Russia’s €500 Sabotage Market

For somewhere between $500 and $7,000, a person in an EU country can be hired to set fire to a NATO vehicle, photograph a military convoy, or daub a Ukrainian memorial with vandalism designed to start an argument. The approach comes through a throwaway Telegram account. The proof of work is a video or a set of photographs. The money moves in cryptocurrency. Then the account disappears (Cybernews).

That is the market described by the Poland-based Vot Tak outlet, and it is not just an online fantasy. Criminal cases across several countries now show the same pattern: the people giving the orders stay out of sight, while the person carrying them out is cheap, local and disposable.

The Polish proof

Poland has produced the clearest evidence that this system can work. An 18-year-old Ukrainian national, identified as Ilya K., faces 47 charges linked to alleged sabotage activity between November 2024 and August 2025 (WP, RMF24). Poland's ABW, its internal security agency, and the National Prosecutor's Office say the tasks included desecrating memorials in ways likely to inflame Polish-Ukrainian tensions, and preparing a drone flight over the president's motorcade.

The charge sheet matters, but the method matters more. Instructions allegedly arrived through an online messenger. Photos were sent back as proof. Payment came through cryptocurrency routed via exchanges registered in Russia and China. Prosecutors say the accused also recruited others for further jobs. This was not the image of a trained intelligence officer operating under cover. It was a teenager paid to act as one small part of a larger machine.

Disposable agents, multiple countries

German officials have settled on a phrase for these recruits: Wegwerf-Agenten, disposable agents. They are cheap, replaceable locals hired for one-off jobs: watch a road, test a fence, prepare an arson attack. German security officials describe Russia-linked sabotage, espionage and disinformation as pressure kept deliberately below the level of open military attack (Zeit). In Stuttgart, three alleged disposable agents are accused of probing transport routes for parcel bombs (Tagesschau).

The Netherlands exposed a different weakness altogether, and it did not require a human recruit. Dutch intelligence agencies AIVD and MIVD assessed that Russian state hackers compromised IP cameras along military logistics routes to monitor defence deliveries to Ukraine (NL Times, Defensiebond). Default passwords and outdated firmware turned civilian devices into surveillance infrastructure. No Telegram handler, no cryptocurrency payment, just neglected cameras doing the work for free.

The gap between national borders

The pattern is cross-border. The prosecution is not. A single sabotage chain can involve a recruiter using a Telegram account tied to an Indian phone number, a target in Latvia, payments through Asian exchanges, and related investigations in Poland or Germany. Each country sees part of the operation. None automatically sees the whole thing.

That is not an accident in the EU system. Article 4(2) of the EU treaty reserves national security to member states. Intelligence services, arrests and prosecutions remain national powers. Brussels can press platforms under the Digital Services Act, the EU rulebook for online intermediaries. It can coordinate policing through Europol and harmonise parts of criminal law. It cannot run counter-intelligence operations or prosecute sabotage across the Union.

The European Parliament's Democracy Shield committee has named Russia as a primary threat and called for stronger tools against hybrid attacks, tighter platform accountability and action on cryptocurrency loopholes (European Parliament). Those are recommendations, not operational powers. The committee cannot investigate, arrest or charge anyone.

Telegram sits in the middle of the argument. French judges have again questioned founder Pavel Durov over alleged complicity linked to criminal misuse of the service (Le Figaro). In Britain, Ofcom contacted Telegram after a convicted arsonist allegedly received instructions from a Russia-linked account on the platform (Guardian). Telegram says cooperation depends on properly submitted judicial requests. That answer is procedurally tidy, but it also shows the weakness: enforcement still moves at the speed of national paperwork.

The wider Vot Tak investigation claims millions of sabotage-related posts spread through short-lived accounts. That figure comes from investigative journalism, not court records. Nobody has yet published a clear breakdown of how many posts led to real attacks, how many were scams, and how many may have been law-enforcement traps.

What is already clear is enough to worry interior ministries from Warsaw to Dublin. The recruitment method works. The payments move. The targets are real. The people behind these operations have found a structural gap: recruitment is European, but enforcement remains national. Closing that gap without turning every platform argument into a surveillance argument is now a job for national governments and the Commission's DSA enforcers. So far, neither has given a convincing answer.