In four years of full-scale war against Ukraine, Russia organized at least 151 hybrid operations in Europe.
This is evidenced by the analysis of the International Centre for Counter-Terrorism (ICCT) and the Globsec project, reports Agency.
According to researchers, only one attack was organized by Russian special service employees, and in nine other cases, associated executors were involved.
According to the joint report by ICCT and Globsec, in the second half of 2025 and early 2026, 12 hybrid attacks were carried out in Europe.
More than a quarter of these were recorded in Poland, which most frequently becomes the target of Russian hybrid operations (31 cases since the beginning of the war). Five incidents since mid-2025 occurred in France (20 since the beginning of the war). In Lithuania and Germany, there were 15 incidents over four years, in the United Kingdom – 12, and in Estonia – 11.
The report’s authors counted 172 executors, 95% of whom had no formal ties with Russian special services.
Main Motivation — Money
The primary motivation for the executors, according to ICCT and Globsec, was financial gain. Initially, the executors were paid small sums for relatively simple tasks, then the amount of the reward increased with the complexity of assignments (up to large arson attacks or bombings), the report states. According to the report, about 90% of the executors operated with at least one accomplice, often in larger groups.
Eleven executors were younger than 18 years old, the youngest being 16, the report states. Some of them, according to researchers, were in vulnerable situations (fleeing Ukraine without adult supervision and lacking stable income). Recruiters used TikTok and Telegram, turning recruitment into a game: tasks were presented as challenges requiring gathering information or delivering items.
According to the report, Ukrainians and Belarusians often became executors of hybrid operations, many of whom moved to EU countries since 2020. Most of them were aged 30 to 35, facing employment issues, low wages, or debts, the authors note. Recruitment often involved acquaintances from pre-war times, especially for Ukrainians who fled regions currently occupied by Russia, according to the report.
At least 12 executors were linked to far-right communities. Of the 172 individuals, 44 had previous convictions. Prisons have become an important recruitment platform, the authors claim. In some cases, operations were organized directly from places of confinement, where Russian handlers either established new connections or used existing ones. In several cases, saboteurs were people previously convicted in Russia or wanted there, reported ICCT and Globsec.
“Ideologically Driven” Are Few
According to researchers, only 26 individuals were “ideologically driven” executors. Mostly, these were individuals living in the country where the attacks were conducted, often with dual citizenship. In almost all cases (except one), they understood they were acting in the interests of Russian special services. Payments in this group were quite high — several thousand euros for complex operations. One executor from this group (Dieter S.) received six years in a colony in 2025 for preparing attacks on NATO bases in Germany and participating in the war in eastern Ukraine.
Meanwhile, about half of the executors did not reside in the country where the attack was carried out. They traveled there specifically and left immediately after the operation. Most of these individuals arrived from Moldova, Serbia, and Bulgaria. They often agreed to act for small sums (a few hundred euros).
Authors of the report noted a new trend of growing Colombian participation in Russian operations in Europe. The reasons for this trend are not yet fully understood, but they correlate with the growing presence of Colombian citizens on the battlefield — on both Ukrainian and Russian sides, as stated in the report.
