Podcast: Code Name: Bad Actors

On the nights between 20 and 22 July 2024, three parcel bombs exploded in three different cities: Leipzig, Warsaw and Birmingham. It was one of the most dangerous acts in the campaign of destabilisation that Russia had unleashed across Europe, through arson, sabotage and political provocations. Three explosions, in three days, in three different European cities. The investigation immediately takes on an international dimension and is conducted not only by the police but also by the intelligence services of Germany, Poland, the United Kingdom and Lithuania. The officers, in fact, immediately identified a common thread: all three parcels had come from Vilnius. But there is more. Between 2022 and 2023, airports, schools and other public offices in the Czech Republic and Poland were hit by an unprecedented wave of hoax bomb calls, the origin of which, according to intelligence agencies, is linked to other ‘occasional agents’ recruited on Telegram and paid in cryptocurrency for each job. But the perpetrators are not trained operatives, and Russia and Iran are not the only ones making use of them: they are petty criminals willing to do anything, recruited via social media and paid in cryptocurrencies.

In this episode – the second instalment – of “Nome in Codice”, with the help of a former Ukrainian intelligence officer and Anna Sergi, a criminologist who teaches Sociology of Deviance at the University of Bologna, Claudio Antonelli and Antonio Talia set out to track down the so-called “Bad Actors”, occasional and expendable operatives who come from organisations of robbers and traffickers and exploit the deepest recesses of the web to carry out attacks. From the sabotage of high-speed trains on the opening day of the 2024 Paris Olympics to suspicions of sabotage on the railway lines between Bologna and Pesaro on the first day of the 2026 Milan-Cortina Winter Olympics, to the bomb planted on the tracks of the Warsaw–Lublin line in November 2025, right through to the sabotage of the electricity grids that left 40,000 Berlin homes without power in early January 2026. A common thread links many of these incidents. It includes the fires in March 2026 at the headquarters of the Helsinki-based volunteer association supporting the Ukrainian army and the Czech company manufacturing drone components destined for Kyiv. The pattern repeats itself, sometimes accompanied by false claims of responsibility – such as those attributed to elusive anarchist or pro-Palestinian groups in the cases of Berlin, Paris and Prague. Nor does it exclude the Mediterranean region. The alleged attack in Udine is also under investigation. According to data compiled by Globsec, an independent security think-tank based in Bratislava and funded, amongst others, by the European Commission and the Atlantic Council, there were over 150 incidents of this kind in Europe between February 2022 and February 2026, and around 95 per cent of the 172 people identified so far as responsible are ordinary citizens with no formal affiliation to Russian intelligence agencies. The underlying and most sensitive issue is tracing payments made in cryptocurrencies. And preventing the digital wallets of unsuspecting citizens from being emptied to pay off bad actors. Follow the money… We asked the start-up Mopso how to stay safe.

Listen to the episode