Kremlin’s Telegram Spies: Europe Under Digital Siege

A disturbing new investigation by Novaya Gazeta Europa has brought to light a covert Russian intelligence operation exploiting online platforms to recruit spies across Europe. The operation uses a Telegram bot to target Russian-speaking residents, tasking them with gathering sensitive information about military installations and activities within the EU and Ukraine. This revelation aligns with a well-established pattern of Russian political warfare, which includes sabotage, espionage, and disinformation campaigns aimed at destabilising both Ukraine and the EU.

For the past six months, pro-Kremlin Telegram channels have been circulating monthly recruitment calls, urging Russian speakers to share intelligence about NATO military sites via a dedicated bot. The bot’s recruitment message makes a direct appeal for “eyes and ears in Ukraine and on the territory of Europe,” explicitly seeking information on military-linked facilities.

Crucially, Novaya Gazeta Europa traced the distribution of these recruitment messages to Ksenia Temnik, a member of the occupying authorities in Crimea and head of a “legal department” within Crimea’s “military commissariat.” Temnik received her Russian passport in April 2014, following Russia’s illegal annexation of Crimea, and has since held various positions within the Russian-imposed Crimean administration. While the specific names of the Crimea-linked channel and the spy recruitment Telegram bot were not disclosed by the investigators, the connection to Temnik provides a clear link to Russian state structures.

The Security Service of Ukraine (SBU) has frequently reported instances of Russian intelligence using messaging apps, particularly Telegram, to recruit spies and saboteurs, often including screenshots of Telegram chats in their public statements.

When a journalist from Novaya Gazeta Europa posed as a potential informant and contacted the bot operators, they were asked to provide a range of information, including photos and videos of NATO armed forces, details about military equipment movements, information on Ukrainian specialist training locations, detailed maps and guidebooks from European countries, and even to purchase and activate anonymous SIM cards. The operators, claiming to be part of the Russian Airborne Forces (VDV), showed particular interest in monitoring the situation along the Belarus border for any signs of NATO troop deployments.

The bot operators also provided detailed security advice to potential recruits, instructing them to immediately delete photographs after transmission, remove any incriminating correspondence, maintain absolute secrecy about their support for Russia, and develop plausible cover stories to explain any interest in military sites.

This online recruitment drive comes amidst a series of arrests and reports of Russian espionage and sabotage activities across the EU. Over the past year, several EU countries have reported Russian involvement in organising sabotage operations on their territories. Estonia arrested more than ten individuals accused of working for Russian intelligence, Latvia reported recruitment attempts targeting individuals for spying on a NATO airbase, German prosecutors announced the arrest of two individuals (Russian and German citizens) suspected of planning explosions at industrial and military facilities, and Polish authorities detained a group accused of attempting to disrupt train deliveries of aid to Ukraine.

This investigation follows a September 2024 report by the Organized Crime and Corruption Reporting Project (OCCRP) which detailed similar recruitment bots on Telegram, though those operators were reportedly more explicit in their requests for criminal activities, such as arson, sabotage, and assassinations.