An investigation by the independent outlet Vot Tak found that Telegram recruiters are willing to pay substantial sums for “work” carried out in the EU. Journalists posing as job seekers contacted several recruiters on the messaging app and were offered money for arson attacks and intelligence-gathering in Lithuania, Poland, Latvia, and the Czech Republic. In one case, a recruiter offered a candidate $1,500 to set fire to a NATO military vehicle in Lithuania. Another offered $3,000 for an attack on a Ukrainian-linked site in Poland, and the same amount to burn down the office of a Ukrainian organization in Latvia.
Vot Tak said potential recruits are being sought in Telegram job chats. The ads usually describe the work as an “easy side job” and “simple technical work” with stable pay. But once the conversation moves to private messages, recruiters openly discuss illegal tasks, send price lists for arson attacks, and ask for video reports as proof the job was carried out.
As a first task, one recruiter proposed that a Vot Tak correspondent posing as a resident of Lithuania conduct reconnaissance near a NATO training ground in the Pabrade area, then set fire to a military vehicle. Later, the recruiter also offered money for information that could supposedly confirm drone launches against Russia from Lithuanian territory. A few days after that, Russia’s Foreign Intelligence Service claimed Ukraine was planning to launch drones at Russian targets from the territory of the Baltic states.
In Poland, a Vot Tak journalist was offered assignments to burn cars, diesel locomotives, electric locomotives, communications towers, and sites linked to Ukrainian organizations. After the journalist said they were located in Wroclaw, one recruiter replied that “it can be done there too” and listed possible targets. In another case, a person posing as a Warsaw resident was asked to collect addresses of Ukrainian political organizations, humanitarian aid points, and sites linked to the recruitment of foreign volunteers for Ukraine.
In Latvia, a recruiter proposed an attack on the office of the officially registered Confederation of Ukrainian Communities “Viche” (the Ukrainian word “viche” refers to a public assembly or council). The recruiter promised $3,000 in cryptocurrency in compensation for a proposed arson attack against the Viche office in Riga.
In the Czech Republic, one of the journalists’ contacts asked about buying electric igniters (a common component in fireworks, but also in improvised explosive devices). A month after that exchange, a defense plant in Pardubice that produced drones for Ukraine’s armed forces was set on fire.
Vot Tak said the recruitment campaign on Telegram is large-scale, with more than 20 million ads containing concealed offers to conduct sabotage appearing in job-search chats since the start of 2026 alone. The ads were posted in Russian-language chats in the United Arab Emirates, Thailand, the United States, Germany, Poland, and more than 20 other countries.
Journalists also studied accounts that mass-posted the ads. Many existed for only a few days before being deleted. Among the distributors identified, the outlet said it found no accounts linked to Ukrainian phone numbers. Instead, most profiles were tied to numbers from India, Iran, and Arab countries. Vot Tak calculated that such accounts made up more than 80% of the profiles used to post recruitment ads.
Vot Tak also described a market for buying old Telegram accounts. One of the outlet’s contacts said he was interested in accounts that were at least 10 years old, adding that the country of registration “does not matter.” According to the journalists, since the start of the year, about 1.9 million messages have been posted in various chats advertising account purchases and easy-money schemes, with the same profile listed as the contact.
In Ukraine itself, the scheme regularly leads to real crimes. Vot Tak analyzed Ukrainian court verdicts from 2026 and counted 25 sabotage convictions, 19 of which mentioned recruitment through Telegram. Another 22 verdicts were issued in terrorism cases, 14 of which also involved recruitment through the messaging app.
The Security Service of Ukraine (SBU) characterized the network as being part of a plan called “Sabotage Noise,” an effort that they say Russian intelligence services have been engaged in since 2023. During that period, the SBU said, Ukraine has documented more than 1,400 crimes commissioned by Russia, including about 800 in 2025 alone.
