Since 2022, Russia’s hybrid activity across Europe and NATO states has surged – spanning espionage, sabotage, and even assassinations. As of last year, the term “disposable agents”* and the notion of a “gig-economy” model of covert action have become increasingly prominent when describing the actors carrying out these tasks, evidenced by Germany’s “Don’t Become a Disposable Agent” campaign launched in September 2025. ‘Disposables’  are hired, low-level operatives with no formal intelligence background, untrained and highly deniable.

We assess that Russia is highly likely increasing its reliance on recruiting ‘disposable operatives’ for low-level kinetic operations in European and NATO states. These campaigns are likely used as a PSYOP tool to create internal insecurity over merely achieving tactical success. While the recruitment pool of these operatives is diverse, Russia is highly likely leveraging criminals in particular, and will likely continue to do so.

*Note: It is important to clarify what constitutes a “disposable” agent, as the term is often used too loosely. “Disposables” should not be understood as strictly single-use operatives, of which the term is often used interchangeably. While these assets are expendable, easily replaced, and lack formal ties to Russia’s security agencies, there is substantial evidence that Moscow does re-use those who demonstrate effectiveness. A study by Dr. Bart Schuurman of Leiden University’s Institute of Security and Global Affairs found that nearly 40% of the agents within his sample were involved in more than one operation. [source]

Key Judgements

KJ-1. Russia is highly likely increasing its reliance on recruiting ‘disposable operatives’ for low-level kinetic operations in European and NATO states. 

1. The Financial Times in mid-February cited Western and European intelligence officials stating that previous Wagner recruiters have been now assigned to recruit economically vulnerable Europeans to carry out acts of sabotage on NATO territory. [source] 
2. A Royal United Services Institute (RUSI) paper published in mid-January refers to how the Cold War era predominantly relied on trained operatives, a stark comparison to Moscow’s outsourcing of disposable agents today. [source] 
3. Germany’s security services in September 2025 launched a campaign titled “Don’t Become a Disposable Agent” to warn citizens about Russian intelligence services recruiting civilians for espionage and sabotage. [source, source]
4. Europol also assessed an upward trend of criminal networks by Russian actors to conduct sabotage operations in 2025. [source]
5. In Schuurman’s study, a minimum of 127 disposable agents between 2022-2025 were active in 18 countries. [source] 
6. In 2024, there was a coordinated wave of incendiary parcel attacks across Germany, England, and Poland, attributed by European intelligence agencies to 10 ‘disposable’ agents who were recruited through Telegram and promised payments. [source, source] 
7. Polish authorities in May 2024 convicted several individuals for their role in a large-scale arson attack on a Warsaw shopping centre. [source]
8. According to The Guardian, agents from Russia’s GRU Unit 29155 – previously focused on deep-cover “illegal” (official) agents, are now involved in coordinating sabotage in Europe and the use of low-level recruits. Additionally, in 2024, the unit was incorporated into the newly formed Department of Special Tasks (SSD), a larger structure dedicated to foreign sabotage, possibly indicating the expansion and focus on such activities. [source, source]
9. According to the Center for Strategic and International Studies, the number of sabotage incidents in 2024 tripled compared to the previous year and RUSI characterised many of those as “ordinary individuals…paid in cryptocurrency.” [source, source]
10. German intelligence, along with various experts including Mark Galeotti, state that the mass expulsion of Russian diplomats since 2022, which contained many intelligence officers, significantly weakened Russia’s operational capacity and led to the increased reliance on untrained operatives. [source, source]

Germany’s Federal Office for the Protection of the Constitution (BfV), the Federal Criminal Police Office (BKA), and the Federal Intelligence Service (BND) launched the “Don’t Become a Disposable Agent” campaign.

KJ-2. Russia likely views disposable operatives as a PSYOP tool to create persistent insecurity over merely achieving decisive, immediate physical effects. 

1. Many incidents carried out by these disposable agents did not destroy significant infrastructure, concentrating on soft targets, according to Piotr Krawczyk, the former head of Poland’s foreign intelligence service. Acts are frequently low- level, such as vandalism, arson, and other easily repairable damage, increasingly targeting civilian spaces. As Europol stated in its 2025 serious and organised crime threat assessment, such activity is consistent with the “woodpecker” modus operandi of “seemingly minor actions that collectively erode stability, security, and trust in institutions.” [source, source, source, source]
2. According to Schuurman’s 2025 dataset and other studies, migrants, particularly Ukrainians, are disproportionately targeted for recruitment. Analysts from RUSI note that this is a deliberate and strategic effort to exploit their presence in host societies, provoking distrust and amplifying social tensions, ultimately benefiting Russia. [source, source]
3. Moscow persistently recruits these minimally trained, unreliable individuals despite almost 20% thwart rates, according to GLOBSEC (and likely significantly higher, according to experts interviewed in the same study). Participants in a 2025 RUSI workshop assessed failed operations are still highly significant, as they generate fear and distrust within the host societies. [source, source]
4. Various government officials and subject matter experts referred to the goal of these operations as being “fear, discontent and confusion in society”, as stated by Marta Tuul, a spokeswoman for Estonia’s KAPO security service in late 2024. Indrek Kannik, the director of Estonia’s International Centre for Defence and Security, highlighted it as the “most important aim.” [source]

KJ-3. While the pool of recruited assets have diverse backgrounds, Russia is almost certainly leveraging criminal networks to identify some candidates, and we have not identified any indicators that this will change.

1. A Lansing Institute report published in February stated that Moscow occasionally exploited criminal actors in the Cold War, but deemed them as auxiliary; today, they are “primary executors.” [source] 
2. According to the Latvian State Security’s annual report in 2025, Russia actively performs “targeted searches” for perpetrators in the criminal environment. Similarly, GLOBSEC found that Russian security services recruited through prisons or organised crime groups. [source, source]
3. In Schuurman’s dataset, at least 26% of Russia’s disposable agents had verifiable criminal antecedents. Another similar study by GLOBSEC found that 35 of 131 identified in kinetic incidents linked to Russia had criminal pasts, roughly 45%. [source, source]
4. A 2024 Dossier Center report stated that recruiting criminals minimises the risk to the GRU itself. According to the study, individuals with criminal backgrounds are more likely to agree to risky, illegal tasks. Additionally, the Institute for Global Politics also notes the value of criminal networks, in that they are more likely than the average citizen to gain access to weapons, false documents, or the black market. [source, source] 

Statement on Analysis

We have moderate confidence in this assessment. The report utilises a range of credible sources, including reliable international news outlets, think tanks, and comprehensive datasets by subject matter experts. However, some limitations need to be addressed. While Russia’s strategic culture and operational patterns are consistent with the use of disposable operatives as a psyop tool, intent remains inherently difficult to determine. Additionally, much of the extracted data regarding cases only consider the formally confirmed and attributed cases, such as those captured in Schuurman’s study and GLOBSEC datasets. This means a potentially significant number of suspected but unattributed incidents are excluded, and thus may affect the understood recruitment pool. Nonetheless, there is a clear trend in Russia hiring civilians abroad to conduct kinetic activities as part of its hybrid warfare against NATO and European states.

Intelligence Cut-off Date: 02 March 2026