A disposable agent or low level agent is a lay person who, indirectly recruited by an intelligence agency, is carrying out sabotage or intelligence gathering actions in a foreign state, usually either his home country or country of residence.^[1] The amateur spy is typically recruited through social media, paid in cryptocurrency, and often does not know the exact purpose of his actions nor the true identity of his recruiter.^[2] Alternative designations include: lay agent, amateur spy, or single use agent.^[3][4]

For decades, intelligence agencies in Europe and the United States have been dealing with mostly online recruitment of lone individuals for the purpose of committing terrorist acts. These tend to be primarily ideologically motivated, thus requiring periods of indoctrination. Both Islamist extremist and extreme right-wing terrorist groups have used these tactics.^[5] Beside this, limited use of lay spies had been known standard practice for Russia during the Cold War.^[6]

In recent years, intelligence agencies, scientific researchers and newspapers reported and warned about a surge in disturbances and interference of various nature, both online and in offline society throughout Europe, that were attributed to "state actors", i.e. linked to autocratic regimes outside of Europe.^[7]

In response to the Russian invasion of Ukraine in 2022, more than 750 diplomatic staff have been expelled from Europe, "the great majority of them spies", according to MI5 director general Ken mcCallum.^[5][8] This diminished the ability of the Kremlin to cause damage and carry out malign intelligence operations in the West, but only briefly so.^[8]

Along with a subsequent surge in cyber activity, in the following years – and notably in the course of 2024 – a steep increase in the number and gravity of hostile incidents was noticed, followed by a significant drop in 2025.^[6] These attacks, carried out by criminals and untrained individuals recruited through platforms like Telegram, were identified as Russian hybrid warfare, "moving west" through Europe.^[9] Varying widely in nature, and with an emphasis on quantity rather than quality, this "incident spam" requires a lot of effort to investigate and attribute with any degree of certainty, thus burdening the intelligence community disproportionately in comparison to the cost involved for the Russian services.

Disposable agents are rarely used in cyber attacks, or online disinformation campaigns; these are mostly attributed to specialised troll farms. Disposable agents are however used online as coordinators, planners, and recruiters i.e. communicative nodes/buffers, shielding Russian operatives from actions being traced back to them and thus making it easier for Moscow to deny involvement.^[6]

Attacks in Europe, attributed to low level agents since early 2022, included entering water facilities without (yet) tempering with the water supply, endangering civil aviation by jamming GPS, train derailments, arson attacks, and even assassination attempts targeting politicians and captains of industry. They also targeted military and weapons facilities, transport infrastructure, energy and communications infrastructure, or landmarks, memorials, public space and shopping centers.^[10]

• Germany Political unrest was caused in Germany, just before the federal election, by sabotaging over 270 private cars in several states, in a way that implicated "green" activists, with news media reporting "Climate radicals attack cars with building foam". Police discovered that the perpetrators were in fact various small-time criminals, recruited by a Russian agent via the messaging app Viper. ^{[11] [12]}

• Poland In spring of 2024, 80% of the Marywilska 44 shopping mall in Poland, housing some 1400 shops and service outlets, was destroyed by flames. Many of the predominantly Vietnamese store owners lost their livelihoods. After a one-year investigation, Polish authorities announced they had proof the fire had been ordered by Russian special services, by means of low level agents, recruited through the messaging app Telegram.^[12][13]

• France In the wake of the October 7 Hamas attack on southern Israel in 2023, hundreds of spray painted Star of David emerged on residential walls in Paris. Some of them were accompanied by texts like "Palestine will overcome". Islamist activists were thought to be behind this, but local police soon caught a couple from Moldova in the act. Western intelligence services attribute this and other minor acts of subversion, aimed at amplifying divisions in French society, to Russian agency FSB. It was said to be part of a disinformation campaign that similarly targeted Poland, Spain, Germany, Romania and Austria.^{[14] [15]}

• United Kingdom/Germany/Poland/Lithuania In Juli of 2024, three packages containing incendiary devices caught flame in various locations, waiting to be transported across Europe on their way to North America. A fourth device failed to ignite. While nobody was injured, experts stated that these bombs could have caused major incidents if they had exploded while in transit on a plane. Lithuanian police arrested fifteen people, from Russia, Lithuania, Estonia, Latvia and Ukraine, who were recruited through the messaging app Telegram, by the same middle men who were responsible for another arson attack earlier that year in Lithuania. These attacks were seen by intelligence analists as "test runs" for future operations by Russian military intelligence agency GRU, against nations who actively support Ukraine, by targeting cargo flights to the US and Canada, from Europe. ^{[16] [17]}

Research carried out at the University of Leiden, Netherlands, showed that the majority of recruits throughout Europe, are men in their thirties. About one third have criminal precendents, and a disproportionately large number of them (24 out of 127 researched individuals) are Ukrainian, along with Bulgarians, Moldovans and people with (dual) Russian nationality, suggesting that cultural affinity and linguistic kinship with Russia play a role in recruitment.

An additional reason for Russian agencies to favour Ukrainians as disposable agents, would be to undermine public support for Kyiv in the war.^{[6] [18]}

About a third of the low level agents investigated were used several times before being discarded, provided they had not yet been detected and arrested.^[6]

Following the Israeli-American offensive against Iran, a new group called Harakat Ashab al-Yamin al-Islamiya (HAYI), which the International Centre for Counter-Terrorism (ICCT) suspects to be a front for already existing operations by the Iranian regime, has been claiming responsibility for a variety of attacks in Europe. In at least one of those instances in France, several teenagers and a 21 year old were recruited through Snapchat to execute the attack, without exactly knowing for whom they were doing this.^[19][20]

• Active Measures
• Gerasimov doctrine
• New generation warfare
• Total war
• Agent Provocateur
• Subversion