LONDON — As British detectives analyzed the blurry CCTV footage of the burning warehouse, there initially seemed to be no indication they were witnessing a secret Russian intelligence operation.

The footage from March 2024 at the Cromwell Industrial Estate in east London depicted two masked individuals dousing gasoline outside the warehouse, igniting it with a flaming cloth, and escaping into the night.

The fact that this storage facility was part of a Ukrainian logistics company, which was sending humanitarian aid and Starlink satellite internet equipment to Ukraine, did not immediately trigger any suspicions.

However, when a warehouse from the same company was also set on fire 10 days later in Madrid, Spain, detectives recognized it was more than just a simple arson incident.

The subsequent investigation and prosecution revealed what Western officials have cautioned against: a risky Russian strategy of utilizing local criminals to carry out sabotage acts across Europe.

“It’s increasingly common to see criminal intermediaries performing actions on behalf of foreign nations,” stated Cmdr. Dominic Murphy, leader of the counter-terrorism unit at London’s Metropolitan Police, to Sky News, NBC News’ international partner, in July. “This trend has been emerging over the past year or two, and it’s likely we’ll continue to observe its progression in the coming years.”

Over the last year, NATO governments have accused Russian intelligence agencies of remotely recruiting criminals and using them to sow chaos.

The exact number of attacks is difficult to quantify. The allegations range from Britain to Estonia to the Czech Republic to Poland — where, authorities say, Russia paid a group to burn down the country’s biggest shopping mall in May 2024.

Moscow denies all allegations of sabotage, including in the case in London. “Russia has never engaged in sabotage activities against the United Kingdom and has no intention of doing so,” the Russian Embassy in the United Kingdom said in a statement.

Calvin Bailey, a British member of Parliament who sits on the Defense Select Committee, said the London attack fit a pattern in which Russian operatives used encrypted apps and cryptocurrency to hire criminals as they tried to mask their own involvement.

“They’re incentivized by money but the use of Telegram and bitcoin creates plausible deniability and allows the Russians to keep their distance,” Bailey said in a recent interview. “It hides the trail, be that a money trail or any of the connections.”

According to British prosecutors the trail that led to the warehouse burning in east London began in March 2024, when a 21-year-old British drug dealer named Dylan Earl initiated communications with an anonymous account on Telegram with the usernames “Privet Bot” and “Lucky Strike.”

The account was run by an operative with the Wagner Group, the Russian mercenary group that fought in Syria and Ukraine before it launched a short-lived mutiny against Russian President Vladimir Putin in June 2023 but has now been brought to heel by the Kremlin.

Earl expressed interest in joining Wagner as a gun-for-hire, saying, “I need a fresh start” after his life of small-time crime in the U.K, according to documents released by prosecutors.

But the Russian handler said Wagner had a different use for him: carrying out operations in Europe.

Over the course of hundreds of messages, the Russian handler offered the young British criminal both money and ideological encouragement to burn down the warehouse, which could net him roughly $8,000.

“I’ll make you rich. And grant you things no one else can. Citizenships. Passports. Everything,” the Russian handler said in a message posted on the Privet Bot account. In another, the handler said, “You are our dagger in Europe.”

Earl was also encouraged to embrace a clandestine lifestyle by watching the FX show “The Americans” about KGB spies operating undercover in the United States.

“Look how they describe Russia. But you see U.K. and USA,” the handler wrote. “Homeless everywhere. Drugs etc. It is fearmongering bro. They want people scared.”

Earl knew he was dealing with a Wagner operative but did not back down.

Within weeks of their initial messages, Earl had recruited a group of young accomplices to carry out the warehouse attack. According to prosecutors, only one of them — Jake Reeves, 23 — understood that they were starting the fire on Russian orders.

Neither Earl nor Reeves was present when the fire was started by Nii Kojo Mensah, 23, Jakeem Rose, 21, and Ugnius Asmena, 23, all of whom were convicted of aggravated arson. Instead, they watched a livestream of the blaze on FaceTime provided by Asmena.

The men who actually started the fire believed it was merely a criminal act — Earl never told them they were acting on Russian orders.

British detectives stepped up the hunt after they realized they were most likely dealing with a Russian state-sponsored operation targeting the Ukrainian business. They arrested Earl in early April and after they accessed his phone, quickly established his connection to the Wagner group.

Earl and Reeves both pleaded guilty to aggravated arson and offenses under British national security laws.

There is no suggestion that they were linked to other attacks across Europe or the groups carrying them out.

“This case is a clear example of an organization linked to the Russian state using ‘proxies’ — in this case British men — to carry out very serious criminal activity in this country on their behalf,” Murphy, the Met counterterrorism head, said in a statement after the verdict.

The suspected Russian-backed criminal attacks across Europe are usually unsophisticated intelligence operations. Many of the plots, like the one in London, involve arson.

In June, a Colombian man was imprisoned for eight years in the Czech Republic after he was convicted of setting fire to buses in Prague. Like Earl, he was also given orders by a Russian handler over the Telegram messaging app and told to record himself setting the fire, according to Czech authorities.

That type of attack is relatively low-risk for Russia, compared with sending its own professional agents into an increasingly hostile Europe.

But there is some evidence that the Russian operative handling Earl had higher ambitions for his group of British gangsters-for-hire.

British police said that at the time of their arrest they had already begun surveillance operations for their next plot: kidnapping a Russian dissident named Yevgeny Chichvarkin and setting fire to his Michelin-starred Hide restaurant in one of London’s most expensive neighborhoods.