Sabotage for $500: Europe’s disposable agents

For somewhere between $500 and $7,000, you can hire someone to burn a NATO vehicle, photograph a military convoy, or vandalize a Ukrainian memorial in an EU country. The recruiter posts from a disposable Telegram account. The hired hand films the job as proof. Payment arrives in cryptocurrency. The account vanishes (Cybernews).

That transaction, exposed by the Poland-based Vot Tak media outlet and traced through criminal cases in multiple countries, describes a cheap cross-border market for sabotage jobs. The command chain stays hidden. The executor is expendable.

The Polish proof

Poland supplies the hardest evidence that this market works. An 18-year-old Ukrainian national identified as Ilya K. faces 47 charges linked to sabotage activity between November 2024 and August 2025 (WP, RMF24). Poland's ABW (its internal security agency) and the National Prosecutor's Office say the alleged tasks included desecrating memorials to inflame Polish-Ukrainian tensions and preparing a drone flight over the president's motorcade.

The mechanics matter more than the charge sheet. Tasks arrived through an online messenger. The executor sent photos as proof of completion. Payment came via cryptocurrency routed through exchanges registered in Russia and China. The accused allegedly recruited others to do additional jobs. Not a trained intelligence operative — a teenager working for cash, plugged into a pipeline that treated him as replaceable.

Disposable agents, multiple countries

Germany has a word for these recruits: Wegwerf-Agenten, disposable agents. Cheap, replaceable locals hired for single tasks — surveil a route, test a perimeter, prep an arson. German security officials describe Russia-linked sabotage, espionage and disinformation as pressure designed to stay below the threshold of open military attack (Zeit). In Stuttgart, three alleged disposable agents face accusations of probing transport routes for parcel bombs (Tagesschau).

The Netherlands revealed a different vulnerability entirely — one that needs no human recruiter at all. Dutch intelligence agencies AIVD and MIVD assessed that Russian state hackers compromised IP cameras along military-logistics routes to watch defence deliveries to Ukraine (NL Times, Defensiebond). Default passwords and outdated firmware turned civilian cameras into surveillance infrastructure. No Telegram account, no crypto — just neglected devices doing the watching for free.

The gap between national borders

The pattern is visible across borders. Prosecution remains stuck inside them. A single sabotage chain can involve a recruiter on a Telegram account registered to an Indian phone number, a target in Latvia, payments routed through Asian exchanges, and a parallel investigation in Poland or Germany. No single country sees the full picture.

EU law keeps the hardest tools with national governments. Intelligence services, arrests and prosecutions all sit with individual member states under Article 4(2) of the EU treaty, which reserves national security as each country's sole responsibility. Brussels can pressure platforms through the Digital Services Act (its rules for online intermediaries), coordinate police through Europol, and align parts of criminal law. It cannot run counter-intelligence or prosecute sabotage across the Union.

The European Parliament's Democracy Shield committee recently named Russia as a primary threat and called for stronger tools against hybrid attacks, platform accountability and cryptocurrency loopholes (European Parliament). Those are political recommendations. The committee has no power to investigate, arrest or prosecute.

Telegram itself is a contested pressure point. French judges have again questioned founder Pavel Durov over alleged complicity related to criminal misuse of the service (Le Figaro). In Britain, regulator Ofcom contacted Telegram after a convicted arsonist allegedly received instructions from a Russia-linked account on the platform (Guardian). Telegram argues cooperation depends on properly submitted judicial requests — a response that only underlines how much enforcement still depends on national procedure.

The broader Vot Tak investigation claims millions of sabotage-related postings spread through short-lived accounts. That scale rests on investigative journalism, not court records. How many posts produced real attacks, how many were scams, how many were law-enforcement traps — nobody has published.

What the evidence does prove: the recruitment mechanics work, the payments flow, and the targets are real. The attackers have found the gap. Recruitment is cross-border, but enforcement is still national. Closing that gap without turning every platform debate into a surveillance fight is a question that national interior ministers and the Commission's DSA enforcers both owe an answer to. Neither has offered one.