Russian intelligence services recruiting Ukrainian refugees for sabotage operations in Europe – intelligence

Russian intelligence services are accused of organizing sabotage across Europe to intimidate people, damage important facilities, and weaken support for Ukraine. The alleged targets include railway lines, warehouses, logistics hubs, and defense industry sites. Poland has reportedly faced the largest share of known cases.

The operations often begin with simple assignments. Recruits may photograph a facility or put up stickers. Later, handlers can demand surveillance, property damage, arson, or bomb attacks. Recruits must record their actions and send the video as proof. A September fire near the Carfil SA defense plant in Brasov, Romania, illustrates the alleged pattern. Romanian intelligence linked the arson to a Russian-directed network. The suspects included one Ukrainian and two Belarusians.

The FIS says these acts form part of a wider hybrid campaign. It reports around 200 Russia-linked sabotage acts in Europe since 2022. The alleged campaign aims to create fear, disrupt security, and undermine military assistance to Ukraine.

Sabotage means deliberately damaging, disrupting, or threatening important facilities or activities to cause wider harm. It can serve political or military goals. In this article, the alleged purpose is not simply to destroy property. The FIS says Russia seeks to intimidate Europeans and undermine military assistance to Ukraine.

Ordinary vandalism or crime may involve personal motives, money, anger, or opportunism. Sabotage is different when an act is directed toward strategic targets or broader pressure. The reported examples include photographing defense sites, monitoring targets, damaging property, setting fires, and preparing bomb attacks. These actions may still be prosecuted as ordinary crimes, but their alleged coordination and purpose make them sabotage.

The distinction matters because sabotage affects more than one victim. It can force authorities to protect facilities, divert security resources, and respond to public fear. The article reports that Russian intelligence services allegedly use recruits as expendable assets in this wider campaign.

According to Ukraine’s Foreign Intelligence Service, around 200 acts of sabotage linked to Russia have been recorded across Europe since 2022. The figure describes incidents that the FIS connects to Russian intelligence activity. The agency says all leads point to Russia, while Moscow traditionally denies involvement in agent networks on EU territory.

Authorities have identified more than 170 perpetrators so far. The suspects include Ukrainian nationals, not only people directly connected to Russia. The article gives a September case in Romania as an example. Romanian intelligence allegedly linked a fire near the Carfil SA defense plant in Brasov to a Russian-directed network involving one Ukrainian and two Belarusians.

Poland accounts for the largest share, at 21 percent. The FIS says Poland is especially exposed because much military assistance to Ukraine passes through the country. Its railways, warehouses, logistics hubs, and defense facilities therefore appear frequently among known targets. The reported totals show a persistent security challenge.

The FIS says Russian intelligence services target vulnerable people because they may be more willing to accept risky offers or easier to pressure later. The agency lists refugees with low incomes, people from temporarily occupied territories, individuals with criminal connections, and teenagers seeking easy money. Urgent financial difficulties can make promises of payment especially attractive.

The alleged recruitment serves two purposes. First, vulnerable recruits can be used as expendable operatives. Second, Ukrainian nationals can make an attack appear unconnected to Russia. The FIS says this gives Moscow a “plausible alibi” because the perpetrator holds a Ukrainian passport. The Kremlin also seeks to create a toxic image of Ukrainian refugees and encourage anti-Ukrainian sentiment.

The consequences can be severe for recruits. They may receive no payment after completing a task. Once they commit a crime, the FIS says they become vulnerable to blackmail, arrest, and lengthy imprisonment. It urges people to seek help from local authorities or Ukrainian diplomatic missions.

Recruiters reportedly find potential operatives through social media and messaging apps, especially job-search groups. They approach people with offers of easy money or help with urgent financial problems. The first request may seem minor and low-risk, which can make the contact appear like an ordinary job opportunity.

The alleged mechanism is gradual escalation. A handler may first ask someone to photograph a facility or put up stickers. Later, the person may be told to watch a target, damage property, set a fire, or prepare a bomb attack. Recruits must record their actions and send the footage to the handler as proof. Some may not realize who is directing them.

This process leaves recruits exposed. After an operation, they may have committed a serious crime and become vulnerable to blackmail. The FIS says many are arrested quickly, while Russian handlers provide neither protection nor assistance. It advises caution around secretive contacts and easy-money offers.

The alleged operations create several kinds of pressure. European security services must protect railways, warehouses, logistics hubs, defense facilities, and other possible targets. The FIS says this diverts resources and requires tighter security. Even when networks are exposed and suspects are arrested, the disruption and cost have already occurred.

The campaign also affects public attitudes. The FIS says Moscow deliberately uses Ukrainians to create a toxic image of refugees and fuel anti-Ukrainian sentiment. A Ukrainian passport can obscure the alleged Russian connection. This risks shifting blame toward law-abiding refugees, although the agency stresses that millions of Ukrainians who fled the war are not involved.

Military assistance is another target. Poland carries much of this assistance to Ukraine, so its transport routes and facilities are frequently mentioned. The FIS says the Kremlin wants to undermine that support. Continued recruitment could bring more security measures, investigations, and pressure on European societies.

A hybrid operation is a coordinated campaign that uses different forms of pressure at once. In this case, the FIS describes sabotage, recruitment, intimidation, misinformation effects, and attacks on support for Ukraine as connected parts of one campaign. The method relies on covert agents and criminal acts rather than openly claiming responsibility.

Using Ukrainian nationals allegedly makes attribution harder. The perpetrator may appear to be an independent Ukrainian citizen, not someone directed by Russian intelligence. The FIS calls this a “plausible alibi.” Recruiters can also obscure the trail by using social media, handlers, and people who may not know whom they serve. The article says some operatives receive no payment and are used as “torpedoes.”

The wider effect is political as well as physical. An attack can damage a facility, force Europe to spend more on protection, and create suspicion toward refugees. It can also pressure countries that transport military assistance to Ukraine. The FIS says European partners are sharing intelligence to expose these methods.