A Russian-linked recruitment network operating through Telegram has expanded its sabotage recruitment campaign beyond Ukraine into several European Union countries, according to an investigation by independent news outlet Vot Tak. The investigation found that recruiters are offering payments ranging from $1,500 to $3,000 for attacks targeting NATO-related assets, Ukrainian organizations, transportation infrastructure, and other facilities across Europe.
The investigation indicates that what initially focused on recruiting individuals for sabotage inside Ukraine has increasingly shifted toward operations in EU member states during the spring of 2026.
Recruiters Present Illegal Tasks as Part-Time Jobs
According to Vot Tak, recruiters advertise what appear to be legitimate part-time jobs, describing them as "easy work," "simple technical work," or flexible side jobs with stable payments.
After establishing contact, recruiters reportedly inform applicants that the assignments involve illegal activities. They then provide detailed price lists outlining payments for different sabotage missions and explain the methods required to complete them.
One recruiter using the Telegram alias "Jan Pol" allegedly told an undercover journalist that the work was "illegal" before sending instructions and payment offers for various assignments.
The investigation also identified other recruiter aliases, including "Sasha," "Smitt," "Moroz," and "Maks," who allegedly coordinated assignments in different countries.
Poland Among Primary Targets
According to the investigation, Poland became one of the main countries targeted after the network expanded its activities into the European Union.
Recruiters allegedly offered payments of up to $3,000 to carry out arson attacks against:
- Locomotives
- Mobile communication base stations
- Vehicles with Ukrainian license plates
- Humanitarian aid collection points
- Ukrainian organizations and volunteer centres
Before approving an attack, recruiters instructed recruits to conduct reconnaissance by collecting addresses, filming potential targets, and submitting the footage for approval.
If the target was accepted, recruits were instructed to record the attack using the Timestamp Camera application, which embeds time and location data into videos. Payment was reportedly made through cryptocurrency or bank transfer after handlers verified the footage.
Latvia: Ukrainian Community Office Targeted
In Latvia, investigators found that recruiters offered $3,000 to attack the headquarters of the Viche Confederation of Ukrainian Communities in Riga.
According to Vot Tak, recruiters supplied photographs of the building and previously recorded reconnaissance footage. They instructed recruits to carry out an arson attack and submit video evidence before receiving payment.
Lithuania: NATO Equipment and Disinformation Assignment
The investigation found that recruits in Lithuania were offered $1,500 to set fire to a NATO military vehicle.
An additional $500 was reportedly offered for obtaining or staging video material claiming that Ukrainian drones were being launched from Lithuanian territory.
According to Vot Tak, this proposal was made only days before Russia's Foreign Intelligence Service publicly claimed that Ukraine was preparing drone launches from the Baltic states.
Czech Republic Operations
In the Czech Republic, recruiters allegedly sought individuals willing to purchase electric igniters, devices commonly used in pyrotechnics but also capable of serving as components in improvised explosive devices.
Approximately one month after these communications, an arson attack occurred at a defence facility in Pardubice that manufactures drones for Ukraine.
While investigators have not confirmed a direct connection between the Telegram communications and the incident, Vot Tak noted that the timing has drawn attention from investigators examining possible Russian intelligence involvement.
Recruitment Network Uses Layered Structure
The investigation describes a structured recruitment system designed to reduce exposure for organizers.
Initial advertisements are distributed through thousands of Telegram job-search groups by temporary accounts that often remain active for only a few days before being deleted.
After initial contact, potential recruits are transferred to handlers who explain the assignments, approve targets, and arrange payments.
To verify completed operations, recruits are instructed to:
- Conduct reconnaissance before the attack.
- Record the entire operation using the Timestamp Camera app.
- Submit the footage to handlers.
- Receive payment, typically in cryptocurrency, after verification.
Massive Online Recruitment Campaign
Researchers cited by Vot Tak estimate that more than 20 million recruitment advertisements linked to sabotage have appeared on Telegram since the beginning of 2026.
On May 12 alone, approximately 10,000 nearly identical advertisements in Russian and Ukrainian were identified across Telegram channels and job groups.
Most advertisements promoted flexible, well-paid work before directing interested users to recruiters.
According to the investigation, these advertisements appeared not only in Eastern Europe but also in Russian-language Telegram groups serving users in Germany, Poland, the United States, the United Arab Emirates, Thailand, and more than 20 other countries.
Foreign Phone Numbers and Older Telegram Accounts
The investigation found that many of the accounts distributing recruitment advertisements were registered using foreign phone numbers rather than Russian or Ukrainian numbers.
Most were linked to numbers from India, Iran, and several Arab countries.
Researchers also found evidence that another branch of the network purchases older Telegram accounts, sometimes more than ten years old, to bypass platform spam filters and increase the credibility of recruitment messages.
According to Vot Tak, recruiters were willing to purchase established Telegram accounts for relatively small amounts before repurposing them for recruitment activities.
Recruitment Previously Focused on Ukraine
The investigation notes that until late 2025, most sabotage assignments targeted locations inside Ukraine.
However, by the spring of 2026, standard recruitment materials had expanded to include operations across several European countries.
The Security Service of Ukraine (SBU) told Vot Tak that it considers the recruitment effort part of what it describes as the Russian intelligence operation known as "Sabotage Noise," which Ukrainian authorities say has been active since 2023.
According to the SBU, more than 1,400 Russia-directed sabotage-related crimes have been documented in Ukraine since the operation began, including approximately 800 cases during 2025.
Recent Arrest Highlights Ongoing Threat
The investigation comes as European security agencies continue monitoring suspected sabotage activities linked to Russian intelligence.
On July 7, 2026, two individuals were detained at the Serbia-Hungary border after intelligence shared by German security services and allied agencies.
According to intelligence officials and German newspaper BILD, authorities discovered an explosive device during a search of their luggage. Investigators believe the suspects were travelling to Germany to carry out a sabotage attack against a defence-industry facility involved in military assistance to Ukraine.
Officials described the pair as suspected "disposable agents" allegedly recruited for a single operation.
Investigation Highlights Growing Cross-Border Recruitment
The Vot Tak investigation concludes that Telegram has become a significant platform for recruiting individuals willing to conduct sabotage operations through offers of quick payments and anonymous communication.
While Ukrainian authorities have documented numerous cases of Telegram-based recruitment inside Ukraine, the investigation suggests that similar methods are now increasingly being directed toward targets across the European Union.
At the time of publication, Vot Tak reported that official requests for comment sent to intelligence agencies in Poland, Lithuania, Latvia, the Czech Republic, and the United States had not received detailed responses regarding the scale of the recruitment activity in their respective countries.
Source: vot-tak.tv
——— End of Article ———
