EMET NEWS PRESS

Evidence Note

The public evidence base is asymmetric. For Russia-linked activity, there are official warnings, investigations, indictments, specialist assessments and recurring case patterns across several European states. This line can therefore be assessed as the more densely documented operational complex.

For Iranian or Iran-linked activity, the public evidence base is less closed. The assessment relies more heavily on security warnings, specialist analysis, journalistic reconstruction and target-pattern assessment. This indicates security relevance, but it does not allow hard state attribution in every individual case.

This distinction is central. Russia and Iran must not be treated as analytically identical. The Russia-linked line primarily concerns military support spaces and European logistics. The Iranian or Iran-linked line primarily concerns intimidation, target reconnaissance and symbolic effect against Jewish, Israeli and opposition target spaces.

Core Situation

Hybrid operational activity uses civilian spaces, digital platforms and criminal facilitation structures to generate effect below the threshold of open war. A state or state-linked actor does not need to act visibly if it can generate effect through local individuals who initially appear as lone actors, petty criminals, radicalised youths or ordinary arsonists.

The term disposable asset is not a legal or official government category. It is an analytical term for a locally recruited, expendable person used for limited operational tasks without necessarily knowing the sponsor, the target system or the strategic intent. This person is not a classical intelligence agent. They are a sensor, courier, observer, marker, arsonist or disruptor inside a concealed operational chain.

The military utility lies in the separation of tasking, execution and attribution. The perpetrator often knows only a chat contact. The chat contact may know only an intermediary. Payment moves through wallets, vouchers, cryptocurrencies, anonymous transfers or third parties. The task is broken down into small steps. Operational effect is created before reliable attribution becomes possible.

Why Is This Method Operationally Relevant?

The method is cheap, scalable and difficult to attribute conclusively. A recruited person can photograph a target, move a parcel, mark a vehicle, observe a sensitive site, circulate a threat or prepare an arson act. The individual act remains limited. Its effect emerges in context: reconnaissance, disruption, protective costs, investigative pressure, media resonance and political uncertainty.

For the sponsor, the quality of the individual perpetrator is secondary. What matters is local availability. A teenager with a smartphone, messenger access and financial pressure may be sufficient for a simple task. A petty criminal can execute an arson act. A vulnerable person can serve as courier. An ideologically receptive contact can amplify propaganda or threat communication.

The actual operational work takes place above that person. Target selection, task segmentation, payment, shielding and intended effect are controlled at a higher level. That is why the local actor is replaceable. Once exposed, the person can be abandoned while the higher structure remains concealed.

Spatial Order: Where Is This Pattern Most Relevant?

The affected countries cannot be read as a simple list. They have different functions within the operational space. The relevant distinction is between front space, transit and support space, military rear area, eastern-flank space and intimidation space.

Ukraine is the immediate front space and the densest recruitment environment for Russia-linked activity. Tasking there targets mobilisation, military facilities, vehicles, recruitment offices, rail lines, logistics and infrastructure. Every disruption directly affects endurance, mobilisation and internal security. When young people are approached for observation, target marking, arson or sabotage preparation, the objective is not symbolic disturbance. It is interference in an active war and mobilisation environment.

Poland is the key European transition space between front proximity and NATO rear area. It is a border state, an eastern-flank state and a central hub for Western support to Ukraine. Rail lines, logistics nodes, storage areas, energy infrastructure and transport axes have elevated operational significance. If low-cost recruits are supplemented by more structured sabotage networks, the impact is not limited to Polish internal security. It affects the functionality of Western support chains.

Germany is not a front space, but it is a central logistical rear area. Sensitive target spaces include parcel routes, freight chains, rail infrastructure, storage facilities, industrial sites, military-adjacent supply chains and critical supply systems. Germany’s geographical distance from the front makes it attractive for hybrid operations. Reconnaissance, sabotage preparation or disruption in Germany generates political pressure, investigative workload and protective costs in a state that is materially relevant to Ukraine support without being a belligerent party.

Lithuania and the Baltic states are exposed eastern-flank spaces. Their importance derives from proximity to Russia and Belarus, NATO presence, sanctions and transit issues, and clear support for Ukraine. Smaller sabotage, arson or reconnaissance acts have strategic signalling value because they touch reaction capacity, societal resilience and protection of critical infrastructure in a particularly sensitive alliance space.

The United Kingdom is a politically and intelligence-exposed target space. Russia-linked cases concern sabotage and arson-related activity around Ukraine support structures. Iranian or Iran-linked networks are associated in security assessments and reporting with intimidation, attack planning and activity against Jewish, Israeli or opposition target spaces. The UK is therefore less relevant as a geographical transit state than as a space where state adversaries can combine operational effect with symbolic communication.

France, Belgium and the Netherlands are primarily intimidation and resonance spaces in this context. Target selection concerns Jewish institutions, Israeli interests, Western-associated targets or sites with high public visibility. The operational significance lies less in interrupting military logistics than in the ability to generate protective pressure, fear, media resonance and political reaction with low-complexity acts.

Israel is a target and operational space for Iranian influence and intimidation lines. Relevant activities include observation, target reconnaissance, propaganda, threat communication and the mobilisation of local or digitally connected persons against Israeli or Jewish target spaces. The effect is directed not only at individual institutions, but at security perception, social stability and state protective capacity.

The hierarchy is therefore clear: Ukraine is the war space; Poland, Germany and Lithuania are militarily relevant support, transit and rear-area spaces; the United Kingdom is a politically and intelligence-exposed target space; France, Belgium and the Netherlands are primarily symbolic intimidation spaces; Israel is a target space for Iranian influence and intimidation logic. These layers must not be conflated.

Russia-Linked Operational Line

The Russia-linked line sits within the context of the war against Ukraine. Its focus is disruption of the military and civilian support space. Targets include transport, logistics, freight, parcel routes, rail, storage facilities, energy supply and sites connected to Ukraine assistance.

The method follows a recurring pattern: digital approach, small tasks, limited information, local execution, concealed payment and rapid disengagement if exposed. The recruited perpetrator does not need to know for whom they are acting. For the sponsor, it is enough that a specific act is carried out.

The operational effect sits between tactical micro-action and strategic impact. A photograph can be target reconnaissance. A vehicle marking can prepare later sabotage. A parcel can test a transport route. A reconnaissance trip can expose security routines. An arson attempt can trigger protective measures and bind authorities.

Russia-linked hybrid operations are therefore not limited to the immediate front. They transfer pressure into European rear areas. There they create investigations, site protection, delays, insurance costs, political communication and social uncertainty. Material damage may remain limited while follow-on costs are high.

Iranian or Iran-Linked Operational Line

The Iranian line requires narrower formulation than the Russia-linked line. What is publicly supportable is that Western security authorities, specialist assessments and journalistic investigations describe increased activity by Iranian or Iran-linked structures against Jewish, Israeli and opposition target spaces.

The target profile differs clearly from the Russia-linked logistics line. The focus is on Jewish institutions, synagogues, Israeli interests, Iranian opposition groups, exiled persons and symbolically sensitive soft targets. In this environment, low-complexity activity can generate high effect. A threat, a marking, an arson attempt or a staged act can trigger protective pressure, fear and public reaction.

The use of indirect actors fits a proxy-based operating style. Local petty criminals, vulnerable persons, young people, front structures or digital intermediaries create distance from the sponsor. That distance makes reliable attribution difficult. Journalistic language must therefore distinguish between target pattern, suspicion, official assessment and publicly proven direction.

Not every attack on a Jewish or Israeli target is Iranian-directed. Not every antisemitic act is part of a state operation. What is supportable is that these target spaces are strategically relevant to Iranian or Iran-linked intimidation logic and appear repeatedly in Western security assessments.

Target Types and Operational Function

Target types can be separated by function. Militarily and logistically relevant support spaces include rail lines, freight centres, parcel routes, warehouses, ports, airports, vehicles, energy supply and locations connected to Ukraine assistance. These targets matter because they affect resupply, movement, maintenance and political endurance.

Symbolically sensitive targets include Jewish institutions, synagogues, Israeli targets, Iranian opposition groups, political offices and media locations. Material damage is not the decisive metric. The effect lies in intimidation, polarisation and public signalling.

Critical infrastructure remains an attractive target space because energy, communications, transport, water, digital services and public supply systems can trigger protective measures even through reconnaissance, suspicion or minor disruption. An operation does not need to destroy successfully in order to have effect. It needs to create uncertainty.

Information spaces are part of the operational logic. Threat communication, claim videos, statements of responsibility, graffiti and propaganda translate small physical acts into political effect. The act is not only an act. It is signal, test and communication tool.

Recruitment Mode

Recruitment usually does not begin with an openly political task. It begins with a simple assignment: a photograph, a short trip, an observation, a parcel, a marking, a test. The approach comes through messengers, social platforms, gaming environments or criminal online contacts. The task is disguised as a side job, challenge, courier service, test or fast-earning opportunity.

Payment can move through cryptocurrency, vouchers, wallets, anonymous transfers or third parties. This payment method is not only practical. It is part of the shielding architecture. It reduces personal contact, conceals sponsors and complicates tracing.

The process follows an escalation logic. The first task tests availability. The second tests compliance. Later tasks increase dependency and vulnerability to coercion. A person who has already provided photographs, moved parcels or reconnoitred sites can be pressured because chat records, payments and prior acts become instruments of control.

This does not create classical agent handling. It creates digital short-term tasking. The recruit often knows no service, no state and no strategic intent. They know a contact, a task and a payment. That is the operational separation.

Recognition Indicators for Young People

Any online offer that pays money for real-world tasks that must remain secret is suspicious. Assignments involving photographs of buildings, vehicles, rail stations, police facilities, military sites, synagogues, parcel centres, warehouses, power plants, ports, airports or entrances are particularly critical.

Courier tasks, parcel pickups, placing objects, marking vehicles, applying stickers, buying accelerants or observing a specific location are also suspicious. Warning phrases include: “just one photo”, “fast money”, “no questions”, “delete the chat”, “use VPN”, “buy a new SIM”, “tell nobody”, “you do not need to know what it is for”.

Any task linked to police, military, rail, energy, Jewish institutions, Israeli institutions, Ukraine assistance, embassies, opposition figures or logistics is high risk. A small task is not harmless if it is secret, paid and target-directed. In hybrid operations, the small task is often the entry point into the next stage.

Prevention Situation

Young people should break off contact, send no further images, transport no parcels, attend no meetings, place no objects and create no new accounts, SIM cards or wallets. Chats, usernames, phone numbers, wallet addresses, links, payment records and timestamps should be preserved because they may be important for assessment.

Anyone who has already completed a task does not have to continue. That pressure is deliberately exploited. Seeking help early from a trusted adult, school, youth services or police is better than being pulled deeper into a criminal act or concealed operational chain.

For parents, schools and youth services, unexplained payments, new devices, new SIM cards, crypto wallets, night-time errands, sudden secrecy, deleted chats, VPN use without a clear reason, new foreign online contacts or photographs of infrastructure without a personal reason are relevant warning signs. One signal alone does not prove recruitment. The combination of anonymous contact, money, secrecy, real-world tasking and a sensitive location is security-relevant.

Prevention cannot be treated only as a pedagogical issue. It must connect youth protection, crime prevention and counterintelligence. Schools and youth services need to recognise such patterns without prematurely criminalising young people. Security authorities need to distinguish between youth misconduct, organised crime and state-directed influence.

Strategic Effect

At the strategic level, these operations generate political pressure. They burden support policy, minority protection, public security and confidence in state protective capacity. Attacks or preparations against Jewish institutions, Ukraine support spaces or critical infrastructure do not affect only individual objects. They create resonance in domestic politics, media and security debates.

The effect is cumulative. One incident may remain limited. A series of small incidents changes threat perception, protection priorities and political communication. This is the strategic effect: the targeted state must bind resources, explain risk and avoid damaging the open society through overreaction.

Operational Utility

At the operational level, these activities disrupt processes. Transport routes, parcel chains, rail connections, storage sites, site protection, police routines, infrastructure operators and official situation management are tied down. Immediate damage may remain limited, while follow-on costs are high.

For Russia-linked operations, the operational utility lies especially in disrupting support chains for Ukraine. For Iranian or Iran-linked lines, operational utility lies more strongly in intimidation, target reconnaissance, protective pressure and political signalling against defined adversary groups.

Small operations can also reveal response times, camera density, access protection, media resonance and political pain thresholds. This is not necessarily the primary function, but it is a relevant by-product for later operational adjustment.

Tactical Application

At the tactical level, the acts consist of photographic reconnaissance, observation, marking, parcel transport, arson preparation, threat communication or small disruptions. These acts are easy to carry out and difficult to recognise immediately as part of a wider operational chain.

The tactical task does not have to be complex. Its significance comes from target selection, repetition and integration into a broader pattern. A photograph is not proof of espionage. A marking is not automatically sabotage. A courier trip is not necessarily part of an operation. Context, tasking, payment, secrecy, target type and network connection make the act security-relevant.

OSINT Relevance

OSINT is central, but attribution-sensitive. Open traces can include messenger channels, aliases, wallet addresses, chat screenshots, local police reports, court records, fire imagery, social media profiles, corporate registries or movement data.

Reliable analysis separates levels: incident site, target type, perpetrator profile, communication channel, payment structure, network connection and attribution. A Russian-language chat does not prove Russian direction. An Iranian claim does not prove Iranian direction. A young perpetrator does not prove a state operation.

Only patterns, repetition, target selection, official assessment, payment channels, communication traces and links to other cases produce a reliable operational picture. For journalism, this separation is mandatory. Precise language must distinguish between proven, officially suspected, analytically described, intelligence-plausible and not publicly demonstrable.

Core Assessment

Digitally recruited disposable assets are a relevant instrument of hybrid conflict activity. They combine local availability, low cost, limited tasking, digital control, concealed financing and delayed attribution.

The Russia-linked line is publicly the most densely documented and is directed primarily against Ukraine support, logistics, transport, infrastructure and European rear areas. The Iranian or Iran-linked line is less conclusively documented in open sources, but it is associated with intimidation, attack planning and activity against Jewish, Israeli and opposition target spaces.

The operational challenge does not lie in the individual perpetrator. It lies in the chain connecting digital approach, local execution, concealed financing, unclear attribution and political signalling. This chain has to be addressed jointly by situation management, law enforcement, counterintelligence, platform analysis and prevention.

For Europe, this means that hybrid conflict activity does not occur only at borders, fronts or inside government networks. It occurs in messenger groups, freight centres, parcel routes, rail facilities, youth environments, Jewish target spaces, digital wallets and local incident sites. The decisive task is to detect these patterns early, attribute them precisely and counter them within the rule of law.

Glossary

Disposable Asset
An analytical term for a locally recruited, expendable person used for limited operational tasks without necessarily knowing the sponsor, strategic intent or full operational chain.

Attribution Delay
The delay between an incident and reliable attribution to a sponsor, network or state actor. This delay is part of the operational effect because it complicates political response.

Soft Target
A civilian or lightly protected target with high symbolic, social or political effect. This can include Jewish institutions, exile organisations, political offices, media locations or public infrastructure.

Front Space
A space where military effect directly affects combat operations, mobilisation, supply or internal wartime functions. In this text, this primarily refers to Ukraine.

Rear Area
A space outside the immediate front that remains relevant for resupply, logistics, transport, training, industry, political support or endurance. Germany and Poland are central examples.

Intimidation Space
A target space in which operations are designed primarily to generate psychological, social or political effect. Material damage may be limited while protective pressure and public resonance are high.

Proxy Structure
An indirect operational chain in which a state or state-linked actor operates through intermediaries, criminal groups, front organisations or locally recruited persons.

Crime-Terror Nexus
The overlap of organised crime, terrorist violence, intelligence activity and state-directed disruption. The term describes a functional pattern, not a single organisation.

Tasking
The assignment of a specific operational act to a recruited person. This may include a photograph, observation, parcel transport, marking, arson attempt or threat communication.

OSINT
Open-source intelligence; the analysis of publicly available or commercially accessible information such as social media, court records, local reports, registries, satellite imagery, platform traces or payment indicators.

References

Financial Times

Reporting on teenagers and young adults allegedly recruited online by Russian and Iranian actors for espionage, sabotage, propaganda and intimidation tasks.
ft.com/content/58dabb01-41f6-4440-8a5f-69947d8afe06

Reuters

Investigation into Ukrainian teenagers allegedly recruited for sabotage and arson-related activity in the context of Russia’s war against Ukraine.
reuters.com/investigations/ukrainian-teens-are-committing-acts-betrayal-how-should-they-be-judged-2026-04-28

MI5

Official UK security assessment on state threats from Russia and Iran, including sabotage, intimidation, attack planning and the use of criminal intermediaries.
mi5.gov.uk/director-general-ken-mccallum-gives-latest-threat-update

Bundesamt für Verfassungsschutz

German domestic intelligence assessment on the increased threat posed by Russian espionage, sabotage and disinformation activity.
verfassungsschutz.de/SharedDocs/hintergruende/DE/spionage-und-proliferationsabwehr/gefaehrdung-russische-spionage-sabotage-desinformation.html

Generalbundesanwalt

Official German federal prosecution statement on investigations into alleged intelligence activity for sabotage purposes linked to transport and parcel routes.
generalbundesanwalt.de/SharedDocs/Pressemitteilungen/EN/2025/Pressemitteilung-vom-14-05-2025-engl.html

Tagesschau / NDR / WDR / Süddeutsche Zeitung

Reporting based on a confidential BKA assessment concerning suspected sabotage and espionage cases in Germany.
tagesschau.de/investigativ/ndr-wdr/bka-sabotage-verdacht-100.html

ICCT

Specialist analysis of Russia’s crime-terror nexus, criminal networks, disposable assets and hybrid warfare activity in Europe.
icct.nl/publication/more-same-russias-crime-terror-nexus-criminality-tool-hybrid-warfare-revisited

GLOBSEC

Updated analysis of Russia-linked hybrid incidents in Europe since February 2022, including sabotage, proxy structures and criminal facilitation.
globsec.org/publication/update-russia-crime-terror-nexus-hybrid-warfare-europe

Associated Press

Reporting on Polish security warnings that Russia is moving from low-cost recruits toward more structured sabotage cells.
apnews.com/article/2a61859813d885423a1aca37cb0e61fd

Europol

Assessment on the online recruitment of young perpetrators by criminal networks, relevant for understanding hybrid proxy and sabotage structures.
europol.europa.eu/cms/sites/default/files/documents/IN_The-recruitment-of-young-perpetrators-for-criminal-networks.pdf

Europol TE-SAT 2025

European Union terrorism situation and trend assessment, including youth radicalisation, online recruitment and evolving security risks.
europol.europa.eu/cms/sites/default/files/documents/EU_TE-SAT_2025.pdf

RUSI

Analysis of financing channels, payment traces and countermeasures related to Russian sabotage activity in Europe.
rusi.org/explore-our-research/publications/insights-papers/responding-russian-sabotage-financing

The Soufan Center

Strategic analysis of hybrid warfare as a convergence field of terrorism, organised crime and state-directed disruption.
thesoufancenter.org/intelbrief-2026-may-15

Washington Institute

Analysis of Iranian hybrid warfare in Europe, including proxy structures, disposable operatives and activity below the threshold of open conflict.
washingtoninstitute.org/policy-analysis/deniable-disposable-disruptive-irans-hybrid-warfare-europe-demands-proactive

The Guardian

Reporting on analysts’ assessments of alleged Iranian low-level hybrid warfare attacks in the United Kingdom and Europe.
theguardian.com/uk-news/2026/apr/23/iran-low-level-hybrid-warfare-arson-attacks-uk-europe

OCCRP

Investigative reporting on recruitment through Telegram for sabotage, arson and violent activity in Europe.
occrp.org/en/investigation/make-a-molotov-cocktail-how-europeans-are-recruited-through-telegram-to-commit-sabotage-arson-and-murder