Russia has created a network of agents to wage a hybrid war against Europe. According to one study, the network brings together government agencies and organized crime and Russian-speaking men with criminal records are being recruited to carry out acts of sabotage.
“The study locates Moscow’s strategy against the backdrop of a full-scale war on Ukraine, revealing that hybrid operations are not a side theater but a central pillar of Russian strategy,” the researchers explain in their introduction. He compared these tactics to the approach of the so-called “Islamic State” (ISIS) terrorist group, which “recruited former criminals who went on to carry out violent attacks in the Levant and Europe.” The researcher reported that “Today, a new crime-terrorist nexus has emerged in Europe – this time driven by a state actor – Russia.”
study, entitled “Russia’s Crime-Terrorist Nexus: Criminality as a Tool of Hybrid Warfare in Europe,” It was conducted by the non-governmental organization GLOBSEC and the International Center for Counter-Terrorism (ICCT), which presented its findings at the meeting of the Special Committee on European Democracy in Brussels.this Shield (EUDS).
110 incidents of vandalism since 2022
According to the study, between January 2022 and July 2025, there were 110 attempted sabotage and attacks by people linked to Russia in Europe, mainly in Poland and France.
“Of those, 89 were executed successfully, while 21 were thwarted,” the researchers wrote. He further said that the number of disrupted plots “is likely to be much higher, as intelligence services do not always publicly disclose such information.”
They identified 131 criminals, of whom at least 35 had previous criminal involvement and were recruited through criminal organizations or from penal colonies. The overwhelming majority were male and the average age was 30. Most were Russian-speaking from a post-Soviet state and were socio-economically vulnerable, which led them to be incentivized by financial compensation. “The financial incentives were decisive: payments ranged from a few euros for graffiti to substantial sums for attempted attacks on critical infrastructure.”
Recruitment was conducted primarily online, particularly in the Telegram messaging app, as well as through friends and family.
Illegal finance and sanctions evasion
The researchers highlighted that Russia’s “hybrid operations are inseparable from illicit finance and sanctions evasion.” It found that Moscow “has turned to shadow financial operations to covertly move money across borders, conduct payment operations and maintain its war economy.”
“These channels enable the Kremlin to circumvent sanctions, as well as deeply integrate criminal networks into its hybrid warfare strategy,” the researchers said.
It further demonstrates that “Illicit finance, criminality, and mixed operations are not separate challenges but elements of the same playbook. Russia’s dynamic campaign – bombings, arson, assassination plots – should be seen as punishment for Europe’s support of Ukraine and preparation for a potentially wider conflict.”
Kremlin’s ties to crime are nothing new
The Russian government’s use of criminals is nothing new, with GLOBSEC’s Dominika Hajdu pointing out that those who “lived east of the Iron Curtain” still remember how chronic supply shortages in the Soviet Union had reinforced society’s reliance on the shadow economy. After the fall of the Soviet Union, unlike other communist countries, the fight against corruption was not a priority in Russia, he said. Instead, corrupt methods became the norm and the modus operandi of officials.
According to Hajdu, in 1994, there were more than 500 criminal groups active in Russia and they controlled about 40,000 companies.
“In the early 2000s, representatives of the security services, including former KGB domestic intelligence officers, consolidated their control over the Russian state,” he said. “And their ties to the criminal underworld became part of the state system.”
Polish politician Bartłomiej Sienkiewicz, a member of the European Parliament and in the European People’s Party (EPP) group, agreed that the Russian government’s use of criminal methods and its ties to organized crime are long-standing practices.
He told DW that he has no doubt that the Kremlin has maintained ties with organized crime to recruit agents in Europe, adding that the problem is how the EU should respond. Referring to recent drone activity at European airports that disrupted traffic, he said: “Nobody shot them down. We want to take action against those recruited by Russia, but the activities on Telegram have still not been stopped, even though the EU should actually regulate such platforms.”
What can the EU do?
The authors of the study attempted to formulate recommendations for possible responses by the EU. These include better monitoring of online platforms, especially Telegram. As a further step, the definition of “hybrid threats” should be broadened. The national doctrines and strategies of many countries do not adequately account for the role of “non-state actors such as criminal organizations, ideologically motivated proxies, or individuals acting in their own interests”. It is precisely these “legal loopholes” that have enabled Russia to deny its guilt or involvement in attacks and acts of sabotage.
In their recommendations, the study’s authors call for “reinforced investments in Europe’s internal security capabilities as well as a broader understanding of hybrid threats and stronger cooperation between public and private actors.” He suggests that hybrid threats should be better defined. “Although the EU’s definition includes a focus on both state and non-state actors,196 many national theories and strategies either completely lack or do not account for the growing role of non-state actors – such as criminal organizations, ideologically motivated proxies, or profit-driven individuals.” He argues that it is precisely the “legal loopholes” created that “promote Russia’s unacceptability.”
Hajdu said he believes closer cooperation between public and private actors will be key in tackling the threats.
“They should be partners, because private companies in Europe have more sophisticated mechanisms to detect Russian criminal activities,” he said. “We therefore advocate the creation of a platform to coordinate cooperation to prevent Russian hybrid attacks on European countries.”
This article was originally published in Russian.