How to recruit a saboteur
According to the Finnish Security and Intelligence Service’s observations, there is a risk of Finnish people being recruited for Russian influencing activities abroad. In some countries, even minor acts of vandalism can lead to very serious punishments.
In 2025, there were less Russian sabotage activities targeting Europe than in 2024. Despite this, acts of sabotage linked to Russian state actors were still observed in Europe last year. The acts mainly involved arson, painting graffiti or sticking posters in public places.
In its influencing activities, Russia uses proxies recruited from the internet. Proxy actors refer to individuals who are not members of Russian intelligence services, and who carry out requested activity for money. The spectrum of actions varies greatly, from small-scale influencing activities to vandalism or even arson. Russian intelligence services recruit proxies internationally, and according to the observations of the Finnish Security and Intelligence Service, the risk of Finnish citizens being recruited for physical influencing activities abroad exists. Proxy actors do not always understand the illegality of their actions and often do not know who the recruiters are. If a Finnish citizen ends up as a proxy actor abroad to engage in influence activity on behalf of Russia, the personal consequences can be very serious.
Finland is not among the main target countries for Russian influencing activities, and, so far, Russia has not targeted Finland in its sabotage actions. In addition to small-scale influencing, such as painting graffiti, the threat of more serious sabotage, such as arson, continues to exist also in Finland. In Europe, Russian proxy sabotage is conducted especially by the military intelligence service GRU. The aim is to create a deterrent. Sabotage has a long tradition in Russia. The activities are cost-effective and likely to continue for as long as Russia has a reason to disrupt Western unity and support for Ukraine.
Recruiting proxy actors for influencing activities follows a specific pattern, each stage of which is under the strict supervision of the Russian intelligence services.
1. Recruitment
Russian intelligence services recruit proxies with messages on social media platforms and messaging applications, especially on Telegram. Money is offered for conducting small tasks.
Recruitment takes place via several intermediaries in order to conceal links to the Russian authorities. Some of the messages have also been targeted at people with a Russian background or pro-Russian attitudes or who are in need of money.
Often, those who agree to take up a task have a criminal or disadvantaged background. For them, the tasks offered may sound like a good opportunity to earn some money.
2. Assignment
The first assignments are small, such as sticking posters to public places. The aim is to test, whether the recruited individuals are reliable and able to carry out more demanding tasks.
Russian intelligence services provide recruits with very detailed instructions on how to carry out the assignment. The services decide the targets and the execution and timing of the activity.
Sometimes, the person carrying out the act will recruit people from their social circle to participate. Several different proxy actors, unaware of each other, are used for the different stages of an act of sabotage or vandalism.
3. Action
Usually, there are many people involved in the actual sabotage. The group of perpetrators may also be multinational. A person recruited from Finland can travel to another European country for Russian influencing activities.
The perpetrators share the responsibility for carrying out the sabotage activity: for example, one person may bring the necessary equipment and materials, another may perform the act of sabotage, and a third may film the action. The perpetrators need a permission from the Russian intelligence service to carry out the act.
4. Evidence and payment
Russian intelligence services require evidence of a successful operation in order to pay the perpetrators for it. All activities must be filmed. The Russian intelligence authorities may refrain from paying the reward if the instructions have not been strictly followed. The amount of the payment varies. Each link in the chain of intermediaries takes its own share of the reward.
5. Getting caught
Western security and intelligence services investigate suspected sabotage activities promptly. This significantly increases the likelihood of getting caught. Usually, the persons getting caught are those who carried out the attacks and not their recruiters.
For Russia, proxies are “disposable”. Proxy actors are used because their apprehension does not harm the influence activities. Russia does not provide any support to proxies if they get caught.
6. Punishment
Even if the perpetrator of the act is unaware of being recruited by Russian intelligence services, they may be accused of very serious offences. In Europe, people who have carried out small-scale acts of vandalism have been suspected and accused of, for example, acting for the benefit of a foreign state and terrorist offences.
Sentences for such crimes can amount to several years in prison. Conditions in penal institutions abroad are likely to be poorer than in Finland. In such a situation, the Finnish authorities have very limited opportunities to provide consular assistance to Finnish citizens.