Russia's Disposable Agents: Online Recruits Behind Europe's Sabotage Wave

European security services say Russia is running a sustained sabotage and espionage campaign across the continent through so-called 'disposable agents', low-level recruits hired online for one-off tasks such as arson, surveillance or the delivery of incendiary devices. As of October 4, 2026, the campaign is still active. Its most recent wave struck defense plants and a major cargo airport in August 2026, and the European Union is now building a joint mechanism to respond to this type of attack.

Disposable agents, also called throwaway or single-use agents, are not trained intelligence officers. They are typically approached through Telegram channels, Facebook groups, job boards and volunteer forums, then paid small sums, often in cryptocurrency. Many do not know who is really giving the orders or what the true purpose of the assignment is. People prosecuted so far have included Ukrainian refugees, petty criminals, local teenagers looking for quick cash and former soldiers from Latin America. According to research by the Royal United Services Institute, payments range from a few dollars for graffiti to as much as $10,000 for violent acts.

Analysts link the rise of this model to the mass expulsion of Russian diplomats suspected of spying after the full-scale invasion of Ukraine in 2022. The expulsions removed much of Russia's professional network in Europe, and remote recruitment filled the gap. In February 2026, Western intelligence officials told the Financial Times that former Wagner Group recruiters had been reassigned to find financially vulnerable people in Europe willing to carry out sabotage.

The clearest picture of how a recruiter operates came on September 14, 2026, when four European public broadcasters, DW, LRT, RTVE and Czech Television, published a joint investigation coordinated by the European Broadcasting Union. After six months of work based on classified court files, leaked data and dozens of interviews, the reporters traced an online handler known as 'Adrian' or 'Dios' to Petrozavodsk, a city in northwestern Russia. They identified him as Oemis Romagoza Durruthy, a Cuban-born man with Russian citizenship who teaches salsa and bachata at a local Latin dance studio.

According to the investigation, accounts linked to him posted job offers in 2024 in Telegram and Facebook groups used by Latin Americans looking for work in Poland or hoping to fight for Ukraine. One ad promised $1,500 plus a bonus for each completed operation. The handler arranged flights, lodging and ground transport remotely and never met his recruits in person. Between May and September 2024, he allegedly directed arson attacks on two construction-supply warehouses in Poland, a bus garage in Prague, a recycling facility in Romania and a Lithuanian company producing equipment for the Ukrainian military.

At least a dozen people were recruited by this single handler, and at least nine have been caught. One of them, Colombian army veteran Luis Alfonso Murillo Diosa, was detained in Bucharest in July 2024 after photographing a recycling plant he had been told to set on fire. He told investigators that he wanted to reach Ukraine and did not know who he was working for. A Romanian court sentenced him in 2025 to six years in prison for attempted sabotage. Another Colombian recruit is serving an eight-year sentence in the Czech Republic.

The legal pressure on the organizers increased sharply in September 2026. On September 15, the US Department of Justice unsealed an indictment in federal court in Manhattan against five alleged members of a Russian intelligence network accused of plotting killings and sabotage in the United States and Europe. The defendants include a former Russian intelligence colonel, his son, who is described as an officer of the Federal Security Service, and Romagoza. All five are charged with conspiracy to finance terrorism, are believed to be in Russia and remain at large. On September 17, Poland's Internal Security Agency confirmed that Polish prosecutors have also charged Romagoza over fires at building-material warehouses in Warsaw and Radom in May 2024. The agency added that footage of those fires was later circulated by Russian-language outlets and falsely presented as attacks on NATO military sites. Lithuanian prosecutors had already placed him on an international wanted list and attributed the arson series to Russian military intelligence. Moscow denies any role in sabotage in Europe.

For supply chains, the target list is the main concern. In 2024, attacks attributed to disposable agents destroyed the Marywilska 44 shopping center in Warsaw, damaged an Ikea store in Vilnius and placed incendiary parcels in courier networks, causing fires at logistics hubs in Germany, Poland and the United Kingdom. In 2026, the focus has shifted toward companies that supply Ukraine. Overnight from August 4 to August 5, a drone carrying explosives was found next to a Ukrainian Antonov Airlines cargo plane at Leipzig/Halle Airport, one of Europe's largest air freight hubs. The airport was shut for several hours, flights were diverted and a DHL cargo aircraft made an unscheduled landing in Hanover after striking an object during its climb. Normal operations resumed on August 6.

More incidents followed within weeks. On August 15, a fire hit the Tallinn plant of Milrem Robotics, an Estonian maker of unmanned military vehicles used by Ukraine, and two suspects were arrested. On August 25, Slovak police said they had stopped an arson plot against a Ukrainian-owned drone manufacturer and detained three people. Shortly after midnight on August 31, a fire broke out at a WB Electronics drone plant in Skarzysko-Kamienna, Poland, after cameras recorded a masked intruder entering the site. Prosecutors estimated the damage at about 15 million zlotys, or roughly $4 million, and Prime Minister Donald Tusk called it deliberate arson and an act of sabotage.

Governments have started to respond more openly. On September 1, Germany formally blamed Russia for the Leipzig attempt. Interior Minister Alexander Dobrindt said the device showed a high level of technical skill but that the operation itself had been handed to low-level agents. Berlin ordered the Russian consulate in Bonn to close from September 18 and announced the closure of the Russian House cultural center in Berlin. A few days later, two suspects were placed in pre-trial detention over an arson attack near defense companies in Munich. German authorities have counted more than 165 suspected sabotage cases in the country in 2026. In early September, British police charged a man with passing details of drone manufacturing sites in England to a Russian intelligence unit, and Denmark's security service accused Russia of trying to recruit Danish citizens to sabotage defense firms working with Ukraine.

The overall scale keeps growing. The Associated Press has logged about 200 incidents of sabotage and other hostile activity in Europe linked to Russia since 2022, and researchers found that the number of sabotage incidents roughly tripled between 2023 and 2024. Poland, the main logistics corridor for aid to Ukraine, remains the most heavily targeted country.

On September 28, EU foreign ministers met in Brussels to work on an emergency security protocol that would let member states coordinate quickly when a hybrid attack is identified. EU foreign policy chief Kaja Kallas warned that intelligence shows Russia is planning further sabotage. In early October, Polish broadcaster TVP World reported that its own journalists had received suspicious offers of paid remote work resembling known recruitment methods, although nothing ties those messages to Russian intelligence. Romagoza has not been arrested. According to DW, he joined at least two more Facebook groups for Latin Americans seeking work in Poland around April 2026, and several of his former recruits are still awaiting trial.

For manufacturers, freight operators and warehouse owners, the lesson is that the attackers are cheap, replaceable and hard to trace back to a sponsor. Defense suppliers, drone makers, air cargo hubs and storage sites linked to Ukraine face the highest exposure, and companies in these sectors are being urged to tighten perimeter security, screen parcels and contractors more closely and report suspicious job offers or surveillance to national security agencies.