Imagine checking a Telegram channel for a side hustle and finding a "job" that pays €500 to set fire to a train. It sounds like a bad movie plot, but for two individuals in Latvia, it was a reality that just landed them in a prison cell.
Latvia’s State Security Service (VDD) recently went public with the details of an August arson attack that targeted a train and critical rail equipment. This wasn't a random act of vandalism or a couple of teenagers acting out. It was a cold, calculated move directed by Russian interests. Meanwhile, you can read similar events here: The Calculated Silence Behind the June Strikes on Iran.
The strategy is simple and terrifying. Russia isn't sending elite spies in trench coats to do the dirty work anymore. They’re hiring local residents—often those with criminal backgrounds or financial troubles—to act as proxies. This "sabotage-as-a-service" model gives the Kremlin plausible deniability while turning ordinary European streets into a low-grade war zone.
The August arson and the propaganda trap
In August, two people set fire to a train and several railway relay cabinets in Latvia. These cabinets are the brains of the track; they control movements and signals. If they’re gone, the trains stop. To explore the complete picture, check out the recent report by Reuters.
The suspects didn't just light the match and run. They filmed the entire thing. That footage wasn't for a personal trophy collection. It was sent straight to their Russian handlers. Why? Because the Kremlin used that exact video in a propaganda campaign, claiming the fires were actually happening in Ukraine. It’s a double win for Moscow: they damage NATO infrastructure and then use the evidence to fuel a fake narrative online.
This incident is just one of over 150 documented cases of Russian-linked sabotage across Europe since the 2022 invasion of Ukraine. The goal isn't necessarily to start a full-scale war but to drain resources and make people feel unsafe. If you can’t trust that the train tracks are safe or that the power will stay on, you start to lose faith in your government’s ability to protect you.
Recruiting the gig economy saboteur
Russia has figured out that it’s cheaper and safer to hire a local than to risk a highly trained agent. They’re scouring Telegram, TikTok, and even job-seeking forums for "operatives."
The VDD’s director, Normunds Mežviets, has been vocal about the profile of these recruits. They often target people with criminal records, drug users, or those in desperate need of cash. Last year, authorities caught a group planning to torch trucks with Ukrainian plates. They had a literal shopping list of targets:
- Power facilities and warehouses
- Military sites and NATO training grounds
- Memorials and cultural landmarks
- Private companies working on defense projects
In one case, a man was paid just 400 euros to photograph a military airfield. It’s "gig economy" warfare. The pay is low, the risk to the handler is zero, and the person holding the matches is entirely expendable.
Why the Baltics are the front line
Latvia, Estonia, and Lithuania aren't just neighbors to Russia; they’re the gateway for NATO’s eastern flank. This makes them a playground for "hybrid warfare"—a term that basically means "everything short of actual bullets."
The intensity has ramped up significantly. In early 2026, we’ve seen everything from GPS jamming that messes with commercial flights to physical attacks on infrastructure. Just a few months ago, Lithuania uncovered a network sending incendiary devices through DHL disguised as massage cushions and cosmetics. One of those packages exploded in a cargo hub.
Latvian authorities aren't just sitting back. They’ve finished a 280-kilometer fence on the Russian border and are now preparing plans to physically destroy roads and rail lines if an invasion ever starts. The message is clear: the time for "business as usual" ended a long time ago.
Stopping the shadow war at home
The scary part is that these attacks are designed to look like accidents or local crimes. An IKEA store catches fire in Lithuania. A warehouse burns in London. A water valve is "accidentally" opened in Norway.
Western intelligence services are getting better at connecting the dots, but the sheer volume of these low-level attacks is overwhelming. It’s a game of whack-a-mole where the moles are being recruited via encrypted apps for a few hundred euros a pop.
If you’re living in or traveling through the Baltic region, the security landscape has changed. Awareness is the first step. If you see something that looks like "reconnaissance"—someone filming mundane infrastructure like relay boxes or bridge supports—it’s probably not for a travel vlog.
Report suspicious activity to local law enforcement or national security services immediately. Don't engage with "quick cash" offers on Telegram that involve photographing or "visiting" specific sites. The "client" isn't a recruiter; they’re likely a handler, and the paycheck comes with a long prison sentence.
