Russia’s Shadow Army in Europe: How Are Disposable Agents Recruited?

Two Ukrainian teenagers were promised €10,000 and a BMW. Their task was to set fire to shopping centres in Lithuania and Latvia. A few days later, the IKEA store in Vilnius went up in flames. According to the Lithuanian Prosecutor General’s Office, this was not a random act of arson, but a terrorist attack organised by Russia’s military intelligence service, the GRU. Investigators concluded that the organisers operated from Russia through intermediaries, and that the same network was also linked to acts of sabotage in Poland. (The Guardian)

The IKEA store in Vilnius was not the only target. A few days later, the Marywilska 44 shopping centre in Warsaw was destroyed by fire. In Germany, drones were repeatedly spotted over military bases, in the United Kingdom warehouses storing aid for Ukraine were set on fire, and people were detained in several European countries on suspicion of planning or carrying out sabotage. At first glance, these incidents may seem unrelated. But European security agencies increasingly see a common pattern behind them. (Geopolitical Monitor)

The German ARTE documentary Russia’s Shadow Army in Europe describes this new approach as Russia’s “shadow army”. This is no longer a classic intelligence network in which operations are carried out by trained spies. More and more often, ordinary people with no connection to intelligence services are recruited online to carry out one specific task. The German newspaper Merkur has even called them “disposable agents”. (Merkur)

Ordinary people instead of professional agents

For decades, the activities of Russian intelligence services were associated with professional agents. Cold War-era spies lived for years under false identities, recruited new collaborators and gathered secret information.

But after Russia’s full-scale invasion of Ukraine, the situation changed. European countries expelled hundreds of Russian diplomats and intelligence officers, making it much more difficult to rely on traditional agents. So Moscow began looking for a new solution. (Euronews, AP News)

According to European security services and analysts, Russia has shifted to a model in which operations are carried out by amateurs. They are often recruited through social media and messaging apps, are motivated mainly by money, and sometimes do not even know whose interests they are really serving. This model reduces costs, expands recruitment opportunities and makes it harder to link the operations to the Russian state.

Why give up professional agents?

At first glance, it may seem strange that an intelligence service would entrust important tasks to people with no training at all. For Russia, however, the advantages of this model often outweigh the risks.

A disposable agent does not need to carry out a complex task. They may be asked to photograph a military facility, film a port, observe the security arrangements around a building, vandalise a monument, set fire to a warehouse, or transport a package from one place to another. Often, they do not even know how their actions fit into the larger plan.

The operation is broken down into small parts. One person gathers information, another obtains the necessary materials, a third carries out the arson attack, and a fourth spreads disinformation on social media after the incident. None of them sees the full picture. If one participant is caught, they may not know who gave them the task or which part of the operation they were involved in.

This structure makes the entire network more resilient. The arrest of one person does not mean the whole operation is exposed, and it becomes easier for Russia to deny its involvement.

The model is not perfect, however. Poorly prepared recruits make more mistakes and often reveal more during questioning about their recruitment and contacts. This is exactly why European investigators have been able to map Russia’s sabotage networks more effectively in recent years.

Estonia’s experience confirms the same pattern

A similar development is described by the Estonian Internal Security Service, KAPO, in its latest annual review.

KAPO writes that Russian special services are increasingly using so-called disposable collaborators. They are recruited through campaigns on social media, and their tasks may include photographing or filming objects, vandalising them, or causing physical damage.

For example, last year there was an attempt to recruit people through social media to damage the Sinimäed memorial. KAPO also highlights the arson attack on the Slava Ukraina restaurant, noting that attacks on such symbolic targets are intended to spread anxiety and division within society. Calls to photograph, film and damage various sites continue.

Especially noteworthy is KAPO’s observation that Russia has also recruited minors for sabotage operations. Young people are an attractive target for special services because they react quickly to offers circulating online and may not fully understand the consequences of their actions.

Money, not ideology

During the Cold War, agents were often recruited based on ideological beliefs. Today, money plays a much bigger role.

Investigations show that the main motivation for recruitment is usually not ideology, but money. According to investigators, the suspect in the Vilnius IKEA arson case was promised €10,000 and a BMW. The German newspaper Merkur reported that he was found through a job offer posted on Telegram. According to the Lithuanian Prosecutor General’s Office, there was no indication that the young man was motivated by pro-Russian views. (BBC; Merkur)

The head of Poland’s Internal Security Agency, Rafał Syrysko, instead calls such people “low-cost agents”. According to him, hostile intelligence services can use them quickly, cheaply and without direct contact. Such people carry out not only acts of vandalism, but also arson, sabotage and attacks involving explosive materials. (TVP World)

The German ARTE documentary Russia’s Shadow Army in Europe calls such people “disposable agents”. The Estonian Internal Security Service, KAPO, uses the term “disposable collaborators”, Polish security services speak of “low-cost agents”, and English-language analyses also use the phrase “low-level agents”. Although the terms differ, they describe the same phenomenon: people recruited online to carry out individual tasks in Russia’s interests. In this article, we will use the term “disposable agent” to refer to them.

The whole understanding of the threat has changed

Just a few years ago, such incidents were often treated as separate crimes.

Today, European countries increasingly see them as part of one broader hybrid campaign.

One person photographs a military base. Another vandalises a memorial. A third sets fire to a warehouse. A fourth spreads disinformation on social media after the attack. They do not know one another, but their actions may serve the same strategic goal.

This means that modern sabotage no longer necessarily begins with a secret meeting or a complex intelligence operation. More and more often, it begins the moment someone responds to a job offer online.

In the next part of this series, we will take a closer look at how Telegram and other social media channels have become the new recruitment office for Russian intelligence services, and what methods are used to find and influence people.