Europe Faces Rising Threat from “Gig‑Economy” Sabotage Networks Linked to Russia

A growing body of research indicates that Russian intelligence services are increasingly orchestrating low‑cost, deniable sabotage operations across Europe by recruiting “disposable agents” online. These findings, drawn from a recent analysis by the Royal United Services Institute (RUSI), suggest a significant shift in how hostile activities are planned and executed, with implications for European security and public trust.

A New Model of Covert Operations

Investigators and security analysts report that Russian operatives are turning to a “gig‑economy” model of sabotage, outsourcing tasks to individuals recruited through encrypted messaging apps, gaming platforms, and social media. These recruits—often teenagers, migrants, or older individuals with prior military experience—are allegedly offered payments ranging from hundreds to thousands of euros, frequently in cryptocurrency to obscure financial trails.

Unlike traditional espionage, these assignments are designed to be remote, freelance, and highly deniable. Recruits may be tasked with arson, vandalism, reconnaissance, or other low‑level disruptions targeting civilian and military infrastructure. Many are described as “agents for a day,” carrying out isolated acts without broader operational awareness.

Sharp Rise in Sabotage Incidents

European security agencies have documented a notable increase in suspected Russia‑linked sabotage. Reported incidents rose from just two in 2022 to 12 in 2023, and surged to 34 in 2024, according to data cited in the RUSI report. These actions range from damaging undersea cables to setting fires at logistics hubs, as well as reconnaissance of critical infrastructure.

Experts warn that while individual incidents may appear minor or opportunistic, together they form a coordinated campaign aimed at raising the cost of supporting Ukraine, testing NATO’s red lines, and undermining public confidence in national security systems.

Recruitment of Ukrainians and the Risk of Misattribution

With many Russian intelligence officers expelled from Europe since the 2022 invasion of Ukraine, analysts say Moscow increasingly relies on intermediaries—often Ukrainian nationals—to carry out tasks. The report cautions that misinterpreting these incidents as isolated actions by Ukrainians risks fuelling anti‑Ukrainian sentiment, which may itself be a strategic objective of the operation.

Calls for a Stronger European Response

RUSI researchers urge NATO and EU governments to strengthen their counter‑sabotage frameworks. Recommendations include:

• Establishing a shared definition of sabotage across member states
• Enhancing monitoring of illicit financial flows, especially cryptocurrency channels
• Treating even low‑level incidents as part of a broader hostile pattern
• Leveraging counterterrorism tools to track recruitment and funding networks

Analysts argue that Europe must adapt quickly to this evolving threat, which blends digital recruitment, deniable actors, and hybrid warfare tactics.