The Shadow of War in Europe: How russia Recruits Ukrainian Refugees

In September of this year, a fire broke out near the “Carfil SA” defense plant in Brașov, Romania. Recently, the Intelligence Service of Romania has found out that a network of agents directed by russian intelligence services was behind the arson. The suspects include one Ukrainian citizen and two belarusians. They were detained in the EU, where they were planning similar crimes.

This case is just one element of a broad hybrid campaign that russia is waging in European countries, using Ukrainians, among others, as agents. And although millions of our fellow Ukrainian refugees are law-abiding citizens, moscow is trying to find vulnerable individuals among them to replenish its pool of operatives for sabotage operations. That is why the impact of each such incident is quite significant – something the kremlin deliberately counts on.

In total, since 2022, approximately 200 acts of sabotage linked to russia have been recorded in Europe. The highest number of incidents (21%) occurred in Poland. More than 170 perpetrators have already been identified, including Ukrainians. All evidence points to the rf, but moscow traditionally denies any involvement in establishing agent networks for hybrid operations on EU territory.

The kremlin’s main objectives are to intimidate Europeans and undermine military aid to Ukraine. Therefore, Poland – through which the bulk of this aid passes – has become the main focus of russian intelligence services. Its railways, warehouses, logistics hubs, and defense enterprises feature in most of the known cases.

Why is the kremlin trying to use Ukrainians in particular? Firstly, because it wants to impose a toxic image on our refugees; secondly, to stir up anti-Ukrainian sentiment; and most importantly – to cover its tracks. Involving Ukrainians gives moscow a “plausible alibi”: the perpetrator is not only unconnected to russia but actually holds a Ukrainian passport.

russian secret services target refugees in vulnerable situations: low-income individuals, people from temporarily occupied territories, those with ties to organized crime, and teenagers looking for easy money. Recruitment most often takes place through social media and messaging apps, particularly in job-search chat rooms. Once contact is established, a russian handler assigns simple tasks: taking photos of a target, putting up stickers, and so on. Over time, the tasks become riskier: surveilling targets, damaging property, arson, or even bombings. The operatives are required to record the results on video to report back to their handler. Sometimes the saboteurs do not realize who exactly they are working for, and often receive no payment at all after completing a task. By the time the operation is over, the perpetrator has effectively committed a crime and is being controlled through blackmail. A bleak future awaits them: arrest and a lengthy prison sentence. russia uses such people as “torpedoes”, meaning it offers them no guarantee of cover or assistance after their sabotage operations.

Spy networks are exposed, and the operatives are apprehended fairly quickly; however, this has an effect: European intelligence services are forced to devote resources to protecting facilities and tightening security measures. For moscow, this is a fairly favorable cost-benefit ratio: a few hundred or thousand dollars per saboteur in exchange for tangible losses and pressure on European societies.

The Foreign Intelligence Service of Ukraine is actively countering this threat: it constantly exchanges information with European counterparts, helps identify the tactics and methods of russian intelligence services, and exposes recruitment channels and potential targets for sabotage.

To avoid becoming a recruitment target, one should be vigilant about new contacts who attempt to obtain personal information, offer “easy” money, or promise to “resolve” urgent financial problems. One indicator of communication with a representative of the enemy intelligence services is the requirement to keep the relationship confidential.

An effective way to avoid recruitment is to seek legal assistance from law enforcement agencies in your country of residence or from a Ukrainian diplomatic mission.

The recruitment of Ukrainians for hybrid operations in Europe is a systemic campaign. Its goal is to persuade Europeans that supporting Ukraine is too costly for them. In response, Europe must, on the contrary, remain strong and united in its support for Ukraine, improve its counterintelligence efforts, and strengthen accountability for aiding the enemy. After all, even the slightest sign of weakness always encourages russia to take increasingly aggressive actions.