Russian Intelligence Recruits Refugees and Migrants in NATO Countries for Espionage

Executive Summary:

• Since Russia’s full-scale invasion of Ukraine in 2022, harsh sanctions, growing awareness among North Atlantic Treaty Organization (NATO) member states of Russian intelligence tactics, and enhanced counterintelligence operations have made the Kremlin’s traditional information-gathering methods nearly impossible.
• Following widespread expulsions of Russian diplomats from NATO countries in 2022, Russian intelligence agencies shifted from traditional espionage featuring trained agents under diplomatic cover to more diffuse recruitment of vulnerable groups
• The Russian Federal Security Service (FSB) and Main Directorate of the General Staff of the Russian Armed Forces (GRU) are preying on socially, economically, and legally marginalized groups, including Ukrainian refugees and Russian migrants, for intelligence gathering and sabotage.
• These recruits are often unaware they are part of Russian operations and receive no support from the Kremlin when arrested.
• Russian intelligence operations in countries such as Poland and Czechia focus less on traditional intelligence collection and more on generating panic, undermining social cohesion, and weakening NATO’s support for Ukraine by exploiting local fears and divisions.

The Czech Security Information Service’s annual report for 2024, released on July 10, documented intel about Russia’s Federal Security Service’s (FSB) operations in the country. The report found that the FSB was recruiting migrants from outside of the European Union via Telegram to engage in criminal activities with the intent of weakening public cohesion, undermining trust in the government, and reducing support for Ukraine (Seznam Zprávy, June 9; Czech Security Information Service, July 10). Similarly, in May 2024, Polish counterintelligence arrested several individuals suspected of spying for the FSB (TVN24, May 20, 2024). Among those detained were refugees from Ukraine and Belarus who had arrived in Poland after the start of Russia’s full-scale invasion of Ukraine in 2022. According to Polish authorities, these individuals were recruited to install hidden cameras at railway hubs and collect intelligence on routes used to deliver Western military aid to Ukraine. These are among many examples demonstrating how Russian intelligence services are abandoning traditional espionage tactics, particularly operations under diplomatic cover, in favor of recruiting vulnerable and unofficial agents in North Atlantic Treaty Organization (NATO) countries.

Before the full-scale invasion of Ukraine in February 2022, Russian intelligence agencies—primarily the Foreign Intelligence Service (SVR), a successor to the First Cheif Directorate of the Soviet Committee for State Security (KGB), and the Main Directorate of the General Staff of the Russian Armed Forces (GRU)—relied heavily on diplomatic missions to conduct espionage abroad. Trained operatives worked under diplomatic cover in Russian embassies and consulates, gathering strategic information and recruiting agents with access to classified or valuable data about NATO and EU countries (Nastoyashee Vremya, April 30, 2023).

Even before the war, the Kremlin actively employed Soviet-style active methods to influence foreign societies. Through lobbyists, politicians, think tanks, non-governmental organizations (NGOs), and charitable foundations, Moscow promoted narratives favorable to its agenda, including calls to lift sanctions, normalize relations, or “understand Russia’s position.” These entities often operated in a semi-legal gray zone, publishing articles, offering consulting services, and organizing international conferences and roundtables defending Kremlin interests (Pallin and Oxenstierna, “Russian Think Tanks and Soft Power,” August 2017).

One notable example of such an organization was the “Dialogue of Civilizations Research Institute,” founded in Berlin in 2016 by Vladimir Yakunin, a close associate of Russian President Vladimir Putin (RIA Novosti, July 1, 2016). The institute hosted international forums and roundtable discussions that promoted the idea of a multipolar world, advocated for Russia’s stance in global affairs, and criticized U.S. and NATO hegemony. Western politicians and former officials frequently participated in these events (DW, September 18, 2018).

Individual agents of influence also operated within foreign organizations to promote the Kremlin’s ideology. For instance, Maria Butina, a student and “activist” with Kremlin ties, functioned as an informal agent of influence, building relationships with U.S. political and lobbying organizations, including the National Rifle Association (NRA). Her goal was to establish a network of influence to weaken anti-Russian policies in the United States (BBC Russian, July 17, 2018, April 26, 2019).

After Russia’s full-scale invasion of Ukraine, the effectiveness of traditional espionage methods declined dramatically. Western countries enhanced their counterintelligence measures and expelled hundreds of diplomats suspected of working for Russian intelligence services in response to the Kremlin’s aggression. Operating under diplomatic cover became inefficient and extremely risky, and traditional intelligence-gathering methods were virtually impossible. Harsh sanctions, growing awareness of Russian tactics among Western governments, strengthened counterintelligence operations within NATO countries, and the mass expulsion of Russian diplomats significantly undermined Moscow’s usual espionage tools (RBC, October 10, 2023).

Russian intelligence services were forced to adapt their espionage tactics to these conditions. Intelligence services started using “street agents,” individuals without formal training, diplomatic immunity, or, often, even awareness that they were involved in foreign intelligence operations (DW, October 14, 2024). Russian intelligence agencies directed their efforts toward foreigners from third countries located in NATO states, including refugees, migrants, international students, and temporary foreign residents. These groups often have limited legal, social, and political protection in the countries where they reside, making them convenient targets for covert operations. Their social isolation, sometimes irregular legal status, limited access to the labor market, and general sense of alienation make them more susceptible to manipulation, which can create chaos and undermine trust in state institutions (see EDM, April 23, May 7, November 8, 2024, April 9).

Russian intelligence operations have also expanded into virtual campaigns. In June 2024, the Center for Countering Disinformation under the National Security and Defense Council of Ukraine published a report on a coordinated campaign on social media aimed at spreading disinformation about the “danger” posed by Ukrainian refugees and the “threat from NATO” to Europe, particularly Poland. The Kremlin designed this campaign to undermine trust in Ukraine and Ukrainians within NATO and the European Union and ultimately weaken support for further military aid to Ukraine (Center for Countering Disinformation, June 28, 2024).

Poland is a prime target for Russian influence operations because it plays a key role in supporting Ukraine as a logistical hub for the delivery of Western weapons and humanitarian aid (President of Poland, February 23). Additionally, Poland is actively strengthening its armed forces and modernizing NATO infrastructure on its territory, making it a high-value target for hostile intelligence activities (see EDM, February 5, October 22, 2024, January 14, April 4).

Polish counterintelligence agencies, particularly the Internal Security Agency (ABW), have already arrested several dozen individuals suspected of cooperating with Russian agencies such as the FSB and GRU (The Republic of Poland, November 21, 2023). Citizens of Belarus, Russia, and Ukraine are among those detained, including individuals who obtained refugee status or temporary protection in Poland after the beginning of Russia’s war against Ukraine (see EDM, May 8, 29, June 9). In March 2023, for example, Poland’s ABW detained nine individuals suspected of installing hidden cameras at railway hubs and roads used to transport military aid to Ukraine. The network was coordinated from Russia and transmitted data via encrypted channels (The Moscow Times, March 16, 2023). Other incidents include suspected involvement in arson attacks on logistics centers, attempted sabotage of infrastructure, and coordination of so-called “sleeper cells”—small groups prepared to conduct destabilizing actions (see EDM, May 8; see Jamestown Perspectives, May 27; see EDM, May 29).

Such operations do not generally aim to collect strategically important information. Instead, they are intended to create panic, undermine trust in Ukrainian refugees, and escalate social tensions in Europe. Russian intelligence seeks to weaken the political will to resist Russian influence and reduce public support for continued aid to Ukraine.

Migrants and refugees are becoming ideal targets for Russian intelligence services, primarily due to their social, legal, and economic vulnerability. Russian agencies especially exploit Ukrainian refugees arriving in Poland, Latvia, Lithuania, Germany, and other EU countries. There have been cases where FSB agents, operating under cover—for example, posing as Latvian or Lithuanian border guards—conducted prolonged “conversations” with Ukrainians at border checkpoints, in transit camps, accommodation centers, and even during migration interviews (RBC-Ukraine, August 23). These interviews include questioning about biography, place of residence in Ukraine, possible contacts with the Security Service of Ukraine (SBU) or Ukrainian Armed Forces, information on logistics at the front, assessments of Western arms supplies, as well as social connections in Europe.

Special attention is paid to teenagers and young men in vulnerable situations, as confirmed by investigations in Poland, Czechia, and Germany. Reports have shown that the GRU has recruited young Ukrainian refugees via Telegram to sabotage Western aid routes and that migrants were hired via Telegram for espionage, arson, and other operations (Seznam Zprávy, June 9; Czech Security Information Service, July 10).

Russian-speaking migrants in NATO countries have at times become subjects of political suspicion and, in some cases, discrimination. According to a study by the OutRush project, which interviewed more than 8,000 Russian migrants living in NATO countries, however, there has been a noticeable decrease in discrimination against Russians since 2022. Despite Russian migrants trusting their host governments slightly less in 2024 compared to 2022, largely due to bureaucratic difficulties, fewer claim to face discrimination for being Russian—only 14 percent in 2024, compared to 24 percent in 2022 (Meduza, March 25). Still, any level of discrimination makes Russian migrants more vulnerable to the overtures of Kremlin intelligence services. These conditions create a situation, or at least the perception, of social isolation and legal instability, which recruiters can exploit. Since the FSB and GRU operate under a “disposable agents” strategy that preys on the vulnerable, the number of recruits could rise if legal opportunities for migrants and refugees decrease. The promise of money or protection in return for espionage and sabotage is much less appealing to individuals with better options, especially as it becomes increasingly clear that the Kremlin views recruits as expendable.

The arrest of Russian citizen Igor Rogov in Poland in March 2024 is a telling example. According to the ABW, he was involved in a network of agents sending parcels containing improvised explosive devices to warehouses and logistics facilities in the European Union (Novaya Gazeta Europe, August 8, 2024). The ABW  later detained his wife, who was also residing in Poland under humanitarian status, on suspicion of involvement in the same intelligence network (The Insider, December 2, 2024). Despite the seriousness of the charges, the Russian side made no official statements in their defense, highlighting a clear trend—to the Kremlin, such agents are expendable. This is further confirmed by previous cases in which individuals accused of espionage in Czechia, Germany, and Finland received no consular support or legal assistance from the Russian Federation (Vot Tak, December 16, 2024).

Moscow has shown little to no interest in the fate of its non-traditional operatives (Vazhnie Istorii; The Insider, August 1, 2024; Agentstvo, August 2, 2024; see EDM, August 5, 13, 2024). These individuals are left to face the consequences of their crimes alone, receiving no support from the Russian authorities. They are nothing more than temporary, expendable tools for the Kremlin’s dirty work. Russian intelligence agencies’ tactics are inconsistent and varied, revealing a willingness to use any method to destabilize NATO’s support for Ukraine, even if the effect is ultimately small. In this confrontation, victory does not depend on weapons, but on the ability to recognize hybrid threats and respond to them wisely and decisively.