Adversary Intelligence — 2026-07-08

Investigation Reveals Mass Russian Telegram Recruitment of Saboteurs Across EU Countries Offering Thousands for Arson Attacks

BLUFRussia's expansion of its Telegram sabotage-for-hire network into NATO member states marks a operational shift from proxy harassment of Ukraine to direct tasking against Alliance territory and infrastructure.

An investigation by Belsat-affiliated outlet Vot Tak found Telegram-based recruiters expanding a Russia-linked sabotage network beyond Ukraine into Lithuania, Poland, Latvia, and the Czech Republic, offering journalists posing as job seekers between $500 and $7,000 for arson, reconnaissance, and intelligence-gathering tasks 12. Recruiters offered $1,500 to burn a NATO military vehicle near the Pabrade training ground in Lithuania and sought reconnaissance and video "proof" of alleged Ukrainian drone launches from Lithuanian territory, while offering $3,000 for attacks on a Ukrainian-linked site in Poland and the Riga office of the Ukrainian Confederation of Communities "Viche" in Latvia 1The Insider" data-url="https://theins.press/en/news/294544" data-otype="digital_news">3. Vot Tak counted more than 20 million ads with concealed sabotage offers posted in Russian-language job chats across over 20 countries since January, with more than 80 percent of distributing accounts tied to phone numbers from India, Iran, and Arab states rather than Ukraine 3. The Security Service of Ukraine has attributed the campaign to a Russian intelligence effort it calls "Sabotage Noise," documenting more than 1,400 commissioned crimes since 2023, including roughly 800 in 2025, while Vot Tak separately identified 25 Ukrainian sabotage convictions in 2026, 19 of which involved Telegram recruitment 3.

Analysis
The recruitment campaign's expansion beyond Ukraine into paid arson and reconnaissance taskings inside Lithuania, Poland, Latvia, and the Czech Republic signals a deliberate decision by its Russian intelligence sponsors to normalize NATO-territory targets alongside Ukrainian ones. Reliance on disposable accounts tied to Indian, Iranian, and Arab-registered phone numbers obscures attribution and complicates takedowns of the underlying Telegram infrastructure, while tasking spanning a diaspora organization's office and a NATO training-ground vehicle shows target selection covering both symbolic and physical-security objectives. Recruiters soliciting payment and "proof" videos from anonymous contacts have incentive to inflate reach and scale, so ad volume may overstate actual attacks commissioned. The account rests on a single investigation relayed by three outlets without independent verification, and host-nation services across the Baltics and Poland face growing pressure to treat anonymous "easy job" Telegram postings as an active recruitment channel rather than background criminal noise.

4 sources