An undercover test by exiled Russian outlet Vot Tak caught a handler offering $1,500 to burn a NATO jeep in Lithuania, one of about 10,000 similar Telegram job posts on a single May day.
A Telegram handler called "Jan Pol" paid an undercover Vot Tak reporter $1,500 to scout a NATO jeep in Lithuania, douse it in three litres of gasoline, and film the burning for a distant handler. The job came with a script: pour fuel over the windshield, wheels, and hood, light it, and send the video back. The handler even offered a bonus if the fire took hold quickly. That single transaction, captured in the Vot Tak investigation and republished in shortened form by LRT, is the closest documented case of how Russia runs sabotage inside Europe in 2026.
On May 12, 2026 alone, Vot Tak counted roughly 10,000 nearly identical Telegram job postings advertising high pay for "easy work" in Ukraine and across the European Union, a one-day snapshot of a recruitment market that has run through the spring. The pipeline is the same one that has paid arsonists to torch cars in Poland, runners to deliver detonators in the Czech Republic, and operatives in Lithuania to film drone launches and burn military vehicles, LRT reported in its summary of the investigation. The mechanism is a gig economy: anonymous Telegram channels, fixed-price tasks, video proof, and cash payment. It scales because it does not need a single trained operative. It needs a phone, an account, and a willingness to commit arson or worse.
Two caveats matter. The $1,500 figure and the "Jan Pol" exchange both come from a single undercover interaction by Vot Tak, and should be read as Vot Tak's reporting rather than independent verification. Telegram's recruitment scale is a Vot Tak count, not an audited number. LRT English publishes a shortened version of the original Russian-language investigation; the original is the authoritative source if a specific claim is contested.
In 2026, Ukrainian drones hit all three Baltic states. Defense News reported in March that the incursions had reached all three Baltic NATO members in a matter of weeks, with drone types and flight paths still under analysis. The Wikipedia entry on the 2026 incursions tracks the regional pattern, and Stars and Stripes reported on the Latvian portion in May. Attribution remains unresolved in public reporting, which is itself part of the problem: an unattributed drone flight leaves Moscow with plausible deniability, while NATO air policing spends on intercepts and identification. The Baltic drone flights and the May Telegram recruitment spike fell in the same news cycle, with the drone attribution still open and the recruitment counts drawn from a single investigative outlet.
The recruitment side of the operation is documented end to end. The Insider has separately documented the Russian intelligence effort to penetrate drone and defence-industrial targets in the region, and Liga.net reported an attempt by Russian intelligence to infiltrate a Lithuanian drone manufacturer that cooperates with Ukraine. The recruitment posts are modular: one channel sells arson jobs in Poland, another recruits couriers for detonators in the Czech Republic, a third in Lithuania handles drone filming and military-vehicle burning. A single $1,500 payment produces a torched vehicle, a viral video, and a news cycle, all without exposing a Russian intelligence officer.
The pattern points to the next test job. If a small share of the 10,000 May posts land, the apparatus is producing sabotage attempts on a weekly basis across the EU. The cost per attempt is low enough that arrests do not break the model. Any resident in a NATO border state with a phone is a candidate, the handler is a Telegram username, and the price is the cost of a used car.