Foreign Saboteurs Target Ukraine as Russia Recruits Vulnerable Individuals

A growing network of foreign nationals is being recruited to carry out acts of sabotage across Ukraine, with prosecutors revealing that 18 foreigners have been convicted on sabotage-related charges in 2024 alone. These individuals join hundreds of Ukrainian citizens convicted of similar acts since Russia launched its full-scale invasion in 2022.

Ukrainian security services (SSU) told the Organized Crime and Corruption Reporting Project (OCCRP) that they believe Russian intelligence is orchestrating these operations, noting a significant increase in such attacks since 2023.

“They involve minors, people with drug or alcohol addiction, and other individuals vulnerable to recruitment, who are easier to manipulate into illegal activities,” the SSU said in a statement to OCCRP.

One such case involves Moldovan national Gherus, who was sentenced to 10 years in prison for arson. Prosecutors say his case exemplifies a broader pattern where sabotage acts carried out by foreigners are being leveraged by pro-Russian propaganda networks to create the false impression of an “underground movement” opposing the Ukrainian government.

“This narrative was planted from the very beginning of the full-scale invasion to serve as a pretext and justification for the war,” explained Kostiantyn Gozdup, head of the Compliance Monitoring Department at the Vinnytsia Prosecutor’s Office.

Despite these efforts, polling data from October shows that only a small minority of Ukrainians hold positive views toward Russia. Experts emphasize there is no evidence of any coordinated nationwide resistance movement against the Ukrainian government.

Liubov Tsybulska, an expert on hybrid warfare who leads the NGO Join Ukraine, told OCCRP: “A resistance movement requires coordination; it implies some kind of unity among these forces. These are all sporadic cases where Russian special services recruit individual people via social media.” She added that saboteurs are typically motivated by financial rewards rather than ideology.

Moscow’s primary objective, according to Tsybulska, is “to create a rift between the people and the political and military leadership.” The Russian government did not respond to requests for comment.

Court documents in Gherus’ case describe his arson attack as part of “a significant increase in the sabotage activities of the special services of the aggressor state.” Investigators were unable to determine the true identity of his handler, who operated under the name Denis Stanciu and delivered payments via cryptocurrency.

The recruitment operation appears sophisticated yet low-cost. After acts of sabotage, videos are often shared on Telegram channels with messages encouraging others to join what they describe as an anti-mobilization movement. One such channel, created in April 2024 with over 19,000 subscribers, regularly publishes evidence of sabotage acts with messages like: “Join our ranks. We will teach, guide, and support! Everyone can help.”

Andrei Curăraru, a Moldovan security and public policy expert, describes how messaging apps have revolutionized recruitment for intelligence operations: “You can identify vulnerable individuals, give them a narrow task, request a video as proof, and pay them without direct contact. This type of sabotage increasingly resembles a clandestine gig-economy marketplace rather than traditional espionage networks.”

The recruited individuals “often do not even understand whose interests they are serving,” Curăraru noted. “These people are expendable, and everyone in the chain of command knows this — except for the recruits themselves.”

Both Gherus and his accomplice, 26-year-old Moldovan Iurie Lupu, fit the profile of vulnerable recruits targeted by Russian operatives: young men with financial problems and histories of drug issues and prior legal troubles. Lupu told reporters that he received an initial Telegram message from “Denis Stanciu” offering a chance to “make some money,” and subsequently involved his friend Gherus who was also in need of cash.

When contacted for comment, Telegram spokesperson Remi Vaughn told OCCRP the messaging app was “a platform for peaceful speech and privacy, not war,” adding that “attempts to recruit people for sabotage are routinely removed.”