Short-lived Telegram accounts used to recruit EU saboteurs, report says
Some Telegram “job postings” are recruiting saboteurs.
Image by Cybernews
- Telegram accounts are allegedly offering money for sabotage acts across Europe, according to an investigation by Vot Tak.
- Recruiters are targeting local criminals with payments ranging from $500 to $7,000 for attacks and surveillance tasks.
- Short-lived Telegram accounts are spreading millions of sabotage-related listings across Ukraine and other regions.
- Authorities have linked online recruitment to previous sabotage cases targeting European infrastructure and Ukrainian interests.
Millions of sabotage-related "job postings" are being spread through short-lived Telegram accounts as Russia expands its recruitment efforts beyond Ukraine, according to a new investigation. The campaign is now targeting recruits across the European Union.
An investigation by Vot Tak, the Russian-language arm of the Polish broadcaster TVP World, found that recruiters on Telegram are now offering $500 to $7,000 for acts of sabotage not only in Ukraine but also in various EU countries.
They are recruiting local criminals via Telegram and searching for targets such as military vehicles and cars with Ukrainian registration plates, among others.
For example, the journalists of Vot Tak pretended they lived near a NATO base in Lithuania. They were asked by a recruiter to "come closer" and "film a little," with the recruiter offering an unspecified payment for this kind of "service." They were also offered $500 for proof that drones targeting Russia are being launched from Lithuania.
More from Cybernews
Sainsbury’s installs more facial rec tech in stores: Should shoppers be worried?
"Phantom squatting” uses AI hallucinated domains for cyber attacks
What they’re doing to gamers is a robbery in broad daylight
Irish parliament expands Microsoft use, despite the EU’s efforts to ditch it
Can government AI actually scrub UAP footage from the internet?
The EU and Apple CEO Tim Cook held "constructive" talks after their Siri AI dispute in Europe
Meanwhile, according to the investigation, $3,000 was promised for attacks on Ukrainian-linked sites in Poland, with similar sums offered for arson against Ukrainian organizations in Latvia.
The report claims that this type of criminal recruitment offering has been live on Telegram for more than a year, mostly operating in Ukraine. Similar offers targeting EU countries began appearing in mid-2026.
What's more, according to Vot Tak, similar "job postings" are spreading among Russian-speaking communities in the United States, the Gulf region, and Southeast Asia as well.
The investigation also showed that there are millions of "job postings" for sabotage-related roles in Ukraine and other countries. The postings are shared by dedicated Telegram accounts that remain active for only a few days and are registered to phone numbers in India, Iran, or Gulf countries.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
While it is not clear how successful these types of recruiters are, multiple reports have already indicated possible acts of sabotage. For example, German police have recorded hundreds of acts of sabotage against critical infrastructure, including energy networks.
Additionally, Polish intelligence has confirmed that the Warsaw shopping mall arson in 2024 was directly financed and ordered by an operative from Russia's military intelligence, who hired mercenary arsonists via online channels.