers and facilitate crowdfunding.
One example is “Operation Z”, a Telegram channel run by the pro-Russian outlet Russian Spring.
Alongside pro-Kremlin narratives about the war in Ukraine, the channel calls for donations to buy weapons and dual-use equipment for Russian soldiers.
An investigation published last January traced more than 13,000 transactions worth tens of millions of dollars moving through the channel, often in cryptocurrency.
Soldiers at the front regularly send videos thanking supporters and showing the items they bought with their donations. The channel gathers users from all across the EU: Bulgaria, Germany, Italy, the UK and Serbia.
Telegram has stepped up its takedown of accounts over the past year and has been accepting more requests from authorities to remove material, since its CEO Pavel Durov was detained in France in 2024 over the platform’s alleged links to criminal activity.
While Telegram seems to be linked to most recruitment operations, Schuurman’s research suggests that recruiters also use WhatsApp, TikTok, Facebook, and phone calls.
Personal connections remain important. “Most of them are recruited through channels like Telegram, but there's also quite a pronounced recruitment through interpersonal contacts,” Schuurman said. “We see cases of people recruiting their comrades from the armed forces, or simply someone's housemate”.
The larger war
The goal is to sow division or target infrastructure. In October 2023, Stars of David were spray-painted on buildings and synagogues across Paris. Less than a month after the red-hands incident empty coffins draped in French flags and bearing the inscription “Ukraine’s French soldiers” were found beneath the Arc de Triomphe. In May 2025, green paint was thrown at synagogues, and in September, pig heads were left outside several mosques.
With both antisemitic and islamophobic acts at record levels in France, which has Europe's largest Jewish population and a large Muslim population, these acts sent shock waves through the country.
All are suspected, as the judge found in the red-hands case, to be “acts coordinated from abroad to disturb public opinion and play on preexisting divides and fracture French society just a little bit more.”
These operations “exist in a grey space,” said Kate O’Riordan, a researcher at the Brussels Institute for Geopolitics.
“Probably the strategic objective is to generate chaos, to radicalise public opinion, to sow seeds of distrust,” she said. “Single incidents can be brushed off, but when there’s a huge network and it’s happening on a large scale, everyone should be a lot more worried.”
Low-level sabotage is hard to track, and EU governments still struggle to assess the full scale of the threat.
Last week, European Commission president Ursula von der Leyen called for a clear European response to what she described as “hybrid situations.” She also suggested testing counter-drone and early-warning systems to identify potential gaps.
“Unfortunately, today hybrid and cyberattacks, foreign interference, and disinformation are appearing regularly,” von der Leyen said. “Deterrence is the best strategy to preserve peace. So let us stay vigilant.”
On the digital front, EU leaders have urged online platforms to do more to combat foreign information manipulation and interference campaigns.
They have also asked the Commission to use its tech law, the Digital Services Act, which can impose big fines, to hold online platforms accountable.
EU’s defence commissioner Andrius Kubilius went further. In a speech in February, he called for EU monitoring of online platforms to detect and stop hybrid threats at an early stage. “Russia uses a wide variety of hybrid warfare elements exactly to undermine our political will to fight,” he said. ”It is cheaper to mobilise algorithms than to mobilise armies.”
Europe cannot stop Russia from recruiting agents through Telegram, said Jacek Raubo, a Polish defence and security expert and journalist at Defence24. Instead, authorities should adopt a similar approach to the FBI, which details its operations to the public.
“We need more transparency by showing the modus operandi. We need to be more open to people in the everyday public.”