Russia’s military intelligence agency is using parts of the Wagner network to recruit Europeans for sabotage operations inside the EU and wider NATO area, according to western intelligence officials cited by the Financial Times.

The recruitment is described as outsourced: former Wagner recruiters and propagandists, once used to enlist Russians for combat, are now said to be tasked with identifying economically and socially vulnerable Europeans willing to carry out “low-sophistication” attacks. Western officials told the newspaper the intent is to create distance between the Russian state and individual incidents, using intermediaries as buffers.

Western intelligence officials said the approach relies heavily on online ecosystems, including Telegram channels, where recruiters can contact targets directly, assess reliability, and propose tasks framed as quick, contained jobs. The Financial Times reported that the Wagner network’s established social media footprint and experience in targeted messaging make it a useful conduit for Russian services seeking rapid outreach without official exposure.

Officials described recruitment packages that prioritise quantity over capability: rather than trained operatives, the focus is on “disposable” agents who can be directed towards arson, vandalism, intimidation, or the circulation of extremist propaganda. The Financial Times said intelligence services see this as part of a broader effort by Russia’s security apparatus to seed disruption across Europe while maintaining deniability through cut-outs.

A frequently cited UK case illustrates the method. Dylan Earl and Jake Reeves were prosecuted over an arson attack on a London warehouse linked to a Ukrainian-owned business and the storage of aid destined for Ukraine. Counter Terrorism Policing said the pair organised the arson “on behalf of Russia”, and prosecutors described it as a Russia-backed plot pursued under the National Security Act 2023.

Court and policing statements indicate the organisers used remote direction and online contact, with Telegram featuring in the evidential picture in related reporting. The case has been presented publicly as an example of how organisers can recruit, instruct and deploy local actors with limited experience against targets chosen for their connection to Ukraine.

The Financial Times report links this model to Wagner’s post-2023 evolution, arguing that even as the group’s battlefield role changed, parts of its recruitment and messaging apparatus remained usable for covert work. Western officials told the newspaper that Russian agencies can exploit Wagner-linked contacts and methods while inserting “intermediate” layers to frustrate attribution and complicate legal thresholds for proving state direction.

Security officials interviewed for the report described a practical logic to using ex-Wagner personnel: they can speak in the idiom of target communities, operate through informal networks, and make approaches that appear non-state in origin. The recruitment pitch, as characterised by officials, is often transactional rather than ideological, with small payments and low barriers to entry.

Western agencies also see an operational trade-off. The Financial Times reported that investigators consider many recruited operatives to be amateurs, which can make plots easier to detect because of poor tradecraft and digital traces. At the same time, officials warned that a larger volume of low-level attempts can still tax policing and intelligence resources, particularly when recruitment is conducted online and across borders.

European counter-intelligence responses have included closer monitoring of online spaces where recruitment approaches occur, public warnings about hostile-state solicitation, and the use of new legal tools to prosecute organisers and facilitators. In the UK, the warehouse case was highlighted by police and prosecutors as a landmark use of the National Security Act 2023 against individuals acting for a foreign power, signalling an enforcement route against similar recruitment-driven plots.

The western intelligence assessment reported by the Financial Times is that Russia’s services are seeking effects that do not require sophisticated capability: disruption, fear, and the diversion of domestic security attention, especially where targets intersect with Ukrainian logistics, diaspora communities, or political symbols. Recruitment through Wagner-linked intermediaries is presented as a means of scaling those efforts while reducing direct exposure for Russian state bodies.

Image source: counterterrorism.police.uk