Russia's GRU used 20 million Telegram job ads to recruit disposable saboteurs

TLDR

• Finland's Supo says Russian GRU sabotage recruitment intensified over the summer, with defense manufacturers and Ukraine-support logistics now targeted.¹
• The warning followed an arson attack on a Polish Starlink ground station that relayed connectivity to Ukraine's military; Polish prosecutors suspect Russian intelligence ordered it.¹
• An investigation by Vot Tak documented over 20 million Telegram job ads in the first half of 2026 recruiting disposable saboteurs across 20-plus countries, paid in cryptocurrency and often unaware they work for the GRU.²
• The pattern has already produced 151 documented sabotage incidents across Europe since 2022, 31 of them in Poland.²

Finland's Security and Intelligence Service, known as Supo, says the threat of Russian sabotage in Europe has grown over the summer, with the country's defense industry and Ukraine-support activities now the most exposed targets.¹ Teemu Liikkanen, Supo's head of counterintelligence, told state broadcaster Yle there was no indication of imminent danger but that Finland needed to stay prepared.¹

The warning came five days after arsonists burned power equipment at a Starlink satellite ground station in the Polish village of Wola Krobowska, a facility that relayed internet connectivity to Ukraine's armed forces. Polish prosecutors confirmed arson as the cause and said they suspected Russian intelligence ordered the attack.¹

Why it matters: the mechanism behind the surge is not new hardware or doctrine, it is Telegram itself.² A July 2026 investigation by Vot Tak, the Russian-language outlet run by Poland's TVP World, documented how GRU handlers buy or age Telegram accounts registered on phone numbers from India, Iran, and Arab countries to complicate Western subpoenas, then post ordinary-looking job ads inside legitimate Telegram job-search communities.² Recruits who respond are moved to separate channels, assigned arson, reconnaissance, or component-acquisition tasks, and paid in cryptocurrency before the intermediary account is deleted within days.² Vot Tak journalists posing as recruits were offered $1,500 to burn a NATO vehicle in Lithuania and $3,000 to torch a Ukrainian organization's office in Riga; a month after one such contact, a Ukraine-supplying drone plant in Pardubice, Czech Republic, burned down.²

Driving the news: the International Centre for Counter-Terrorism's February 2026 accounting, independently corroborated by the Associated Press, documented 151 Russian-linked sabotage incidents across Europe between 2022 and 2026, with Poland alone accounting for 31.² Of 172 identified perpetrators, 95% were ordinary citizens rather than intelligence professionals, a deniability layer that Latvia's State Security Service chief Normunds Mežviets has separately described as recruits carrying out tasks without ever knowing who is really paying them.² Poland's Internal Security Agency (ABW) reported in May 2026 that the disposable-recruit model is increasingly supplemented by professional sabotage cells drawing on former soldiers, police officers, and Wagner Group veterans.²