Since 2022, Russia’s hybrid activity across Europe and NATO states has surged – spanning espionage, sabotage, and even assassinations. As of last year, the term “disposable agents”* and the notion of a “gig-economy” model of covert action have become increasingly prominent when describing the actors carrying out these tasks, evidenced by Germany’s “Don’t Become a Disposable Agent” campaign launched in September 2025. ‘Disposables’  are hired, low-level operatives with no formal intelligence background, untrained and highly deniable.

We assess that Russia is highly likely increasing its reliance on recruiting ‘disposable operatives’ for low-level kinetic operations in European and NATO states. These campaigns are likely used as a PSYOP tool to create internal insecurity over merely achieving tactical success. While the recruitment pool of these operatives is diverse, Russia is highly likely leveraging criminals in particular, and will likely continue to do so.

*Note: It is important to clarify what constitutes a “disposable” agent, as the term is often used too loosely. “Disposables” should not be understood as strictly single-use operatives, of which the term is often used interchangeably. While these assets are expendable, easily replaced, and lack formal ties to Russia’s security agencies, there is substantial evidence that Moscow does re-use those who demonstrate effectiveness. A study by Dr. Bart Schuurman of Leiden University’s Institute of Security and Global Affairs found that nearly 40% of the agents within his sample were involved in more than one operation. In conversation with Mark Galeotti, a leading expert in Russian history, politics and security, he stated Moscow intends to reuse these assets and indeed slowly build up their tradecraft so they can be used in more ambitious operations. [source]