Poland’s intelligence chief has warned that Russia is scaling up hybrid operations across EU countries by recruiting radicalised youth, criminals, and foreign nationals online. Recent arrests from Berlin to Stockholm show the warning is not hypothetical.
Rafał Syrysko, head of Poland’s Internal Security Agency, said Russia is massively recruiting so-called “cheap agents” via the internet — individuals used for arson attacks, surveillance, intelligence gathering, and acts of sabotage. Poland has already recorded a growing number of such incidents. His assessment was reported by Ukraine’s Center for Countering Disinformation under the National Security and Defence Council.
“Radicalised youth, representatives of criminal circles, and foreigners are actively involved in such activities,” the CCD statement said, citing the Polish side’s assessment. “Some of the operatives may not even realise they are acting in the interests of Russian intelligence services.”
The Kremlin uses this model, analysts say, because of its simplicity, low cost, and the ability to minimise direct links to Russian intelligence. At the same time, Polish intelligence warned that Moscow is gradually moving toward creating more organised sabotage networks involving trained operatives — suggesting the current wave of low-cost recruitment is a transitional phase, not a ceiling.
Three Countries, Three Cases
The pattern Syrysko described is visible across EU territory in recent weeks alone.
In Germany, authorities arrested a Kazakh citizen identified as Sergej K. in Berlin on suspicion of spying for Russia, according to the German Federal Prosecutor’s Office. Prosecutors said he had been “in continuous contact from Germany with a Russian intelligence service” since at least May 2025, providing his handler with details about German military aid for Ukraine, including companies involved in developing drones and robotic systems. He also allegedly photographed NATO military convoys and public buildings in Berlin and offered to recruit additional agents.
The case fits a pattern German authorities have been tracking since 2022. Two German-Russian dual nationals were arrested in 2024 on suspicion of plotting sabotage attacks on US military sites in Germany. German police have separately arrested several “disposable” agents — individuals conducting espionage without formal training, paid small amounts for specific tasks. Berlin’s Foreign Office has said such operations are “completely unacceptable” and represent deliberate attempts to undermine Germany’s support for Ukraine.
In Sweden, the Swedish Security Service SAPO detained two individuals — a Swedish and a Turkish citizen — on suspicion of illegally supplying advanced engineering equipment to Russia in violation of EU sanctions, Reuters reported. Searches were conducted at multiple locations across Stockholm and southern and western Sweden. SAPO’s deputy head of operations Kristoffer Wedelin said plainly: “The Russian military industry depends on technology, including from Sweden, to continue its war of aggression against Ukraine.”
The Strategic Logic
Poland’s CCD analysis frames the overall objective clearly: by scaling up its hybrid war against the West, Russia seeks to destabilise Europe, undermine trust in state institutions, and reduce public support for Ukraine. The operational diversity across EU territory — arson in Poland, espionage in Germany, sanctions evasion in Sweden — is itself part of the strategy. Dispersed, low-attribution attacks are harder to respond to collectively than a single identifiable operation.
The shift toward more organised sabotage networks, which Polish intelligence flagged as an emerging trend, suggests Moscow is treating the current phase as preparation for something more structured. The cheap agents are not the endpoint. They are the recruitment pool.
