Disposable: The ordinary people doing Russia’s dirty work

According to tovima.com, hostile intelligence services are outsourcing their dirty work to completely deniable freelancers rather than relying exclusively on trained, elite GRU or FSB officers who are difficult to replace and politically toxic if caught. These individuals are commonly referred to as disposable agents and act as the gig workers of covert operations. Recruitment has included individuals from former Soviet republics such as Belarusians, Moldovans, and Ukrainians. This recruitment frequently takes place online, using messaging platforms like Telegram, gaming forums, TikTok, and Snapchat to post seemingly harmless advertisements seeking quick tasks. Payments range from a few hundred to several thousand euros for assignments that can escalate from photographing facilities or painting graffiti to vandalism, arson, or sabotage against critical infrastructure.

A 2026 study by Bart Schuurman examined 145 low-level agents involved in Russian covert operations across Europe between 2022 and 2025. The study found considerable diversity in their backgrounds, with approximately 26 percent having previous criminal convictions. These findings challenge the assumption that recruitment primarily targets teenagers or young adults. Furthermore, the study revealed that 35.2 percent of the examined individuals had participated in multiple operations, demonstrating that the term disposable does not necessarily mean they are used only once. Recruits often have limited knowledge of the wider operation or the identity of those directing them, and some knowingly participate in illegal activities while others may be unaware they are working for a foreign intelligence service. Separating individual assignments through intermediaries reduces the risk that the arrest of one operative will expose the wider network.

Disposable agents present a distinct challenge to European counterintelligence services that have traditionally monitored suspected foreign intelligence officers, tracked espionage networks, and investigated individuals operating under diplomatic cover. Their activities often resemble ordinary criminal offenses rather than foreign-directed intelligence operations, making it difficult for authorities to recognize the broader threat and establish attribution. The cross-border nature of these networks further complicates investigations because individuals involved in the same operation may be recruited, directed, or investigated in different countries. Consequently, arresting a disposable agent does not dismantle the wider network, leaving the individuals responsible for recruiting, financing, and coordinating operations unidentified.

The European Union has developed its Hybrid Toolbox and the Critical Entities Resilience Directive to coordinate responses and strengthen essential infrastructure. In September 2026, European Commission President Ursula von der Leyen called for a European counter-hybrid playbook and an Emergency Security Protocol. Addressing the use of disposable agents requires European intelligence and law enforcement agencies to strengthen their ability to connect seemingly isolated incidents across national borders. Existing mechanisms including Europol, Eurojust, and the EU’s Single Intelligence Analysis Capacity can support cooperation, while financial intelligence tracking payment flows through conventional banking, cash, or cryptocurrencies can help uncover links between operatives and coordinators. Closer cooperation with digital platforms for early detection, alongside public awareness campaigns informing individuals about deceptive recruitment methods, can also help reduce the available pool of recruits.