Sabotage for $500: Russia's disposable agents

For somewhere between $500 and $7,000, a recruiter can find someone willing to set fire to a NATO vehicle, photograph a military convoy, or vandalise a Ukrainian memorial inside the EU. The approach is simple. A disposable Telegram account posts the job. The person hired records the act as proof. Payment lands in cryptocurrency. Then the account disappears (Cybernews).

The model, exposed by the Poland-based outlet Vot Tak and visible in criminal cases across several countries, is a cheap cross-border market for sabotage. The people giving the orders stay out of sight. The person carrying out the job is treated as disposable.

The Polish proof

Poland offers the clearest evidence that this market is not theoretical. An 18-year-old Ukrainian national identified as Ilya K. faces 47 charges linked to alleged sabotage activity between November 2024 and August 2025 (WP, RMF24). Poland’s ABW, its internal security agency, and the National Prosecutor’s Office say the tasks included desecrating memorials in order to stir Polish-Ukrainian hostility and preparing a drone flight over the president’s motorcade.

The method matters more than the number of charges. Instructions arrived through an online messenger. Photos were sent back as proof. Cryptocurrency payments were allegedly routed through exchanges registered in Russia and China. Prosecutors say the accused then recruited others for further tasks. This was not the picture of a trained intelligence officer. It was a teenager working for money inside a system built to replace him the moment he became useful to police.

For Malta, the lesson is uncomfortable but familiar. A small country does not need to be the main battlefield to become part of the infrastructure. A port, a data centre, a payment route, a logistics company, or a loosely monitored online community can matter because it connects to something larger. Hybrid operations feed on these ordinary gaps.

Disposable agents, multiple countries

Germany has a term for these recruits: Wegwerf-Agenten, disposable agents. They are cheap, local and replaceable, hired for one-off tasks such as watching a route, testing a perimeter, or preparing an arson attack. German security officials describe Russia-linked sabotage, espionage and disinformation as pressure kept below the level of open military attack (Zeit). In Stuttgart, three alleged disposable agents are accused of probing transport routes for parcel bombs (Tagesschau).

The Netherlands has exposed another weakness, one that does not even require a human recruit. Dutch intelligence agencies AIVD and MIVD assessed that Russian state hackers compromised IP cameras along military logistics routes to monitor defence deliveries to Ukraine (NL Times, Defensiebond). Default passwords and outdated firmware turned civilian cameras into surveillance tools. No Telegram handler, no crypto payment, just neglected equipment doing the watching for free.

That part should sound close to home. Malta’s security debates often focus on the visible points: the airport, the Freeport, energy infrastructure, the Armed Forces, government systems. But the softer surface is wider. Private CCTV, poorly maintained devices, online groups, small contractors and payment channels can all become useful in the hands of someone looking for deniability.

The gap between national borders

The pattern crosses borders. Prosecution still largely stops at them. One sabotage chain can involve a recruiter using a Telegram account tied to an Indian phone number, a target in Latvia, payments routed through Asian exchanges, and a parallel investigation in Poland or Germany. No single country automatically sees the whole structure.

This is where the EU’s limits become visible. Under Article 4(2) of the EU treaty, national security remains the sole responsibility of each member state. Intelligence services, arrests and prosecutions stay in national hands. Brussels can pressure platforms through the Digital Services Act, the EU rulebook for online intermediaries. It can coordinate police work through Europol and align parts of criminal law. It cannot run counter-intelligence operations or prosecute sabotage across the Union.

The European Parliament’s Democracy Shield committee recently identified Russia as a primary threat and called for stronger tools against hybrid attacks, tougher platform accountability and tighter treatment of cryptocurrency loopholes (European Parliament). Those are political recommendations. The committee cannot investigate, arrest or prosecute anyone.

Telegram is now one of the pressure points. French judges have again questioned founder Pavel Durov over alleged complicity linked to criminal misuse of the service (Le Figaro). In Britain, Ofcom contacted Telegram after a convicted arsonist allegedly received instructions from a Russia-linked account on the platform (Guardian). Telegram says cooperation depends on properly submitted judicial requests. That answer points back to the same weakness: enforcement still depends on national procedure moving fast enough against networks designed to vanish.

The wider Vot Tak investigation claims millions of sabotage-related postings circulated through short-lived accounts. That figure comes from investigative journalism, not court records. No one has published a reliable breakdown of how many posts led to real attacks, how many were scams, and how many may have been law-enforcement traps.

What the evidence does show is enough. The recruitment works. The payments move. The targets are real. The attackers have found the space between national systems: recruitment across borders, enforcement inside borders. Closing that space without turning every platform debate into an argument for blanket surveillance is now a question for interior ministers and the Commission’s Digital Services Act enforcers. So far, neither has given a convincing answer.