Russia recruits "disposable agents" on Telegram for sabotage

A Telegram message offers easy money. The first task is small: photograph a building, check an access route, join a protest. Payment follows proof. If the recruit delivers, tasks escalate. Polish, German and French security services have now arrested or indicted people drawn into this pipeline. Not trained spies — ordinary people, recruited online for compartmentalised jobs they may not fully understand. The model is cheap, hard to classify early, and exposes how slowly Europe turns scattered local files into a shared sabotage picture.

Photograph first, escalate later

Poland's ABW (the domestic security agency) has produced the clearest public record. Prosecutors described arrests of a Pole and a Belarusian who photographed sites important to state security on orders from a Telegram moderator, classified as "diversion directed against Poland" (Interia). Interior Minister Tomasz Siemoniak named Warsaw, Wrocław, Kraków, Zakopane and Bydgoszcz as cities where such recruitment operated (RMF24, Radio Alex).

A separate operation paid people to join seemingly grassroots demonstrations among Ukrainian refugees. The aim was to weaponise corruption scandals and internal Ukrainian disputes, sharpening Polish-Ukrainian tensions through what looked like spontaneous protest.

Polish experts call these people "disposable agents" — drawn in through money, pressure or manipulation (Rzeczpospolita). The first act looks like vandalism or activism. The handler is testing whether the recruit can later do something more dangerous.

Same playbook across borders

Germany's BfV (the domestic intelligence service) described the same mechanism in its 2025 annual report: Russian services recruit helpers through Telegram for photography, infrastructure observation and early-stage sabotage (BR). The design blurs whether any given incident is state-directed, ordinary crime or accident. Three men were convicted for spying on rail lines connected to Ukraine support (DW, ZEIT).

France adds the sharpest single case. Near Toulouse, a Belarusian man was indicted on 5 June after technicians at Delair, a drone manufacturer, caught him filming drone tests. Investigators from the DGSI (France's domestic intelligence agency) found a 55-second video on his phone, sent to a Russian number (Le Monde). A separate Molotov-cocktail attack hit the same factory days earlier, according to Le Monde, but investigators have not publicly established a link between the detained man and the arson. The reconnaissance file is strong. The full chain from Russian tasking through filming to arson by the same person is not proven.

Who owns the problem

Latvia's VDD (state security service) has warned that young people are increasingly recruited through TikTok, Discord, Telegram and gaming platforms like Roblox (Baltija.eu). The recruitment surface is widening. The authority to act against it is not.

National security remains each member state's own responsibility under EU treaty law (TEU Article 4). National services investigate. National prosecutors charge. Europol can connect police intelligence across borders (Europol). Eurojust can bring prosecutors together, and its SIRIUS project helps them obtain the Telegram chats and account data that these cases depend on (Eurojust SIRIUS). But coordination is not command. No single EU body can run a counter-sabotage case from detection to prosecution.

The platform gap compounds the problem. Telegram is not on the Commission's list of Very Large Online Platforms under the Digital Services Act (the EU's content-governance law), so it escapes the extra systemic-risk oversight that applies to the biggest platforms (Commission VLOP list). The recruitment channel sits outside the regulatory architecture built to police exactly this kind of coordinated harm.

A sabotage recruiter operates as an EU-wide problem while every legal response starts local. Europe has coordination tools, but no single authority owns the pattern early enough. Recognition still depends on a national officer connecting a photograph of a rail yard, taken by someone who thought they were earning easy money, to the Telegram chat that ordered it.