EU passport is not a shield from the recruiter: how Russia searches for performers for sabotage through social networks
IA “FACT” already wrote about a series of suspicious packages with ignition devices that caught fire during delivery last summer in Europe. Three packages exploded in courier warehouses, one of which caused a fire at DHL’s cargo hub in Leipzig, and another was stopped pending activation. Inside the parcels that arrived from the Baltic states were pillows, gel tubes, sex toys and cosmetics that actually contained explosive magnesium, nitromethane and chemicals with detonation timers.
The Federal Prosecutor’s Office of Germany investigated these diversions, but officially the word “Russia” was not mentioned in the warnings. However, in security circles, the activity of Russian saboteurs and spies in Germany has increased, especially in logistics centers and near military facilities, including NATO bases.
Following this incident, DHL has increased security measures across Europe. German special services warned aviation and logistics sectors about “unconventional incendiary devices” and attacks on critical infrastructure. At the same time, concerns about the use of drones for reconnaissance and potential attacks have grown: drones — presumably of Russian origin — are increasingly being spotted over Bundeswehr facilities, including bases where the Ukrainian military trains.
At present, the law enforcement officers have no doubt that the series of parcel bombings in Poland, Germany and Britain is behind it stand Russian special services: recruited performers, including Ukrainians, were involved in their organization.
The Kremlin’s hybrid mail: how Russian special services recruit couriers for terrorist attacks in the heart of Europe
According to the data sources, the GRU is involved in terrorist attacks. Curators operated through Telegram, paying performers several thousand euros each. One of the detainees is Ukrainian Vladyslav D., who lived in Poland. He received instructions from an agent called “Warrior”. In Lithuania, Vladyslav activated explosive devices in packages and handed them over to an accomplice in Vilnius. He was arrested in August and charged with terrorism.
Another figure, Oleksandr B., is suspected by the investigation of preparing attacks on cargo flights to the USA and Canada. He had to collect data on the logistics of parcels and organize their shipment allegedly with clothes and sneakers.
These are illustrations of the same hybrid war that Russia is waging in the very heart of Europe. Under the guise of ordinary packages filled with household trinkets, death was delivered to Europe. The organization of disguised terrorist attacks was brought to the level of logistical art.
This war is fought not only in the trenches, in the air, at the bottom of the ocean and on TV screens. It breaks into warehouses, logistics centers, postal sorting hubs. Its soldiers are not only GRU officers, but also recruited civilians. Its routes are courier services, and its targets are critical NATO infrastructure, Bundeswehr facilities, and sometimes just civilian cargo.
In today’s hybrid warfare, Moscow has long moved away from schemes with diplomatic cover or deeply conspiring agents. Instead, the Kremlin is active attracts for recruiting TikTok, Telegram, WhatsApp. Networks in which cats, memes and friendly chats were posted in peacetime, turned into to the most dangerous hunting ground. Not for influencers, but for those who have a European passport, legal status in the country of residence — and at the same time financial or psychological vulnerability.
Russian special services are working with the precision of marketing agencies: looking for target audiences and offering what they want. “Work without documents”, “earnings online”, “no questions” – these are the slogans that lure you to the first contact. People who were just looking for a part-time job for a week suddenly find themselves in a conversation with a “curator”, which only requires performing a few simple actions: deliver a package, transfer coordinates, buy a SIM card, take a photo of a certain object. All for a “reward”, which is many times higher than what they were offered in construction, pizza delivery or elsewhere “in the real sector”.
This is not the first time in Polish, Czech, German, and Belgian Telegram channels reveal messages that are “bait” from the GRU: work as a driver, delivery of “important engineering cargo”, sometimes even with a patriotic connotation (“helping people in Ukraine”). And after a few days, the negligent applicant is already arrested with evidence of involvement in sabotage.
Because they are invisible. A Ukrainian with a residence permit in Warsaw or Berlin does not arouse suspicion. He is not a citizen of the Russian Federation, does not appear in the bases of border guards as a potential threat. His phone, route, lifestyle are quite typical. And that is why such an agent is ideal. They are not looking for him, because he is already “theirs”.
Formally, he is a courier. But in fact, it is a link in the chain leading to the Kremlin. And this logic perfectly fits the philosophy of hybrid warfare: a saboteur is not necessarily an agent with special training, he is a random acquaintance from the “help with moving” chat.
After the full-scale invasion of Russia, the GRU’s tactics changed. Instead of its own officers, which are increasingly difficult to hide after the revelations and mass expulsions of diplomats, Moscow began act through intermediaries – the so-called “agents-group leaders”. They rule from the territory of the EU, recruit performers through social networks, coordinate arson, sabotage, anti-Semitic provocations, and they themselves remain in the shadows.
Such diversions have already become commonplace in European capitals. In Riga set fire to Museum of Occupation, the trail led to a prisoner who acted on the orders of GRU officer Volodymyr Lipchenko. There is a whole group of Moldovans in Paris was drawing stars of David on the facades; according to them, the curator approached them through TikTok, offered 250 euros and introduced himself as an activist of a Jewish organization. In fact, the special services were behind everything.
The operations are not carried out by agents in suits, but by ordinary people with EU passports who are looking for work or want a quick income. They are given small tasks, paid in cryptocurrency, and in case of failure, they simply disappear from the chats. This is how the Kremlin destabilizes, incites discord, disrupts support for Ukraine. European security services are recording more and more such cases, but while they are responding, the following message has already been sent: “Greetings. There is work. Write if you are interested”.
Moscow deploys cynical, sophisticated and insidious game on the European field. Russian special services coldly use Ukrainian citizens as living weapons in their information war against Ukraine. By involving them in provocations and sabotage on the territory of the EU countries, the Kremlin is trying to sow distrust, distort the image of Ukrainians and turn the victim of aggression into a suspect.
This is not just an attack, it is an attempt to rewrite reality. Russia wants to force Europeans to see the Ukrainian diaspora not as refugees who fled the war, but as “sleeper agents”, a dangerous force that supposedly poses a threat to European security. This is a game on prejudices, a strategy of disunity: to weaken solidarity, dilute support, undermine faith in the justice of the Ukrainian resistance.
Behind this scenario is one goal — to isolate Ukraine. Moscow wants the Western world to tire, become indifferent and turn away. So that only silence remains instead of help. And that is why it is so important not to be silent. Stop them from creating a false narrative. Don’t let those who fight for freedom be lied to.
…Russia is waging a new form of hybrid warfare in Europe — through anonymous messengers, cryptocurrencies, and courier packages, the Kremlin is recruiting Ukrainians and Europeans to subvert to undermine trust, sow fear, and provoke division in societies. Arson attacks, explosives, attacks on logistics are not just acts of terrorism, but a strategy of psychological pressure disguised as everyday life. The enemy acts without form or front, but with a clear goal: to destroy unity, sow xenophobia and turn trust itself into vulnerability.
Tetyana Viktorova
