While the world is focused on the war in Ukraine, Russia’s security services have completely overhauled their intelligence methods and launched an invisible hybrid war against Europe as a whole. Thousands of intelligence officers, tens of thousands of recruited agents, and hundreds of thousands of citizens misled by Russian propaganda and disinformation are working in the interests of Russia’s security apparatus. Networks of Russian influence agents penetrate political parties, media outlets, universities, NGOs, religious communities, cultural centers, and immigrant communities. What Russia is doing in Europe today is not Cold War–era spying; it is a new generation of hybrid intelligence.
After the detention of Russian agent Igor Rogov in Poland, it became clear this was not an isolated episode but only the tip of the iceberg — part of a large-scale operation to build a new intelligence network across Europe. A network operating by fundamentally different rules than classic espionage, using hybrid tools: influence, disinformation, recruitment via vulnerabilities, and targeted actions at the right moment.
Igor Rogov portrayed himself as a businessman and someone helping Russian-speaking immigrants adapt in Poland. In reality, he was an agent of Russia’s security services coordinating elements of an intelligence network in Eastern Europe. His mission was not to steal military secrets. The goal was different: to expand an influence-agent network, recruit people, build connections, identify vulnerabilities, and prepare the ground in advance for future operations.
After 2022, Russian intelligence changed its tactics completely. The old model — station networks, diplomatic cover, classic agents — no longer works. Europe expelled hundreds of Russian diplomats, closed consulates, strengthened counterintelligence, and cut off old channels. But Russia did not leave Europe; it adapted. It launched a new intelligence model based not on professional career officers, but on influence agents recruited from immigrants, students, activists, businesspeople, politicians, journalists, priests, athletes, artists, and bloggers — people who do not arouse suspicion, live legally in Europe, and are integrated into local society.
How this new Russian intelligence network works
Stage one: recruitment.
The security services look for people who can be recruited and drawn into cooperation. These are not necessarily convinced Kremlin supporters. More often they target people with vulnerabilities — individuals they can force to work through blackmail and threats: debts, a criminal past, compromising material, dependence on documents or legal status, relatives in Russia who can be pressured. Sometimes they pick ambitious, greedy people willing to work for money, influence, or status.
Stage two: legalization.
A recruited person is not “burned” in obvious operations — they are carefully embedded into legitimate structures. They open a business, register an NGO, create a media outlet, establish a Russian school, get a position at a cultural center, teach at a university, run a blog, organize events for the Russian-speaking diaspora, hold conferences and invite people of interest to the services, run cultural festivals, children’s events, sports activities, or work as a schoolteacher.
Everything looks legal and transparent — no grounds for suspicion, no lawbreaking.
Stage three: use.
The agent begins carrying out tasks — but not ones that can be easily classified as espionage. They collect information: which immigrants are oppositional, who might be useful, who works where, who poses a threat to the Kremlin, or, conversely, who can benefit it. They compile dossiers and pass them to the security services. They recruit new people and expand the network, seeking new candidates. They influence public opinion through social media, publications, and personal contact. They shape Kremlin-friendly narratives and gently shift public sentiment in the desired direction.
A key element: exploiting emigrants
After 24 February 2022, more than a million people left Russia, many settling in Europe. Most moved not so much out of ideological or moral rejection of Putin’s policies, but for pragmatic, situational reasons, reacting to circumstances. They adapt in Europe not as political exiles or a “nation in exile,” but simply by adjusting to the moment. This group is extremely easy to recruit in exchange for small help with paperwork, or assistance in securing jobs in companies controlled by Russian security services, mainly in the IT sector. There are relatively few people who are sincerely opposed to Putin.
Among this flow there are also agents of Russia’s security services. They pose as opposition figures, attend anti-war rallies, post against the regime on social media, join diaspora organizations, and gain trust. Then they start collecting information: who does what, who funds whom, who donates to Ukraine’s Armed Forces, who plans which actions, what internal conflicts exist, who can be flipped or discredited, who still has relatives in Russia who can be used, where those relatives work, who plans to travel back for business or family reasons, what connections remain, who receives income from Russia.
The outcome: people are arrested when attempting to enter Russia. They are charged with extremism based on information leaked by agents. Their families in Russia receive threats.
Students and academia as recruitment channels
Russian intelligence makes especially active use of student exchanges and academic programs. Young people coming to Europe to study are ideal recruitment material. They are legally in the country; they have access to universities, libraries, research centers, and research projects; they interact with local students, professors, and researchers. The security services recruit such students either before departure or during their studies, using leverage: family in Russia, debts, compromising material. Tasks may vary: monitoring other Russian students, collecting information about research, recruiting local students, spreading propaganda under the guise of “alternative viewpoints.”
The same applies to foreigners and diaspora compatriots who go to study in Russia. For Russia’s security services, they are all recruitment targets. After returning home, many build careers in politics, business, journalism, or academia. And then someone shows up to remind them: once, they signed a cooperation commitment in exchange for a favor, money, documents, the opportunity to study, or help finding a job. Fear of exposure, reputational collapse, and public scandal becomes a basis for blackmail — and a mechanism of control. There are tens, if not hundreds of thousands of such people worldwide. Every year, thousands more are added: recruited agents who graduated from Russian universities or participated in Russian educational programs.
Cultural centers as hubs
Russia actively uses cultural centers as cover for intelligence activity. Organizations are created that supposedly promote the Russian language and culture. Concerts, exhibitions, lectures, festivals, performances, and Russian-language clubs are organized.
Everything looks harmless. But in reality, these centers are key hubs for coordinating activities, briefing agents, transferring information, and planning operations.
Cultural centers (“Russian Houses”) in European capitals — including Nicosia — are financed by Russian security services. They host events attended by Russian-speaking emigrants. Participants are photographed, conversations are recorded, and active supporters and opponents of the regime are identified. Dossiers are then compiled. Based on this information, some people are recruited, while others are detained when they visit Russia.
Cyber operations combined with human access
In the new environment, Russian intelligence is betting on cyber operations. These are not merely hacks; they are complex operations combining cyberattacks with agents’ real-world access. For example: an agent befriends an employee of a European company or government institution and builds trust. Then they either obtain passwords and access directly, or pass details to hackers who use them for targeted attacks.
Another scenario: an agent spreads malware through seemingly harmless files or links — sending a colleague a presentation, a link to an article, or an invitation to an event. The person opens it; their device is infected; the security services gain access to messages, documents, and contacts. This access is then used for further operations.
The main objective: destabilization, not classic espionage
One of the main goals of the new Russian intelligence network is not so much to gather classic intelligence as to destabilize societies, undermine trust in governments and democratic institutions, spread disinformation, intensify social divisions, and create an atmosphere of fear and suspicion.
How it works: agents spread fake news that inflames conflict. For example, a fake claim that the government plans to raise taxes so Ukrainian refugees receive more aid than local citizens. Or that security services are indiscriminately monitoring everyone. Marginal local media and social networks amplify these fakes. Then debates, conflicts, and protests follow. The result: society fractures, trust in authorities declines, and people begin to suspect one another.
European counterintelligence services are forced to spend resources checking every suspicious case; while everyone is distracted by non-existent threats, Russian agents operate calmly. This is a classic tactic: create noise to conceal real operations. In Russian security-service jargon, such operations are called “diversion to a useless object.”
A hidden war inside the diaspora
The Russian-speaking diaspora in Europe is enormous — millions of people. A hidden war is underway within it. On one side are genuine opponents who fled the regime, or people simply seeking a peaceful life in Europe. On the other are Kremlin agents trying to control the diaspora, identify threats, and recruit new people.
Agents create organizations that look like independent immigrant initiatives: help for newcomers, cultural events, legal consultations, psychological support, Russian schools and kindergartens. People come for help and end up under surveillance. Their data is recorded; their views are assessed. The most active are targeted for recruitment or for discrediting.
In one European country, an organization supposedly helping Russian emigrants adapt was in fact cover for an FSB operation. Its leader turned out to be an agent who compiled dossiers on everyone who sought help and passed the information to Moscow. Some people were pressured into cooperation, others were intimidated, and still others were used to spread disinformation.
Europe is only beginning to grasp the scale
European services are only beginning to understand the scale of the threat. For decades they focused on Islamist terrorism, espionage, and organized crime. Russian hybrid intelligence did not fit familiar frameworks. This is not classic espionage that can be tracked through diplomatic channels. It is a distributed network operating through thousands of small nodes.
The problem is that most of these people do nothing overtly illegal. They do not steal classified documents, plan terrorist attacks, or carry out sabotage. They simply collect information, influence opinion, recruit people, and build infrastructure. All of this sits in a gray zone: hard to prove, hard to prosecute, hard to stop. It is an invisible network — you do not see it unless you deliberately look. It does not produce headline-grabbing incidents. But it exists, it grows, and it permeates European society. And at a critical moment — during elections, a crisis, or a conflict — it can be activated.
It is like a computer virus that sits dormant in a system for a long time. Then, at the right moment, it activates and begins to work. Russian intelligence has built exactly such a network. It can do nothing for years — simply exist, gather information, expand. Then, when needed, it can be used for a massive influence operation or for destabilization in a European country.
Cyprus and the EU presidency
From 1 January, Cyprus assumes the EU presidency, and right now — by many signs — Russian security services have launched an operation to destabilize the island. The goal is to disrupt plans during the presidency period. One central direction of this operation, according to available information, will be to shake the political system on the eve of and during parliamentary elections: increase polarization, undermine trust in institutions and authorities, provoke social division and a political crisis.
The tools of this special operation will be the communists of AKEL and the new party of Fidias Panayiotou, “Direct Democracy.” Both structures are described as agents of Moscow and allegedly financed by Russian security services.
Why youth are a priority target
Russian security services recruit young people especially actively because they are long-term assets. A student today may become an official, journalist, scientist, businessperson, or politician in ten years. If recruited now, years later they may be in a position with access to important information or the ability to influence political decisions. This is a long-term strategy stretching decades — investments in future influence. Russian services invest in young agents knowing the payoff will come — not immediately, but substantially. It is patient, methodical work, and it is already producing results.
Countermeasures — and why they may be late
Some European countries have started tightening controls. Poland has closed several suspicious organizations, the Baltic states have strengthened screening of Russian immigrants, and Germany has begun monitoring cultural centers.
But the problem is that these measures are, in many ways, late. Russia has already built the network; now it has to be untangled. That is difficult, slow, and expensive. But it must be done. Otherwise, Russia will destroy Europe.
A new-generation intelligence war
Russia is waging a new-generation intelligence war. This is not the Cold War with clear rules and boundaries. This is hybrid war: boundaries are blurred; the adversary does not wear a uniform; operations are masked as lawful activity; and it is impossible to distinguish an agent from an ordinary person until you dig deeply.
Europe is beginning to realize the threats exceed anything seen since the Cold War. During the Cold War, it was clear who the enemy was: the KGB, the GRU, diplomatic cover, and station networks. These could be tracked, controlled, and neutralized. Now the adversary is diffuse — everywhere and nowhere. It exploits the openness of Western societies against them. It skillfully uses European jurisdictions and court systems to protect its interests at the expense of Europe’s interests.
New approaches in counterintelligence are needed. Old methods cannot be relied upon. Technology is needed: data analysis, artificial intelligence to detect patterns, international coordination among services, transparency of organizational funding, and monitoring of social media. But above all, vigilance from civil society is needed — especially from journalists. European services cannot track every suspicious person; resources are limited, and the number of agents is large. That is why ordinary people, journalists, activists, and members of immigrant communities must remain attentive: notice suspicious activity, be wary of strange proposals from compatriots, report concerns, and avoid falling for provocations.
It is crucial to understand how modern Russian intelligence works, what threats Russia’s hybrid war poses, how Moscow’s agents infiltrate European society, and how an influence-agent network destabilizes Europe and undermines trust in state institutions.
This network is already operating — and it will expand. Europe is waking up. But the question is whether it is too late, because while Europe slept, Russia built an infrastructure that will now be very difficult to dismantle.