The ConversationNo. 3 · State threats

Russia’s campaign against Europe is run through disposable proxies recruited online. The targets are increasingly private companies, and the people who run them.

By TiNYg Editorial · 6 November 2026

In his annual threat update on 13 October 2026, MI5 Director General Sir Ken McCallum said the UK had entered a new era of national security. His most important line for this readership was about where the blows land: hostile actors are not hitting things the government owns. “They’re aiming at people, businesses, communities.” He described Russia as “aggressor number one”, deliberately operating just below NATO’s Article 5 threshold.

The gig-economy operative

After more than 400 Russian intelligence officers under diplomatic cover were expelled from Europe in 2022, Moscow did not stop operating. It outsourced. Researchers now describe a “gig economy” of sabotage: individuals recruited on Telegram and similar platforms, paid small sums often in cryptocurrency, frequently unaware of who is tasking them. Tasks escalate from photographing a site, to graffiti, to arson, and in some cases to plotting assassinations.

The 2026 record shows how far this has spread into the commercial world:

In June 2026 two men were sentenced in the UK for arson against property linked to Sir Keir Starmer. Both had been recruited on Telegram by an individual linked to the Russian state.

Why this is a corporate security problem

The defence industrial base and its supply chain are the obvious targets. But the logic of hybrid disruption is to impose cost and fear cheaply, and the cheapest targets are soft: logistics hubs, warehouses, data centres, telecoms sites, food supply chains, and executives’ homes. A disposable operative is also an amateur, which makes them more likely to pick the wrong building, use indiscriminate methods and hurt bystanders.

There is a second exposure that is easy to miss. The recruits are often young, financially stressed people, sometimes already inside the target organisation or its contractors. Your cleaner, delivery driver or agency guard may be the person approached with an offer of a few hundred pounds to take photographs.

The professional view

The protective security toolkit that defeats hostile reconnaissance for terrorism works here too, because sabotage-for-hire is reconnaissance-heavy and amateur. What changes is the target selection: organisations need to ask whether anything they make, store, host or transport makes them useful to a state adversary, and whether their leaders are visible in that context.

What to do now

The Conversation is TiNYg’s members’ blog. Members and premium partners are invited to respond to, extend or challenge this article. Get in touch to contribute.

◀ Back to The Conversation newsletter: all 12 articles