Dark-web recruiting helps Russia's sabotage activity in Europe surge 17-fold

How the Kremlin's Spy Agencies Adjusted Their Approach

According to ХВИЛЯ: After mass expulsions of Russian intelligence officers from Europe in 2022, the GRU and FSB revamped their recruitment playbook. Instead of relying on stationed agents, they began working through middlemen, messaging apps, and darknet platforms to direct operations remotely. In an expert interview with the publication Khvylya, Mark Galeotti said those expulsions badly damaged Moscow's existing spy networks, but Russian intelligence adapted quickly by delegating jobs to intermediaries and expanding methods that had already proved effective.

According to the Financial Times, the Kremlin also brought in former recruiters from the Wagner private military company to find so-called disposable agents across Europe. The operation focused on unemployed people, migrants, and those with criminal backgrounds. Many recruits believe they are assisting with legitimate business or helping ordinary criminals; they do not realize the tasks actually serve Russian intelligence.

Hybrid Warfare: A Rising Threat

The Associated Press has documented at least 145 incidents linked to this Russian hybrid campaign. Figures from the Center for Strategic and International Studies (CSIS) show that arson attacks and other serious acts of sabotage increased from two in 2022 to 34 in 2024. Recruitment is conducted through messaging services and the dark web, with payments made in cryptocurrency.

Galeotti observes that 'big organized crime stays out of political games - that's bad for business'.

Even so, Russian criminal networks operating like wholesalers in Europe's illicit economy give intelligence services access to small gangs and lone individuals willing to take risks. Typical jobs assigned to recruited operatives include setting fire to warehouses and conducting surveillance on specific sites.

This new strategy points to a broader evolution in hybrid warfare. As European governments increase pressure and expose agents, Moscow's use of digital tools makes its operations harder to trace and easier to scale. That trend, according to analysts, is likely to create serious security challenges across Europe in the near term.