Putin's secret terror in Germany: How Russia recruits its agents, one click at a time

Russia is recruiting saboteurs across Europe through Telegram by monitoring pro-Kremlin channels to identify potential "low-level agents" and offering small payments for tasks like photographing military sites or starting fires, Germany's intelligence chief warned during a parliamentary hearing of the country's intelligence chiefs in the Bundestag.

Europe is living through a period of "ice cold peace" that "could at any moment turn into open confrontation", the head of foreign intelligence service BND, Martin Jäger, warned at the event.

"We must prepare ourselves for further escalations," he emphasised.

Green MP Konstantin von Notz echoed that concern. "The threats posed today by espionage and sabotage from authoritarian states have long since become a very serious security issue, von Notz said.

He urged the government to "finally take the assessments of the intelligence services seriously" and to respond to the growing dangers "with determined action under the rule of law."

Since its full-scale invasion of Ukraine, Russia has stepped up its hybrid warfare against the West – cutting undersea cables in the Baltic Sea, drone sightings, parcel bombs and carrying out further acts of espionage and sabotage. Some acts of this hybrid campaign can be traced back to so-called "low-level agents".

These individuals, often recruited via social media for small sums of money, carry out minor acts of sabotage, such as photographing sensitive or military infrastructure, starting fires or spraying provocative graffiti.

Pro-Russian narratives on Telegram

Alongside other social media platforms, the messaging app Telegram is frequently used to recruit so-called "low-level agents".

The app allows users to join public channels and send private messages. While signing up requires a phone number, only a username is publicly visible.

Telegram hosts countless Russia-friendly channels, some with hundreds of thousands of subscribers. One of the most prominent is run by EU-sanctioned German blogger Alina Lipp.

Her channel, Neues aus Russland, has over 175,000 followers who regularly access her content promoting Russian narratives. Lipp mainly translates material from Russian-language chats into German, which is then shared further across German-speaking groups and channels.

In this role as translator and amplifier, she quickly became one of the most influential pro-Russian voices on Telegram in the German-speaking world after Russia's full-scale invasion of Ukraine.

Research by Correctiv has found that a network of Russian and German Telegram chats has grown around her channel, passing content between them. These groups act as echo chambers for pro-Russian propaganda, where alternative viewpoints are rarely seen.

More broadly, there are thousands of Telegram channels that share videos, news, and other information, often in favour of Russia's war of aggression, but also on topics such as migration in Europe and the treatment of Ukrainian refugees. Many channels allow users to comment on posts or "like" them.

A click away from becoming an agent?

According to Ukrainian cyber expert Kostyiantin Korsun, this sort of online activity can put users on the radar of Russian intelligence services. According to him, they can monitor conversations in Telegram channels, identify users and administrators by their IDs, and track which channels they follow.

"This creates detailed profiles of millions of users automatically, capturing what they believe, like, or dislike," Korsun told Euronews. Specialised software enables Russian services to monitor thousands of channels simultaneously, assessing how loyal individual users are to Russia and their political attitudes. Based on that, they can estimate how many people might be of interest to the Russian services, he added.

The next step is the first direct point of contact. When a Telegram channel regularly posts pro-Russian content or favourable coverage of the war in Ukraine, intelligence officers can identify and tag users – later reaching out to them, either publicly or in private, and sometimes recruiting them.

"At this stage, the contact is psychological," Korsun explained. "They assess whether a potential agent could provide intelligence, take photos, or even assist in operations."

"Once identified, communication may move from Telegram to more secure messengers like Signal or Wire. Early contact often starts on Telegram because it is open, but later stages rely on encrypted platforms."

"It is not possible for anyone except those operating a channel to identify its subscribers. It is also impossible to see a list of channels that a user follows", Telegram said in a statement to Euronews.

German intelligence agencies are well aware that social networks are being used as recruitment platforms.

In most cases, the Federal Intelligence Service (BND) or the domestic intelligence agency BfV can monitor channels, analyse and document public content without intervention.

But once communication moves to private chats, things get complicated: any attempt to access end-to-end encrypted conversations runs up against both legal and technical barriers, especially on Telegram.

In a statement to Euronews, Telegram said: "Calls to violence or destruction of property are explicitly forbidden on Telegram and are immediately removed whenever discovered. Moderators empowered with custom AI tools proactively monitor public parts of the platform and accept reports in order to remove millions of pieces of harmful content each day, including calls to violence."

Is Telegram working with Russian intelligence agencies?

Ultimately, it is the company itself that decides whether to hand over user data, explained Korsun.

Telegram was founded in 2013 by its CEO Pavel Durov and his brother. Since then, it has grown into one of the world's most popular messaging apps, surpassing one billion users in March this year.

For some time, there have been suspicions that Durov may be sharing data with, or even collaborating with, the Russian intelligence services.

So far, however, there is no solid evidence to support those claims. In a post on Telegram, Durov insisted that the platform "has never disclosed a single byte of private messages" in its 12-year history.

Under the EU's Digital Services Act, Telegram would, he said, only provide IP addresses and phone numbers of criminal suspects in response to a valid court order – but never private messages.

However, investigations by the OCCRP outlet suggest that Telegram's technical backbone is controlled by a previously unknown network engineer named Vladimir Vedeneev.

His company manages Telegram's network equipment and IP addresses and holds exclusive access to parts of its servers, as well as the authority to sign contracts on the platform's behalf.

There is, again, no proof that Vedeneev's firm cooperates directly with the Russian state. Yet two closely linked companies have worked with sensitive government clients – among them the FSB intelligence service, a research centre specialising in the de-anonymisation of internet users, and a state-run nuclear research laboratory.

Telegram confirmed that "Vedeneev's company, Global Network Management Inc. (GNM), is one among dozens of providers of limited telecom services such as colocation and hardware installation – always under Telegram’s direction and without any access to Telegram’s data, encryption keys, or internal systems. Telegram’s IP routing and network operations are handled solely by its own engineering team."

The 'vegetarian' among intelligence services

Although German intelligence agencies are limited in what they can do on Telegram, there are, according to Dr Christopher Nehring, an expert on disinformation and intelligence and director of the Cyber Intelligence Institute, other ways to make recruitment on the platform more difficult for Russian services – for example, through technical counterintelligence measures.

For that, one would need to monitor relevant Telegram channels. "The typical low-level agent is usually Russian-speaking, often a young man with little formal education who is recruited for easy money, without much training or ideological conviction," said Nehring.

"By joining these channels – much as one would with jihadist forums – it's possible both to gather intelligence and to plant so-called honeypots, or decoys, for the Russian services."

According to Nehring, this can be done using AI-generated fake profiles, which tie up the adversary's resources. "I can inject a hundred 'honeypots' that keep handlers busy – and while they’re occupied, they can’t be doing anything else," he told Euronews.

While this is by no means a final solution, it at least complicates access for foreign actors. However, Nehring noted that such methods are legally contentious in Germany, since it remains unclear whether they would even be permissible under domestic law.

Foreign intelligence agencies, by contrast, can take far more aggressive countermeasures in cyberspace, up to and including disabling servers abroad.

German agencies, by comparison, lack such broad powers. It was partly for this reason that former BND president August Hanning once described the German intelligence service as "the vegetarian among the world's spy agencies."

Russia aims to sow division, but which ideology is the Kremlin really pushing? Find out on Wednesday in the third part of our series "Putin's secret terror in Germany".