Since the beginning of 2026, tens of millions of nearly identical posts have appeared on Telegram, offering high pay for what is described as easy work in Ukraine and beyond, according to an investigation by Vot Tak.
The investigative reporters found that the work involved carrying out acts of sabotage like setting cars on fire in Poland, purchasing and delivering detonators in the Czech Republic, and filming drone launches and setting military vehicles on fire in Lithuania.
LRT English is sharing a shortened version of the Vot Tak investigation below, which explores how Russia operates its sprawling recruitment network.
Burn a NATO jeep in Lithuania
"Let's make this one a NATO jeep. They're interested in it. I was told that if you burn it really well, you'll get $1,500 without any bargaining. Scout it out first, film it, and I'll send the video to my boss. You'll need three litres of gasoline – pour it over the windshield, the wheels, and the hood."
That was how a Telegram user operating under the name Jan Pol instructed a Vot Tak reporter posing as a Lithuanian resident who had responded to one of the recruitment ads.
On May 12 alone, around 10,000 nearly identical job postings appeared in Russian and Ukrainian employment chats on Telegram. Every one of them listed the same contact: the Telegram account Jan Pol. The posts promised "simple technical work" with flexible hours and reliable, on-time pay.
Recruits were assured that the assignments were safe. Yet the very first message from Jan Pol made clear that the so-called side job involved breaking the law.
"The work is illegal. I'd even call it underground. But the pay is good. I'll send you the manual now – you can pick whichever job you like."
The instructions Jan Pol sent explicitly encouraged recipients to carry out arson attacks against targets in Ukraine. "It's not as scary as it seems at first glance. Take a look at our channel to see who we're fighting and the methods we use."
The message referred to the Russian-language Telegram channel Underground / Sich. Its creators describe it as "a community of active citizens ready to fight for truth and justice."
The channel regularly publishes videos of vehicles belonging to Ukraine's army recruitment centres being set on fire, along with calls to target their personnel and oppose the Ukrainian authorities.
At the same time, a pinned post claims that "the channel is not Russian propaganda and has absolutely no connection to Russia".
The "manual" also included a detailed price list for different types of sabotage in Ukraine. Destroying a cell tower, for example, was listed at $500; setting fire to a recruitment centre vehicle or a luxury car would earn $1,000; and an attack on a police building was priced at $7,000. Recruiters also promise a $100 referral bonus for every new saboteur brought into the network.
According to them, payment is transferred to any cryptocurrency wallet or bank card within an hour after the arson attack is completed and verified with a video.
The Telegram account used by the recruiter under the name Jan Pol was registered to an Afghan phone number. However, the last posts in Persian made from that account appeared in Telegram channels and chats back in October 2019.
When the Vot Tak reporter introduced himself as a Ukrainian living in Lithuania, the Russian-speaking recruiter identified himself as Sasha.
According to Sasha, he had lived in Kyiv before moving to Zhytomyr. He said he now lives there "basically in a bunker" because he is wanted by the authorities. His wife, meanwhile, is in Russia and has been urging him to leave Ukraine.
After learning that his contact supposedly lived near the NATO training area outside the Lithuanian town of Pabradė, the recruiter suggested filming military personnel and equipment as a reconnaissance mission.
"Think you could get a little closer to the training ground? Shoot a bit of video. I talked to the bosses, and they said they could throw you a little extra if you provide reconnaissance of the site – what's there and what they've got."
After consulting his "senior boss", Sasha came back with another assignment: gather proof that drones are allegedly being launched at Russia from Lithuanian territory.
"We need 100 percent proof that drones are being launched from Lithuania. Even better if you can actually catch one in flight on video. They're ready to pay $500 for that."
The proposal to film drone launches came on May 15. Just four days later, Russia's Foreign Intelligence Service (SVR) claimed that Ukraine was planning to launch drone attacks on Russian targets from the territory of the Baltic states, specifically Latvia. The agency warned that Russia would retaliate,
After several days of conversations, Sasha also offered the reporter $1,500 to set fire to a NATO military vehicle. A slightly lower reward – $1,000 – was offered for burning luxury cars with Ukrainian license plates in Lithuania.
The recruiter himself claimed he earns $15,000 a month for his work, though he described it as "hard labour".
"I have to spend 18 hours a day replying to people, messaging them, explaining things, sitting at the computer. I get 100 to 150 messages a day, plus I have the workers to deal with. If someone screws something up, I'm the one who gets chewed out. "
Millions of messages
Vot Tak found that Telegram is being used to run a large-scale recruitment campaign for would-be saboteurs. Since the beginning of 2026 alone, more than 20 million job advertisements have appeared across Telegram job-search chats, concealing offers to carry out arson attacks and other acts of sabotage in Ukraine.
The campaign's reach extends far beyond Ukraine and Russia. Most of the chats where Vot Tak found these ads belong to Telegram's Russian-language segment (nearly 12.6million posts) and Ukrainian-language segment (more than 8.8 million posts), according to TGStat.
However, recruiters have also been posting their offers of easy, well-paid work in Russian-language communities in the United Arab Emirates, Thailand, the United States, Germany, Poland, and more than 20 other countries.
The recruitment process follows the same pattern in every case. The hundreds of job ads are not posted by the recruiters themselves, but by intermediary accounts – many of which exist for only a few days before being deleted.
Vot Tak examined several dozen of these distributor accounts. Most were registered under Russian first and last names.
Even among accounts posting ads in Ukrainian, Ukrainian spellings of names or other signs of a connection to Ukraine were rare.
Some profiles used Indian or Arabic names, while a handful displayed names written in Arabic script.
Vot Tak did not find a single distributor account linked to a Ukrainian phone number. Instead, these profiles were most commonly registered to phone numbers from India, Iran, and Arab countries, which together accounted for more than 80% of the accounts used to publish recruitment ads for saboteurs.
One typical example was an account operating under the name Ostap Solohubov. It posted hundreds of Ukrainian-language messages across various chats advertising highly paid part-time work.
But opening the profile revealed a female Persian name in the account information – Sharareh Shojaeyan. The name likely belonged to the account's previous owner: the profile gallery contained dozens of photographs of what appeared to be an Iranian family, along with images featuring text in Persian script.
The account itself was registered to an Iranian phone number. The name Ostap Solohubov appeared on the profile only on March 27, 2026. Shortly afterwards, the account began aggressively distributing recruitment ads.
The other distributor accounts identified by Vot Tak follow the same pattern. They are also used to recruit new distributors. In addition to posting offers of lucrative part-time work, these users flood Telegram chats with messages seeking to buy Telegram accounts.
"The country doesn't matter. The only thing I'm interested in is accounts that are at least 10 years old," a user operating under the name Partizan told Vot Tak.
Since the beginning of the year, roughly 1.9 million posts advertising the purchase of Telegram accounts – alongside offers of easy money – have appeared across various chats, all listing Partizan as the contact person.
Burn down a party office in Latvia
On May 20, a Vot Tak reporter responded to one of the recruitment ads and received the standard price list for various acts of sabotage. This time, however, it explicitly stated that the recruiters were seeking operatives not only in Ukraine, but also across the European Union.
"We also have operations in Europe. Contact the handler separately."
During more than six months of monitoring the recruitment network, Vot Tak had never before seen operations in Europe included in the price list sent during the initial contact.
The recruiter, who used the Telegram name Moroz, operated an account registered to a Russian phone number. His primary interest was in finding someone to carry out an assignment in Riga.
"A couple of Molotov cocktails through the window. Quiet building, no cameras. It belongs to a political party," he wrote, without initially specifying which party's office he meant.
Moroz sent photographs of the building and specified that the office on the ground floor was the intended target. He offered $3,000 in cryptocurrency for carrying out the attack.
Later, he identified the organisation he wanted targeted as the Viche Confederation of Ukrainian Communities, a Ukrainian community organisation officially registered in Latvia.
Judging by a video he provided, the building had already been surveyed in advance. "You make a couple of Molotov cocktails yourself. Or you can just smash a window, pour about a litre and a half of gasoline inside, and then set it on fire," Moroz instructed.
An army of arsonists
At least in Ukraine, recruiters using Telegram chats have been consistently successful in finding people willing to carry out their assignments.
An analysis by Vot Tak of verdicts handed down by Ukrainian courts in 2026, using the Unified State Register of Court Decisions, found that as of June 1, 2026, Ukrainian courts had issued 25 convictions since the beginning of the year for acts of sabotage under Article 113 of the Criminal Code of Ukraine.
In 19 of those cases, the court documents explicitly stated that the defendants had been recruited via Telegram. During the same period, courts handed down 22 convictions for terrorist acts under Article 258 of the Criminal Code of Ukraine. In 14 of those cases, the recruitment had likewise taken place through Telegram.
One such case occurred in February 2026 in Kalush, in Ukraine's Ivano-Frankivsk region. The Security Service of Ukraine (SBU) and the National Police arrested a 19-year-old woman suspected of setting fire to a serviceman's vehicle.
According to investigators, she had received the assignment from an unidentified contact in a Telegram chat.
Another case involved two residents of Cherkasy. On May 4, 2026, the Sosnivskyi District Court of Cherkasy sentenced both men to 15 years in prison. According to the court records, they had been looking for easy money in Telegram job chats, where they came into contact with unidentified individuals who "operated in job-offer communities using multiple accounts."
The men were offered money to set fire to "various targets". They first burned down a railway relay station and later set fire to two vehicles belonging to members of the Ukrainian military.
They filmed both attacks and sent the videos to their handlers as proof that the assignments had been completed.
Ukrainian law enforcement agencies regularly report new arrests following the same pattern: someone searches Telegram for easy money, receives an offer of "simple work" that promises high pay, and ultimately ends up committing a serious crime.
In Ukraine, authorities are prosecuting not only those who carry out acts of sabotage, but also those who distribute recruitment advertisements.
In February 2026, for example, a woman from the Vinnytsia region was brought to trial for posting messages in Telegram chats and online classifieds advertising quick money for young people in Ukraine, offering $1,000 for just a few hours of work. She was convicted of "assisting a foreign state in conducting subversive activities against Ukraine."
Until recently, Ukraine had been the primary focus of these recruitment efforts. In the autumn of 2025, only one of the four recruiters with whom a Vot Tak reporter communicated was willing to pay for acts of sabotage outside Ukraine.
By May 2026, however, the situation had changed significantly: assignments in Europe had become part of the standard price list sent during the very first contact.
Vot Tak sent official inquiries to the intelligence and security services of Poland, Lithuania, Latvia, the Czech Republic, and the United States. By the time this investigation was published, none had provided specific information regarding the activities of Telegram-recruited saboteurs operating on their territory.
In its official response, the Security Service of Ukraine (SBU) described the recruitment network as part of "Operation Diversionary Noise". It’s a campaign that, according to Ukrainian authorities, Russian intelligence services have been carrying out since 2023.
Over that period, Ukraine has documented more than 1,400 crimes allegedly committed on Russia's behalf, including around 800 in 2025 alone. Judging by the price lists received by a Vot Tak reporter in the spring of 2026, the operation's geographic scope is no longer limited to Ukraine.
The full investigation (in Russian) is available here.
Newsletter
Every Friday morning.
