The iNews account from former CIA station chief Sean Wiswesser correctly flags Russia's increased reliance on single-use proxies for sabotage, but underplays how this tactic fits a deliberate doctrinal shift toward deniable hybrid operations that blend criminal networks, emigre communities, and unwitting assets. Wiswesser’s examples—Dylan Earl’s Telegram-recruited arson cell and the Polish rail attack by disaffected Ukrainians—mirror patterns seen since 2022, where GRU and FSB units treat the UK and Poland as rear-area logistics targets rather than classic intelligence collection zones. This evolution was anticipated in the 2023 UK Parliament Intelligence and Security Committee report on Russia, which documented Moscow’s pivot from SVR illegals to criminal cut-outs after expulsions hollowed out legal residencies. Unlike Cold War signal sites and dead drops that required patient agent handling, today’s operations prioritize speed and expendability, accepting higher detection risk to disrupt Ukraine aid flows. The recruitment of Bulgarian networks targeting journalists and the Wagner-linked Leyton warehouse plot reveal a calculated tolerance for operational sloppiness that would have been unacceptable pre-2022. London’s large Russian-speaking population now functions as both opportunity and vulnerability; unlike in the 2018 Skripal aftermath when diplomatic expulsions dominated responses, current countermeasures must focus on Telegram monitoring and criminal-justice integration. This approach risks escalation if proxies miscalculate and strike critical rail or port nodes, a scenario NATO’s hybrid threat assessments have modeled since the 2024 Polish incidents.