It is well known that criminal networks in recent years have recruited children and young teenagers through social media. But they are not the only ones who have operated in this way.
State actors have also recently used online platforms to recruit young people to commit acts of terrorism, violence and vandalism in the West in return for payment.
In September, almost a year ago, two 17-year-old Dutch boys were arrested for carrying out services for a foreign country.
The boys are believed to have been recruited by pro-Russian agents or hackers on Telegram. One of them is believed to have been charged with spying on Europol, Eurojust and the Canadian embassy in The Hague by using a “wifi sniffer”, a device that can pick up nearby wifi networks.
More complex and unpredictable
The recruits are described by The Financial Times (FT) as “disposable” agents who pose little risk to the state itself and are easy to replace. They are often young people who are contacted on social media such as Telegram, TikTok, Snapchat, Facebook or Discord and offered money in return for carrying out assignments.
Payment is often made in cryptocurrency and communication takes place on encrypted platforms, which makes it difficult to trace both the communication and the payment back to those behind the assignments.
When the Norwegian Police Security Service (PST) published its national threat assessment for 2026 earlier this year, it said about the threat from state actors that it expected “an increase in Russian cyber operations, influence operations and recruitment attempts through digital channels”.
Kai Bastesen, head of section in PST’s counterterrorism department, says the threat picture today is more complex and unpredictable than before.
“It is characterised by several actors with different motivations. For example, we see state actors, terrorism and organised crime merging together,” he tells NORDIS fact-checking outlet Faktisk.no.
He says PST assesses that foreign states’ intelligence services will also this year try to recruit sources and helpers in Norway. Bastesen says this can happen both physically and digitally, but that the use of social media is an established method for foreign intelligence services.
“This form of digital recruitment is cost-effective and easy to carry out. Recruits can be asked to carry out a range of different tasks, such as gathering information, sabotage and disruptive activities, or acts of violence and terrorism,” he says.
Finds young people on online gaming platforms
Internet-based games are also often used as a recruitment gateway before the conversation is moved to another platform, often Telegram, where the communication continues. According to the BBC, young people are offered easy money to carry out less serious crimes, often disguised as simple tasks. If they resist, attempts may be made to blackmail them.
In its threat assessment, PST also highlights gaming platforms as relevant arenas for recruitment and says online platforms such as Roblox and Minecraft “are particularly relevant for the recruitment of minors, as many minors play online”.
This tactic is said to have started in Ukraine, where teenagers have been recruited to carry out online sabotage, espionage and spread propaganda. Ukrainian intelligence has told FT that 21 percent of those arrested for working for or cooperating with Russia in 2025 are believed to have been teenagers.
In the UK, figures from counterterrorism police showed that almost 20 percent of those arrested for terrorism-related offences in 2023 were 17 or younger. These were the highest figures since records began in 2001. Two years later, the share had fallen to just over 15 percent.
Dominic Murphy, the recently departed head of counterterrorism at London’s Metropolitan Police, told FT in June that he was surprised by how big a challenge it became when this emerged very suddenly around 18 months ago.
Russian diplomat’s son behind Starmer attacks
In the UK, Murphy was not the only one to notice the new method. So did the former British Prime Minister Keir Starmer, who was probably a target in several arson attacks last year.
A Toyota that had previously belonged to Starmer was first set on fire in North London, before the entrance to a flat the prime minister had previously lived in was also set on fire.
Finally, a fire was also started at the entrance to Starmer’s house, which at the time was being rented to his sister-in-law while he himself was living in Downing Street.
Three men appeared in court over the arson attacks, and two of them were found guilty. One of them, a Ukrainian construction worker living in London, was recruited online and offered money and Russian citizenship to carry out the acts.
According to the BBC’s investigation, the person behind the assignments is believed to be 23-year-old Evgeny Lyukshin, the son of a high-ranking Russian diplomat who has previously served at the embassy in Denmark.
Lyukshin is believed to have studied at the Moscow State Institute of International Relations (MGIMO), where he is said, among other things, to have taken part in a programme run by the Russian media company Rybar, which provides training in information warfare.
Behind pro-Islam and far-right groups
Arson was not the only thing Lyukshin offered to pay the Ukrainian man to carry out. He was also given the task of drawing graffiti and putting up posters. The posters he put up are said to have advertised a far-right group called Direct Action UK.
According to the BBC, the group tried to make it look as though it had emerged organically in the UK, but in reality it had been created and controlled by Russians, including Lyukshin, in an attempt to create polarisation among the British public. Direct Action UK first emerged in autumn 2024 after the riots that followed the killings of three children at a dance school in Southport.
The group spread a lot of content describing Prime Minister Keir Starmer as a traitor and expressing general hatred of Muslims. The very active far-right activist Tommy Robinson also reshared disinformation that was frequently promoted by Direct Action UK.
Among other things, Robinson shared posts claiming that the suspects in the attacks against Starmer were actually male sex workers with whom the prime minister was personally involved.
The Telegram group also posted several paid assignments, which among other things led to six mosques and Islamic schools in London being vandalised with Islamophobic graffiti.
Before Direct Action UK, Lyukshin was also involved in starting a fake Islamic organisation called the Takbir Foundation. The group tried to recruit Muslims to create “holy” graffiti to “spread the word of Allah”. But the aim was probably to provoke the far right and create division.
“In particular, some types of extreme digital forums can be suitable arenas for spreading disinformation. This can contribute to fuelling mistrust and thereby create division around Western political institutions and liberal values,” Bastesen at PST says.
The BBC has found several Telegram accounts that initially presented themselves as devout Muslims, but later switched to pushing an anti-Islam agenda in Direct Action UK’s channels.
Recruits through Maniac Murder Cult
Also Sweden has also experienced young people being recruited on behalf of Russia.
A Swedish 20-year-old was recently convicted of cooperating with the neo-Nazi group Maniac Murder Cult.
In autumn 2025, the man was contacted by the leader of the group, who wanted to pay him to carry out acts of terrorism against migrants in Sweden.
The same leader has, in another group, recruited two underage Ukrainians who were planning to carry out acts of terrorism against Ukrainian schools.
According to the Ukrainian Security Service, SBU, the leader of both groups can be linked to Russian intelligence.
Leave a Reply