Russian intelligence agencies are increasingly abandoning traditional spycraft in favor of hiring local criminals, drug dealers, and “proxies” to carry out acts of sabotage on British and European soil, according to a new investigation by Times Originals.
The report details a significant shift in Moscow’s strategy toward “shadow warfare,” a tactic driven by the tightening grip of Western surveillance and the mass expulsion of Russian diplomats following the 2018 Salisbury poisonings. Unable to deploy their own officers without detection due to biometric border controls and facial recognition, the Kremlin has turned to recruiting disposable agents via encrypted messaging apps like Telegram.
The consequences of this shift were made visible during a 2024 arson attack on a warehouse in East London, which destroyed relief supplies destined for Ukraine. While the act served the Kremlin’s interests, the perpetrators were not trained intelligence officers but a group of young British men hired by a local drug dealer, Dylan Earl.
Earl, who was recruited online, believed he was working on behalf of the Wagner Group. Messages exchanged on Telegram, uncovered during the investigation, show Earl offering his services to a Russian handler, writing, “I need a fresh start bro” and “Let me come. Wagner aren’t advertising anymore only Africa.”
The Russian handler’s response was blunt regarding their objectives: “Africa is a field of battle where we are fighting too. But we would like you to help us in Europe. What can you do in Europe, what actions?”
The investigation suggests that for Russian intelligence, the use of such proxies offers “plausible deniability.” Mark Urban, a columnist for The Sunday Times, told the program: “They are people who were working on behalf of a nation state, but they’re not staff members of one of its intelligence organizations.”
This outsourcing of violence has led to a sharp rise in sabotage incidents across the continent. According to data from the University of Leiden cited in the report, the number of Russian-linked operations in Europe surged from 11 in 2022 to 64 in 2024.
The threat extends beyond the UK. In November 2025, Polish authorities reported an explosion on a railway line, describing it as “an unprecedented act of sabotage.” Polish investigators concluded that Russian intelligence had hired two Ukrainian nationals to execute the attack, further illustrating the transnational nature of these recruitment networks.
The Times Originals report highlights that the recruitment process has become disturbingly casual. In one exchange, a Russian handler asked a potential recruit: “Do you have any friends among hooligans or acquaintances in the IRA?”
This move toward digital recruitment has forced a change in how Western security services operate. The “bedrock” of espionage—face-to-face meetings—is being replaced by digital dead drops and online coordination. Consequently, agencies like MI5 and GCHQ are pivoting from physical surveillance to complex data analysis, tracking financial transactions and communications metadata to identify these loose networks.
The UK has responded with legislative updates, specifically the National Security Act 2023, designed to prosecute those acting for foreign powers, even if they are not traditional spies. The law was recently used to jail Howard Phillips, a British man who attempted to spy for Russia in exchange for cash.
However, the challenge remains acute. As the distinction between organized crime and state-sponsored espionage blurs, the investigation concludes that “mastery of these online spaces has therefore become even more important for national security.” With Russia willing to pay locals to burn warehouses and bomb railways, Europe faces a chaotic new front in hybrid warfare.