Russian intelligence and former Wagner operatives are recruiting petty criminals, and jobless men across Europe and Canada to carry out arson and sabotage for a few thousand dollars a job, European security officials say.
The Associated Press has traced 145 incidents to Russia since the February 2022 invasion of Ukraine, with arson and explosives plots rising from one in 2023 to 26 in 2024 and six documented through December 2025. Poland and Estonia recorded the most attacks, followed by Latvia, the United Kingdom, Germany and France, all leading suppliers of aid to Ukraine.
Recruiters approach targets through Telegram channels tied to the Wagner Group and to Russia's military and domestic intelligence services, the GRU and FSB, commission a single job for a fixed fee, then cut the recruit loose. One senior European intelligence official told AP the effort amounts to a "24/7 operation between all the services", designed to drain the time of agencies that must treat each plot as potential terrorism. Volume is the objective rather than any single strike: a fire that costs a few thousand dollars to commission can cost a European security service weeks of investigative labour.
AP's count covers only incidents made public, and officials often take months to establish a link to Russia. Security services across the continent describe a wider effort spanning courier warehouses, rail corridors, shopping centres, undersea cables, airport approaches and the executives of the arms makers supplying Ukraine. Two people arrested in March 2026 had spent three months watching the home of a Bavarian drone manufacturer's chief executive before German officers moved, Die Zeit reported on 5 August 2026.
Recruitment through a bot
Six men were sentenced at the Old Bailey on 24 October 2025 over an arson attack on a warehouse in Leyton, east London, that held humanitarian aid and Starlink equipment bound for Ukraine. The fire, set on 20 March 2024, caused about £1 million in damage and required 60 firefighters to bring under control.
Dylan Earl, the ringleader, established contact with the Wagner Group in 2023 through Telegram, then recruited the men who carried out the attack, according to the Crown Prosecution Service. Earl was to be paid £9,000 and received less because he acted before his handler signed off, the Old Bailey heard. He received 17 years plus six on extended licence, in the first prosecution brought under the National Security Act 2023.
Jake Reeves received 12 years for accepting a benefit from a foreign intelligence service. Nii Mensah got nine years, Jakeem Rose eight and Ugnius Asmena seven for aggravated arson, and Ashton Evans nine years for failing to disclose information about terrorism relating to a separate plot to burn two Mayfair businesses and kidnap their owner, the exiled Russian businessman Yevgeny Chichvarkin. Mrs Justice Cheema-Grubb said the case concerned Russian efforts "to gain pernicious global influence using social media to enlist saboteurs". Commander Dominic Murphy, head of Counter Terrorism Policing in London, said the use of proxies is a tactic increasingly favoured by hostile states.
OCCRP reporters went undercover inside the recruitment operation. Posing as an applicant to a Telegram recruiter called Privet Bot in July 2024, they were offered $10,000 per mission to burn NATO and Ukrainian military vehicles, and the same sum for a targeted killing, alongside requests to photograph military bases, locate fuel depots and film the making of Molotov cocktails. The bot sought people with military experience, criminal records or acute financial need, a hiring profile built for deniability, since the recruit rarely knows who is paying and the handler can vanish the moment the job is done.
Vot Tak, an exile outlet whose findings were carried by The Insider, documented a network the Security Service of Ukraine calls Sabotage Noise offering $1,500 to $3,000 for arson against Ukrainian organisations and NATO vehicles in Lithuania, Poland, Latvia and the Czech Republic. More than 20 million recruitment ads appeared in job-search chats from January 2026, Vot Tak said, including some 10,000 near-identical posts in Russian and Ukrainian on 12 May alone, most carrying the contact details of a single recruiter using the alias Jan Pol. The ads ran in Russian-language chats serving Germany, Poland, the United States, the United Arab Emirates, Thailand and more than 20 other countries.
Vot Tak counted 25 sabotage convictions in Ukrainian court verdicts from 2026, 19 of which described recruitment over Telegram, alongside 22 terrorism verdicts, 14 of them involving the app. The SBU has documented more than 1,400 crimes commissioned by Russia since 2023, about 800 of them in 2025.
The FSB charged Telegram founder Pavel Durov with aiding terrorism on 29 July 2026 and placed him on an international wanted list, accusing the company of failing to remove channels and bots used by Ukrainian intelligence to prepare sabotage inside Russia. Durov, who holds French and Emirati citizenship and lives in Dubai, faces up to life imprisonment if convicted in Russia, and remains under formal investigation in France over criminal activity on the platform. Telegram's official account answered the Russian charge with an image of Durov raising his middle finger.
A hiring desk after Wagner
Yevgeny Prigozhin died in an August 2023 plane crash weeks after a failed mutiny, and Wagner's domestic forces were folded into the Russian defence ministry. Former Wagner recruiters who once signed up fighters in impoverished Russian regions have been tasked with identifying financially vulnerable people in Europe, European intelligence officials told the Financial Times in February 2026. The shift followed the expulsion of hundreds of Russian intelligence officers working under diplomatic cover, which pushed the GRU and FSB toward criminals, the unemployed and migrants willing to run surveillance, arson or vandalism for small payments.
GRU Unit 29155, the sabotage division blamed for the 2018 Salisbury poisoning and the 2014 Czech ammunition-depot blasts, sits at the centre of the European campaign in Western assessments, joined since 2023 by a newer GRU Department of Special Tasks staffed with the same veterans. The U.S. Justice Department indicted five Unit 29155 officers and a civilian in September 2024 over cyberattacks on Ukraine and reconnaissance of 26 NATO states, with the State Department offering a reward of up to $10 million.
The International Institute for Strategic Studies calculated that confirmed Russian sabotage of European critical infrastructure rose 246 per cent from 2023 to 2024. CSIS recorded attacks quadrupling between 2022 and 2023 and nearly tripling again the following year, then a sharp drop in the first half of 2025, when Seth Jones counted only four qualifying incidents. Some early 2025 cases were still unconfirmed when those figures were compiled, IISS said, and attribution lags by months. Counts of the campaign diverge, and the honest reading includes the dips.
Cases across the continent
Two German-Russian dual nationals were arrested in Bavaria in April 2024 over plans to attack industrial and military sites, including U.S. bases. The ringleader, identified in court as Dieter S., had scouted the Grafenwöhr training area, photographed military transports and offered to bomb rail lines used to move equipment toward Ukraine. A Munich court convicted him in October 2025 of working for the GRU and preparing sabotage, sentencing him to six years, with two co-defendants given suspended terms. A May 2024 fire at a Berlin metals plant run by Diehl, which makes IRIS-T air-defence systems for Ukraine, was assessed by CSIS as likely Russian sabotage, though German authorities said afterwards that no conclusive evidence was found. Several Rheinmetall military trucks were set alight near Erfurt in June 2025.
Germany's domestic intelligence service launched a public campaign in September 2025 under the slogan "Don't become a disposable agent", warning that Russian services use messaging apps and social networks to find people willing to spy or sabotage. The Federal Criminal Police Office said such recruits work for small sums, usually without knowing who directs them. BfV head Sinan Selen said in December 2025 that Germany is targeted more heavily than other countries because it is a logistics hub for collective defence, and warned of escalation around the 2026 state elections. Prosecutors arrested a Kazakh national in Berlin in April 2026, accusing him of passing his handler details of German military aid to Ukraine and photographs of NATO convoys, and of volunteering to find further recruits.
Fire destroyed the Marywilska 44 shopping centre in Warsaw in May 2024, gutting some 1,400 shops, and Prime Minister Donald Tusk and prosecutors confirmed a year later that Russian intelligence had ordered and coordinated it, with locally recruited perpetrators and suspects detained as far away as Lithuania. Polish authorities arrested nine people in May 2024 over sabotage ordered by Russian services, and by October 2025 said more than 30 suspects faced trial. A Russian-directed ring broken up in 2023 had been photographing rail routes and planning to derail arms transports near Rzeszów, the logistics gateway for Western aid.
Estonia's Internal Security Service linked to the GRU a network that smashed the cars of Interior Minister Lauri Läänemets and a Delfi journalist and defaced memorials, identifying 11 people, of whom seven were convicted. The organiser, Allan Hantsom, received six and a half years. Estonian courts separately convicted Andrey Makarov of treason over a staged arson of a Ukrainian-plated car filmed for Telegram, jailed two Moldovan cousins for firebombing a Ukrainian restaurant in Tallinn on GRU orders, and convicted University of Tartu professor Vyacheslav Morozov of years of spying for the GRU. State prosecutor Triinu Olev-Aas said the attackers are increasingly "unknown foreigners" rather than locals known to police. Estonian prosecutors have asked for the law to be tightened, because the damage to the two cars totalled €2,663 and fell below the €4,000 threshold at which criminal damage becomes an offence.
Latvia's state security service moved in 2025 to prosecute an arson group it said was "formed on the initiative of a Russian intelligence agency" and had torched a defence-project facility before scouting military sites. Young men recruited over Telegram from 2022 had earlier been tied to surveillance of military and air-base installations. Lithuania charged six people in January 2026 over a GRU-directed attempted arson at a factory supplying Ukraine's forces.
A Colombian national was sentenced in the Czech Republic in June 2025 to eight years for setting three Prague city buses ablaze on instructions and payment relayed through Telegram, in what then prime minister Petr Fiala said was likely organised and financed from Russia. Fire destroyed two buildings at LPP Holding in Pardubice on the night of 19 to 20 March 2026, a company producing drones and thermal optics exported to Ukraine, with damage the firm put in the hundreds of millions of Czech korunas. A previously unknown group calling itself The Earthquake Faction said it set the fire to protest the war in Gaza, posting video from an X account created the day before the attack and describing the site as an Israeli weapons plant. LPP has said its 2023 plan to work with Israel's Elbit Systems was never implemented and that its active contracts were for Ukraine. Czech and Polish authorities have detained at least seven people, including Egyptian, Czech, U.S. and Polish nationals, and charged several with terrorism offences. Suspects have denied involvement, one through a lawyer asserting an alibi, and Czech investigators are examining whether the pro-Palestinian framing concealed Russian direction. No such direction has been established in court.
Attackers threw Molotov cocktails at the Delair drone plant at Labège near Toulouse on 1 June 2026, Le Parisien said, though the mixture failed to ignite and damage was minimal. A Belarusian citizen was detained near the site days later on suspicion of spying on the company.
The defected Russian helicopter pilot Maxim Kuzminov was found shot dead in Spain in February 2024, in what Western analysts assessed as a likely SVR assassination on European soil.
Provocations staged as protest
Roughly 60 blue Stars of David were stencilled on buildings across Paris in late October 2023, in the first weeks of the Gaza war. A Moldovan couple was caught in the act and told investigators, in the Paris prosecutor's words, that they were "acting under orders from a third person and for remuneration". France formally blamed Russia's FSB in February 2024, working through the network of the fugitive Moldovan-Israeli oligarch Ilan Shor, and Moldovan police said the operatives had been given a cover story that a Jewish group requested the job. France's disinformation watchdog Viginum found that 1,095 automated accounts pushed some 2,589 posts amplifying the graffiti, and that the bots began posting around 48 hours before organic discussion emerged, meaning the amplifiers knew the stunt was coming.
Red handprints evoking a lynching were daubed on the Wall of the Righteous at the Paris Shoah Memorial on 13 May 2024. Four Bulgarian nationals were prosecuted and sentenced to prison in October 2025, having been recruited for small sums and coordinated in Russian over Telegram. Five coffins draped in French flags and marked as French soldiers of Ukraine were left at the Eiffel Tower on 1 June 2024; the men who placed them said they had been paid €400, and France's foreign-intelligence service, the DGSE, assessed that the FSB coordinated the stunt. Investigators found the same recruit appearing in more than one operation, evidence of a small, reusable proxy pool rather than organic outrage.
Operatives are typically witting about the criminal act but kept ignorant, through chains of middlemen, of who directs them, so a paid vandal genuinely may not know whether the order came from a criminal network or an intelligence service.
Russia did not create Europe's protest movements or its real divisions over Gaza, researchers who track the operations say. Russian state media and influence networks amplified contradictory Gaza narratives at the same time, boosting pro-Palestinian grievance framing and antisemitic provocation in parallel, an approach researchers describe as playing both sides of a genuine social divide to widen it. The staged stunts also hand Israeli officials a ready argument that pro-Palestinian mobilisation is a Kremlin product, which discredits the movement and its demands.
Parcels and the aviation test
Four parcels containing homemade incendiary devices were mailed from Vilnius on 19 July 2024 through DHL and DPD. One ignited at the DHL freight hub at Leipzig airport in Germany early on 20 July, before loading onto an aircraft bound for Britain. A second burned on a DPD truck crossing Poland, a third caught fire at a DHL depot in Minworth near Birmingham, and a fourth failed when its detonator burned out. Investigators found the charges concealed in vibrating massage pillows and cosmetics containers, set off by electronic timers, and CSIS described the material as a magnesium-based flammable substance.
Lithuanian, Polish and German prosecutors concluded the fires were a trial run to test whether such devices could be slipped onto cargo aircraft bound for the United States and Canada. Two test parcels were dispatched toward North America and two more intended for those countries were intercepted in the Netherlands. Lithuania's prosecutors and criminal police named Ukrainian citizen Daniil Gromov, whose Russian documents were issued under another name, and Lithuanian-Russian citizen Tomas Dovgan Stabacinskas as coordinators, said six kilograms of explosives were recovered, and charged 15 people. Deputy General Prosecutor Arturas Urbelis later put the number of identified suspects at 22.
A Vilnius court opened the trial of five defendants on 17 April 2026, aged between 23 and 69 and holding Lithuanian, Russian and Ukrainian citizenship. Prosecutors allege the operation was organised by people linked to the GRU, with the defendants acting as perpetrators and intermediaries, and told the court that at least 16 related criminal acts may have been planned across Europe, coordinated through a Eurojust joint team spanning Lithuania, Poland, Germany, the Netherlands and the UK. All five deny the charges. A parallel trial of five men opened in Warsaw.
Germany's domestic intelligence chief and the head of its foreign service warned parliament in October 2024 that Russian sabotage was rising in quality as well as quantity, citing the incendiary packages by name. MI5 director general Ken McCallum said the GRU was on a "sustained mission to generate mayhem on British and European streets".
Plots against arms-industry executives
German security services treat months of surveillance on Stefan Thumann as preparation for an assassination, Die Zeit reported on 5 August 2026. Thumann heads Donaustahl, a Bavarian firm making reconnaissance and attack drones for Ukraine. A partner intelligence service warned Germany in December 2025 that his life was in serious danger, and between that month and March 2026 two people photographed and filmed his home and the company's registered address and compiled material about him online, according to investigators.
Bavarian police detained the first suspect, a Ukrainian identified as Serhii N., a former bricklayer from Kharkiv with no intelligence training, and released him before his phones had been examined. Analysis of the devices later showed contact with a Russian intelligence service and attempts to trace his father in Starnberg as a route to locating him. By then he had moved to Spain with his family. A Romanian woman identified as Alla S. continued the surveillance in Germany, and investigators do not regard her as a trained officer. Both were arrested in March 2026, Serhii N. in Spain and Alla S. in North Rhine-Westphalia.
The federal prosecutor's arrest warrants cite suspected intelligence-agent activity for a foreign service rather than a planned killing, because a federal investigating judge was not persuaded on the higher charge, though the BfV treats the case as a planned assassination. Lawyers for both suspects declined to comment. Thumann is under personal protection, his risk assessed as very high, and Interior Minister Alexander Dobrindt is briefed on the case continuously.
Serbian officers stopped two men near Subotica on the Serbian-Hungarian border on 11 June and found concealments for explosives built into their truck, contacts with a Russian intelligence service on their phones and an apparent destination in Bavaria, the state that also hosts the drone makers Quantum Systems and Helsing. At least one further German arms company is under Russian intelligence attention, and investigators do not rule out that another executive's life is at risk.
Bavarian police arrested a 33-year-old Ukrainian in Thuringia on 2 August 2026, saying he had filmed a Bavarian arms manufacturer in June and offered the images to his handlers, and that he was a "low-level agent" working for a foreign power's intelligence service. He has been remanded in custody.
U.S. and German intelligence disclosed in July 2024 that they had disrupted a Russian plot to kill Armin Papperger, chief executive of Rheinmetall, Germany's largest arms maker and a principal supplier of shells and vehicles to Ukraine. NATO's deputy assistant secretary-general for innovation, hybrid and cyber, James Appathurai, told the European Parliament on 28 January 2025 that the alliance had recorded "threats to plot to assassinate industry leaders", naming Rheinmetall's chief and saying other plots existed, the first on-record confirmation by a NATO, German or U.S. official. Germany gave Papperger protection at the level afforded the chancellor. Focus reported in March 2026 that Putin had named Papperger four times at a March 2024 meeting with senior army and GRU officers in Rostov-on-Don, calling him a provocateur and a backer of Ukraine, and that the remarks alarmed German agencies. The Kremlin denied involvement in the plot. Appathurai also said the West had sometimes deterred sabotage by setting red lines privately at the highest level, citing the interception of incendiary devices bound for DHL flights.
Rails, cables and airspace
Deutsche Bahn fibre-optic cables were cut at two locations in October 2022, halting rail traffic across northern Germany for hours in an attack German officials suspected involved inside knowledge. The most serious case came in Poland on 16 November 2025, when a C-4 charge detonated under a freight train on the Warsaw-Lublin line near Mika, a key military-supply corridor, and a second act of sabotage brought down power lines near Puławy on the same route. Tusk said it was an "unprecedented act of sabotage" and Foreign Minister Radosław Sikorski called it an act of state terror. Two Ukrainian nationals accused of long collaboration with Russian services crossed into Belarus hours after the attack and face charges of sabotage of a terrorist nature; several others have been detained.
The Balticconnector gas pipeline between Finland and Estonia, and nearby telecom cables, were severed on 7 and 8 October 2023 by the anchor of the Chinese container ship NewNew Polar Bear; Finnish investigators concluded it was anchor drag. Two fibre-optic cables, the C-Lion1 between Finland and Germany and the BCS East-West between Lithuania and Sweden, were cut on 17 and 18 November 2024 as the Chinese bulk carrier Yi Peng 3 passed over them; investigators from five countries boarded the ship, which was later released. The Estlink 2 power cable and four telecom lines were damaged on 25 December 2024, and Finland detained the Eagle S, a tanker linked to Russia's shadow fleet, recovering an anchor and seabed drag marks after the vessel dragged it nearly 90 kilometres.
Helsinki District Court found in October 2025 that the Eagle S officers had committed aggravated criminal damage but ruled that Finland lacked jurisdiction over an incident in its exclusive economic zone, leaving the Finnish state to pay about €195,000 in defence costs. The court also concluded that the anchor loss resulted from a technical fault rather than deliberate action. Prosecutors appealed, and the ruling has alarmed maritime lawyers, who note that a permissive flag registry combined with no coastal-state jurisdiction leaves cable cutting outside territorial waters effectively unpunishable. Estlink 2 was not repaired until early August 2025, after an outage of more than seven months, at a cost of up to €60 million.
Finnish police detained the cargo ship Fitburg on 31 December 2025, hours after damage to an Elisa telecom cable between Helsinki and Tallinn, having found its anchor chain lowered and evidence that it had dragged for tens of kilometres. The 132-metre vessel, flagged in St Vincent and the Grenadines, was sailing from St Petersburg to Haifa with a crew of 14 from Russia, Georgia, Azerbaijan and Kazakhstan, and was carrying structural steel that Finnish Customs assessed to fall under EU sanctions. One crew member was held in custody, three were placed under travel bans, and the ship was released on 12 January 2026 with the investigation continuing.
GPS jamming attributed to Russian electronic-warfare systems around Kaliningrad and the Gulf of Finland became a near-daily feature of the eastern Baltic from 2023, affecting tens of thousands of flights. Finnair suspended its Helsinki to Tartu route for a month in late April 2024 after two flights had to turn back because the Estonian airport's satellite-dependent approach was jammed. Estonia named Russia directly.
Drone incursions closed airports across Denmark, Germany, Norway and beyond from September 2025. IISS published a dataset on 2 July 2026 covering 144 suspected sightings across 13 European states between August 2024 and February 2026, and assessed it highly likely that the Kremlin ran a drone campaign over Europe, using Russian-linked vessels and the shadow fleet as launch and recovery platforms. About 48 per cent of sightings occurred over military facilities, 18 per cent over civilian airports and 26 per cent over ports, energy sites and other critical infrastructure. Reported incidents jumped from an average of four a month to 22.5 a month between September and December 2025, with Germany alone recording 58. Copenhagen, Munich, Oslo and Vilnius airports were among those forced to close.
French naval commandos boarded the tanker Boracay on 28 September 2025 and found two employees of a Russian private military company aboard. The clearest single case came on 26 February 2026, when the Swedish military jammed a drone launched from the Russian signals intelligence ship Zhigulevsk toward the aircraft carrier Charles de Gaulle during a port visit to Malmö. IISS said the campaign was a series of "tactical successes for the Kremlin and a strategic failure of allied air defence", and cautioned that not every sighting was necessarily Russian, while concluding that misidentification and hobbyists could not account for the aggregate. Sweden is the only state to have publicly blamed Russia for a specific incident, and Vladimir Putin denied in May 2026 that Russia is running a sabotage campaign against Europe.
Russian aircraft have also entered NATO airspace directly: 21 drones over Poland on 9 and 10 September 2025, several shot down by NATO aircraft, and three MiG-31 jets over Estonia on 19 September.
The information front
The EU created a dedicated sanctions regime for Russian destabilising activities on 8 October 2024 and listed troll farms and disinformation firms alongside the GRU's sabotage unit, naming Unit 29155 in the same instrument as the Doppelganger operation that December. Later rounds bundled in influencers promoting pro-Russian propaganda, an electronic-warfare battalion in Kaliningrad and a state hacking group. The regime covered 69 individuals and 17 entities after listings on 16 March 2026, and the Council sanctioned a further nine individuals and four entities over cyberattacks on 13 July 2026. European authorities treat the online campaign against Ukraine and the EU as one effort with the sabotage, by different means.
Doppelganger has run since 2022. It registers look-alike domains impersonating real outlets, among them Der Spiegel, Le Monde, The Guardian, Bild and Fox News, copying their layout down to the cookie banner, then publishes fabricated articles carrying Kremlin narratives and floods social media with bot accounts to spread them. Meta, which disrupted it in 2023, called it the largest Russian influence operation it had confronted. Western governments have named the machinery: the Moscow public-relations firm Social Design Agency, the IT company Structura, and the individuals Ilya Gambashidze and Nikolai Tupikin, operating under the direction of the Russian presidential administration according to the U.S. Justice Department. The U.S. Treasury sanctioned the firms and men in March 2024, the Justice Department seized 32 internet domains that September, and the Treasury designated the hosting provider AEZA Group in July 2025.
Doppelganger inherits from Prigozhin's Internet Research Agency, the St Petersburg troll factory indicted by U.S. prosecutors over the 2016 election, which he admitted in 2023 he had founded and financed. After his death the apparatus fragmented into successor operations, several built around generative AI. Viginum and independent researchers have documented Storm-1516, which manufactures fake whistleblower videos and fabricated news, and CopyCop, which uses open-source AI models to spin up hundreds of impersonation news sites in multiple languages, with the U.S. Treasury tying its financing to the GRU. Bloomberg, working with Clemson University's Media Forensics Hub, catalogued Storm-1516 output from August 2023 to March 2026 and found more than 40 per cent of its stories aimed at undermining support for Ukraine and a third targeting elections in other countries.
Operation Overload, also called Matryoshka, exists to exhaust journalists and fact-checkers: it emails fabricated content directly to newsrooms demanding verification, impersonates trusted media and experts, and floods platforms, exploiting the asymmetry that inventing a lie is cheap while debunking it is slow. CheckFirst and Reset Tech obtained a dataset showing around 71,000 such emails sent to newsrooms and fact-checkers between January and September 2024, and CheckFirst has itself recorded more than 700 targeted emails and nearly 600 unique pieces of falsified content since September 2024, misusing the logos of 180 organisations and the identities of more than 180 public figures. The Institute for Strategic Dialogue, tracking the same operation through 2025, found platforms removing the large majority of its posts, which limited its reach even as its output grew.
Platforms and amplification
Researchers who track Doppelganger, at EU DisinfoLab, the Atlantic Council's DFRLab and NewsGuard, identify X as the network's primary seeding and amplification platform. Trust-and-safety teams were cut after Elon Musk took control in 2022, previously banned accounts including many that pushed pro-Russian and anti-EU content were reinstated, and paid verification gave anyone willing to pay a monthly fee algorithmic priority, letting a handful of subscriber accounts drive millions of views of false claims that Community Notes rarely caught.
The European Commission opened proceedings against X under the Digital Services Act in December 2023 and fined it €120 million on 5 December 2025, the first non-compliance decision issued under the law, for deceptive design of the blue checkmark, an advertising repository that hides who is paying, and barriers that stop researchers accessing public data. X was given 60 working days to fix the checkmark and 90 to submit a plan on the other two, and the wider investigation into illegal content and information manipulation remains open. The fine concerns transparency and design rather than any legal finding that X spreads Russian propaganda, and the two should not be conflated, though both the design permissiveness and the amplification are documented.
Musk floated Kremlin-aligned peace terms in October 2022 that drew a public rebuke from Volodymyr Zelenskyy, and has said he declined a request to extend Starlink coverage near Sevastopol for a Ukrainian attack on Russian warships. In 2025 he amplified false material about Zelenskyy's popularity and drove the shutdown of USAID, a major funder of Ukraine's civil sector. NBC News documented him engaging at least 60 times with content from Tenet Media, the outlet the U.S. Justice Department said in September 2024 had been covertly funded with nearly $10 million routed from the Russian state broadcaster RT; the indictment described the USian commentators involved as deceived rather than knowing participants, and no public evidence indicates Musk knew of the funding. He also positioned himself as pro-Israel after October 2023, visiting the country, meeting Benjamin Netanyahu and agreeing that Starlink in Gaza would operate only with Israeli approval, a visit that followed his own endorsement of an antisemitic post he later called a mistake.
Canada on the target list
Public Safety Minister Dominic LeBlanc's office said in late October 2024 that Canada had raised the incendiary-parcel plot directly with Russian officials and that "any threat to the safety and security of Canadians is unacceptable", while adding there was no imminent threat. Two of the test devices in that plot had been routed toward North America and two more intended for the United States and Canada were seized in the Netherlands. Transport Canada tightened air cargo screening alongside the United States Transportation Security Administration in the weeks that followed.
The Canadian Security Intelligence Service wrote in its 2025 public report that Russia had been seeking to undermine Canadian support for Ukraine since the 2022 invasion, using hybrid methods spanning espionage, sabotage and influence operations, and was willing to act covertly while accepting the risk of collateral damage. Russia ran information and influence operations against Canada through networks of proxies who amplify Kremlin messaging on social media, the service said, and kept procuring export-controlled and sanctioned Western technology from suppliers that included Canada, among it microelectronics, satellite communication technology and precision firearms for the war.
Espionage and attempted sabotage against Canada continued through 2025, CSIS wrote in the same report, and the service said Canada is "considered a legitimate target" as a NATO member that actively supports Ukraine. Its mitigations run from denying entry to Canada to working with foreign partners against Russian agents in Europe. CSIS named GRU Unit 26165, also known as APT28 or Fancy Bear, as hacking email accounts, stealing information and disrupting companies involved in delivering aid to Ukraine, and said Russia-aligned non-state actors have run cyber attacks on critical infrastructure in NATO countries, occasionally achieving disruptive effects.
Foreign Affairs Minister Mélanie Joly said on 13 September 2024 that RT, the Russian state broadcaster, was recruiting Western commentators and influencers, among them Canadians, to produce anti-Ukraine content, and was managing cyber actors who ran information operations against Western targets including Canadian critical infrastructure. The Communications Security Establishment assessed before the April 2025 federal election that Russia was likely to lean on cheap, AI-assisted influence efforts if it moved against the vote, and that Canada's support for Ukraine would shape whether Russia tried.
Doppelganger published fabricated articles attacking Justin Trudeau and the Liberal Party that United States and European officials flagged in September 2024. Tenet Media, the Tennessee outlet covertly funded with RT money, was founded by two Canadians, the commentator Lauren Chen and Liam Donovan, and Canada's foreign interference inquiry was asked to examine it.
The objective
Indrek Kannik, director of Estonia's International Centre for Defence and Security, said the campaign was "terrorism in its purest form". Richard Moore, then head of MI6, told a Financial Times panel that Russia "can't use their own people" and was leaning on criminal proxies that Western services could often dismantle. Marta Tuul, a spokeswoman for Estonia's internal security service, said the attacks were meant to "cause fear, discontent, and confusion in society". Dutch military intelligence, reporting the first observed Russian sabotage attempt against Dutch critical infrastructure in April 2025, said the Europe-wide campaign was close to "state terrorism".
Prosecutors in Latvia, Lithuania and Estonia have formed joint investigation teams for attacks organised by foreign intelligence services, and UK front-line police are being trained to spot incidents that may be state-backed. European officials say more plots are being thwarted than carried out, though each one still pulls investigators off other work.
Fighting back
Volunteers, hacktivists and open-source investigators have pushed back against the recruiters, troll farms and saboteurs of this campaign since the first days of the invasion, working to blunt Russian operations and to fund Ukraine's defence. Their methods run from denial-of-service attacks and data leaks to geolocation, fact-checking and crowdfunding for drones and medical kit.
Anonymous declared cyber war on the Russian government within days of the invasion, RT acknowledged a large denial-of-service outage in late February 2022, and document dumps attributed to the collective appeared on leak sites worldwide. Ukraine's IT Army, stood up on 26 February 2022 by digital-transformation minister Mykhailo Fedorov, posted target lists to a Telegram channel that drew hundreds of thousands of volunteers, and its crowdsourced denial-of-service operations knocked Russian banks, government services and payment systems offline at various points. Adjacent efforts range from the Belarusian Cyber Partisans, who hacked Belarus's railway in January 2022 to slow Russian troop trains, to Squad303's tools for texting ordinary Russians.
NAFO emerged around May 2022 as a decentralised swarm of volunteers identified by cartoon Shiba Inu avatars, who descend on pro-Kremlin accounts to mock, fact-check and drown out their messaging, fighting the troll farms from the other side of the same front. Russia's own arms-control envoy Mikhail Ulyanov handed the movement its catchphrase when he engaged a cartoon-dog account and said "You pronounced this nonsense. Not me". Alongside the mockery, NAFO raise money for drones, vehicles and medical kit through fundraising brands such as Saint Javelin and units including the Georgian Legion, and Ukraine's defence ministry has publicly thanked them. The fundraising is concrete and countable; the effect of counter-trolling on any given disinformation campaign is not, and the movement's diffuseness makes it hard to measure.
YourAnonCentral, is one of the largest anti-Kremlin Anonymous accounts, operating outside Ukraine's own hacker networks. It has run since September 2011, with roots in the Arab Spring, Occupy and the Take the Square movement, and it traces its campaign against Russia to #OpRussia in March 2014, when Anonymous accounts answered the annexation of Crimea with denial-of-service attacks, defacements and data leaks. The security firm Bitdefender documented a 495-megabyte leak from the Russian state contractor crownservice.ru on 5 March 2014, and CNN described a proxy cyber war between rival hackers over Crimea that month.
YourAnonCentral reported thatRussia and adjacent actors had answered #OpRussia and #OpDeathEaters, the victim-led open-source investigation into child sexual abuse, trafficking and blackmail networks founded by Heather Marsh, by flooding the Anonymous name with fake channels, botnets and conspiracy content, capturing the label and discrediting the operations. A tactic seen again in personas such as Guccifer 2.0, which the 2018 U.S. indictment of 12 GRU officers identified as a GRU front. Through the war it has promoted donations to Wild Hornets, a Ukrainian maker of interceptor drones, and to United24's Safe Skies project, and puts its own contribution well into the hundreds of thousands of dollars toward Ukrainian air defence and frontline supply, drawn from a following of more than five million.
Bellingcat identified the GRU officers behind the 2018 Salisbury poisoning and spent years mapping Unit 29155, building much of the evidence base that prosecutors now draw on. The Centre for Information Resilience and geolocation communities have verified thousands of incidents that would otherwise stay deniable. EU DisinfoLab exposed Doppelganger in 2022, Viginum documented the Matryoshka and Storm-1516 networks, and OCCRP's undercover contact with Privet Bot in July 2024 set out the recruitment script 15 months before the Old Bailey sentenced the six men that same script produced in London.
Ukraine's IT Army still posts target lists to the same Telegram the recruiters use to hire arsonists, and volunteer funds keep equipping its frontline units. The NAFO 69th Sniffing Brigade is sending much-needed equipment to Ukraine's International Legion, including buses, drone detectors and jammers able to neutralise drones in flight.
European services have traced 145 incidents to Moscow since the 2022 invasion, the SBU has logged more than 1,400 commissioned crimes since 2023 and courts from London to Munich have turned dozens of the recruited proxies into named defendants. German officers still guard Rheinmetall's chief executive at the level afforded the chancellor, and Vladimir Putin said in May 2026 that Russia was running no such campaign.European services have traced 145 incidents to Moscow since the 2022 invasion, the SBU has logged more than 1,400 commissioned crimes since 2023 and courts from London to Munich have turned dozens of the recruited proxies into named defendants. As the war in Ukraine continues, Russia grows bolder in its attack on Europe and Canada.
