Low-level agents are a key part of hybrid warfare — a mix of military, political, economic, and cyber tactics designed to blur the line between war and peace.
In mid-October, German Chancellor Friedrich Merz announced a “new comprehensive action plan” to counter hybrid threats, to be reviewed by the National Security Council.
Before defences can be put in place, it’s crucial to define which actions count as hybrid warfare.
Austrian disinformation analyst Dietmar Pichler explained incidents such as fires, explosions, accidents, attacks, pro-Russian events, or public graffiti should increasingly be assessed for links to hybrid operations.
He warned that delays can make the response harder. “If authorities don’t communicate clearly – for example, explaining that measures are defensive, not offensive – it can cause major problems in the information war,” Pichler told Euronews.
Resilience over reflex shoot‑downs
The recent surge in drone overflights highlights the challenge. After the first sightings were reported in the media, drone activity noticeably increased.
Germany’s Interior Minister Alexander Dobrindt described the situation as a “heightened security threat” and announced plans to set up a new drone defence centre.
NATO allies have reportedly discussed a “decisive response” to Russian President Vladimir Putin’s increasingly provocative actions, the Financial Times reported.
Measures under consideration include strengthening drone defences – such as a “drone wall” along NATO’s eastern flank – and relaxing rules of engagement to allow pilots to fire on Russian aircraft. So far, no official timetable or plan has been agreed on.
Several member states, including Germany and France, are urging caution to avoid a direct military escalation with Russia.
“There isn’t just peace and war; there’s something in between,” terrorism expert Dr Peter Neumann told this year’s Berlin Peace Dialogue at the German Defence Ministry.
He warned that defensive measures cannot simply follow a tit-for-tat approach. Instead, deterrence should work by making attacks ineffective: society and infrastructure must be able to recover quickly, leaving assaults fruitless.
For DrNeumann, resilience means having the tools to deter and manage such attacks. He is wary of shooting down aircraft, arguing that other measures – such as crippling Russian cyber-operations – should come first.
“Shooting down a plane always carries the risk of escalation,” he said, noting that any such action would almost certainly provoke a Russian response and could spiral further.
What are ‘low-level agents’?
Saboteurs of this type are active in Germany as well. Known as “low-level” agents, they are not professional spies but are usually hired for small sums to carry out minor acts of sabotage.
After completing a mission, they are “discarded” by the foreign operators – likely Russia and its allies – and are rarely used again.
Authorities in several EU countries, including Lithuania and the Czech Republic, have reported similar cases. Russian intelligence is believed to use social networks, especially Telegram, to recruit low-level agents.
Through public channels spreading pro-Russian content and conspiracy theories, operatives monitor users: those who regularly like, comment, or share posts may be flagged as potential candidates.
Special software analyses millions of profiles for political orientation and loyalty. Initial contact usually comes through seemingly harmless messages or offers before moving to encrypted apps.
The recruits are tasked with activities like photographing military sites, setting vehicles on fire, or spray-painting political slogans. Most are untrained, motivated as much by money as ideology, and are dropped after a single action.
According to Kacper Rękawek, senior research fellow at the International Centre for Counter-Terrorism (ICCT), Russia has refined its approach: many recruits are not ordinary civilians but criminals.
“People who were already involved in crime – in Europe, Ukraine, or Belarus – and had little previous connection to Russia,” Rękawek explained.
Germany’s domestic intelligence chief Sinan Selen has warned that “foreign states are threatening our democracy and security by using reckless, untrained low-level agents, motivated by quick money, and recruited through social media and messaging apps.”
He urged citizens not to become “pawns of a foreign intelligence service.”
Possible sabotage in Poland
Eight people, including a Ukrainian national, were recently arrested in Poland in what Polish Prime Minister Donald Tusk said was suspected planning for acts of sabotage.
According to Polish media, the arrests took place in mid-October 2025 across several cities, including Warsaw and Białystok.
Intelligence coordinator Tomasz Siemoniak said the suspects had been preparing not only to spy on military sites and critical infrastructure, but also to carry out sabotage and attacks.
Poland’s domestic intelligence agency ABW reported that the detainees were in contact with handlers in Russia and Belarus.
Warsaw accuses Russia and its allies of sending agents into the country to recruit saboteurs – a claim Moscow has denied.