Μake us preferred on Google What if the person carrying out a sabotage operation isn’t a trained spy, but someone recruited online for a few hundred euros?
On September 14, 2026, a fire broke out at an industrial site in Brașov, Romania, near a defense manufacturing facility. Weeks later, Romanian intelligence authorities announced that the fire had been deliberately set by a sabotage network coordinated from Russia.
According to investigators, the network’s activities extended beyond Romania, raising a wider question. How vulnerable is Europe to sabotage operations carried out across national borders?
Why Is Sabotage Becoming a Growing Concern in Europe?
The Brașov arson is not an isolated incident. Since Russia’s full-scale invasion of Ukraine in 2022, European authorities have reported a growing pattern of Russian-linked hybrid activities, including sabotage, arson, cyberattacks, and other covert operations aimed at undermining European security and support for Kyiv.
Yet what makes this threat particularly concerning is not simply the nature of the attacks, but the changing methods used to carry them out. Rather than relying exclusively on trained intelligence officers, Russian intelligence services have increasingly been linked to operations involving locally recruited individuals, often with little or no intelligence background. These individuals are commonly referred to as disposable agents.
Who Are the So-Called Disposable Agents?
They are the “gig workers” of covert operations. Instead of sending trained, elite GRU or FSB officers who are difficult to replace and politically toxic if caught, hostile intelligence services outsource their “dirty work” to completely deniable freelancers. Recruitment has included individuals from former Soviet republics (such as Belarusians, Moldovans, and even Ukrainians).
Recruitment often takes place online, particularly through messaging platforms such as Telegram, they use gaming forums, TikTok, and Snapchat to post seemingly harmless ads seeking quick tasks, with payments ranging from a few hundred to several thousand euros. What begins as a simple assignment, such as photographing a facility or painting graffiti, may escalate into more serious activities, including vandalism, arson, or sabotage against critical infrastructure.
A 2026 study by Bart Schuurman examining 145 low-level agents involved in Russian covert operations across Europe between 2022 and 2025 found considerable diversity in their backgrounds. While approximately 26% had previous criminal convictions, the findings challenge the assumption that recruitment primarily targets teenagers or young adults. The study also found that 35.2% of the individuals examined had participated in multiple operations, suggesting that the term disposable does not necessarily mean they are used only once.
Unlike traditional intelligence assets, these recruits often have limited knowledge of the wider operation or the identity of those directing them. Some knowingly participate in illegal activities, while others may be unaware that they are working on behalf of a foreign intelligence service. By separating individual assignments and using intermediaries, intelligence services can reduce the risk that the arrest of one operative will expose the wider network.
How Do Disposable Agents Challenge Traditional Counterintelligence?
For decades, European counterintelligence services have monitored suspected foreign intelligence officers, tracked espionage networks, and investigated individuals operating under diplomatic or other forms of cover. However, disposable agents present a different challenge. Their activities may initially resemble ordinary criminal offences rather than foreign-directed intelligence operations, making it difficult for authorities to recognize the broader threat. One of the main challenges is attribution. By using intermediaries and separating individual assignments, intelligence services can obscure the connection between those carrying out an operation and those directing it. Even when a suspect is arrested, establishing links to a foreign intelligence service may require evidence extending far beyond the immediate crime.
The cross-border nature of these networks further complicates investigations. Individuals involved in the same operation may be recruited, directed, or investigated in different countries, requiring intelligence and law enforcement agencies to connect evidence across national jurisdictions. As a result, arresting a disposable agent does not necessarily dismantle the wider network. The individuals responsible for recruiting, financing, and coordinating operations may remain unidentified, allowing similar activities to continue.
How Should European Intelligence Services Respond?
The EU has already developed its Hybrid Toolbox to coordinate responses to hybrid threats, while the Critical Entities Resilience Directive provides a framework for strengthening the resilience of essential infrastructure. In September 2026, European Commission President Ursula von der Leyen also called for a European counter-hybrid playbook and an Emergency Security Protocol to improve coordination in responding to threats that fall below the threshold of armed aggression.
However, addressing the growing use of disposable agents requires the European intelligence and law enforcement agencies to strengthen their ability to identify connections between seemingly isolated incidents, particularly when recruitment, financing, and operational coordination cross national borders. Existing mechanisms, including Europol, Eurojust, and the EU’s Single Intelligence Analysis Capacity (SIAC), can support cooperation and information exchange within their respective mandates, although national authorities retain primary responsibility for counterintelligence.
Financial intelligence should also play a greater role in identifying and disrupting sabotage networks. Following payment flows, whether through conventional banking channels, cash transfers, or cryptocurrencies, may help investigators uncover links between individual operatives, intermediaries, and those coordinating operations. At the same time, closer cooperation between security services, law enforcement agencies, and digital platforms could improve the early detection of online recruitment activities, subject to appropriate legal safeguards.
Finally, public awareness is an important element of prevention. Informing individuals about deceptive recruitment methods, the risks of accepting suspicious paid assignments, and the potential legal consequences of participation could reduce the pool of available recruits.
The growing use of disposable agents reflects a shift in how foreign intelligence services conduct covert operations. By recruiting ordinary individuals for short term assignments, they can carry out activities ranging from surveillance to sabotage while making it more difficult to trace responsibility back to those directing them. The Brașov case illustrates how seemingly isolated acts of sabotage may form part of broader, coordinated operations extending across national borders.
For European counterintelligence, the challenge is no longer simply identifying and apprehending those who carry out these attacks, but uncovering the networks responsible for recruiting, financing, and coordinating them. As these methods continue to evolve, Europe’s ability to connect seemingly unrelated incidents and strengthen cross-border intelligence cooperation will be essential to preventing future operations.
Maria Chondroyianni holds a bachelor’s degree in Political Science from Democritus University of Thrace and is pursuing a master’s degree in National Security, Intelligence and Conflict Resolution.
