Allied Intelligence — 2026-08-28

Czech BIS Reports Russian One-Time Agents Still Threaten Sabotage Against Ukraine Aid Suppliers

BLUFGRU reliance on disposable, low-skill recruits targeting Ukraine aid logistics creates a persistent detection gap that conventional counterintelligence screening struggles to close before an attack materializes.

The Czech Security Information Service (BIS) said in its 2025 annual report, published Thursday, that Russia continues to direct so-called one-time agents toward sabotage attacks focused primarily on facilities involved in producing or distributing aid to Ukraine 12. BIS described these agents as typically inexperienced, low-status individuals with possible criminal backgrounds, recruited through Telegram groups targeting Russian- and Ukrainian-speakers that post hundreds of thousands of times a year, motivated by money, and disavowed by Russia if caught 23. Agents are instructed to photograph or film their attacks for propaganda material portraying Europe as "literally and figuratively in flames," intended to spread fear and undercut support for aiding Ukraine 2. The agency reported that sabotage operations organized from Russia declined in the first half of 2025 but rose again in the second half, and said none of last year's investigated Czech security incidents has been reliably confirmed as Russian-coordinated 24. BIS identified Russia's GRU military intelligence service as the dominant actor behind the sabotage campaign 24.

Analysis
BIS's disclosure functions as an early-warning baseline rather than confirmation of an active plot, since no 2025 incident under investigation has been reliably tied to Russian coordination despite a documented recruitment and tasking apparatus. The GRU's organizing role, paired with sabotage activity declining early in 2025 before rising again in the second half, indicates Moscow calibrates operational tempo to battlefield and political conditions rather than running a fixed campaign. The low-cost recruit model creates a detection gap BIS ties directly to anticipating attacks before they occur. Reporting traces to a single origin, BIS's own report, with ČTK carrying the primary domestic account and other outlets amplifying without independent corroboration. The absence of confirmed incidents may reflect BIS's screening and attribution limits as much as the true scale of Russian sabotage activity.

5 sources

Intelligence service: One-time agents directed by Russia still threat to Czechia - Radio Prague International
BIS: V Česku přetrvává riziko využití agentů k sabotážím řízeným z Ruska - ČeskéNoviny.cz (ČTK)
Russia may use disposable agents for sabotage in the Czech Republic: facilities providing aid to Ukraine under threat - UNN
Fresh wave of Russian-linked threats hits Czechia online and off - Expats.cz
Výroční zpráva Bezpečnostní informační služby za rok 2025 - BIS (Bezpečnostní informační služba / Czech Security Information Service)