Russia Utilizing Criminal Networks for Hybrid Warfare Across Europe, Study Finds
A newly released study reveals Russia has established a network leveraging state agencies and organized crime to conduct hybrid warfare operations across Europe, recruiting individuals with criminal records to carry out acts of sabotage.
The research, titled “Russia’s Crime-Terror Nexus: Criminality as a Tool of Hybrid Warfare in Europe,” conducted by GLOBSEC and the International Center for Counter-Terrorism (ICCT), details how Moscow’s tactics mirror those previously employed by ISIS in recruiting individuals with criminal backgrounds for violent attacks. Researchers presented their findings today in Brussels to the Special Committee on the European Democracy Shield (EUDS), noting that these operations are a central pillar of Russian strategy, not a secondary concern. The study identified 110 acts of sabotage and attempted attacks between January 2022 and July 2025, primarily in Poland and France, with 89 successfully carried out and 21 foiled – though the actual number of disrupted plots is likely higher.
The study found 131 perpetrators linked to these incidents, with at least 35 having prior criminal involvement and recruited through criminal organizations or directly from penal colonies. The average age of those recruited was 30, overwhelmingly male, and Russian-speaking from post-Soviet states, motivated largely by financial incentives ranging from a few euros for minor vandalism to substantial sums for attacks on critical infrastructure. Recruitment primarily occurred online, particularly via the Telegram messaging app, and through personal networks. This exploitation of criminal elements allows Russia to maintain plausible deniability while destabilizing European nations, a tactic that has raised concerns about the continent’s preparedness for escalating conflict. Dominika Hajdu from GLOBSEC explained that Russia’s reliance on criminal networks is rooted in the chronic shortages of the Soviet era and a subsequent lack of focus on anti-corruption efforts after its collapse, leading to a system where “their connections to the criminal underworld became part of the state system.”
Researchers emphasized the inseparability of these hybrid operations from illicit finance and sanctions evasion, highlighting Russia’s use of “shadow financial operations” to fund operatives and sustain its war economy. The study calls for improved monitoring of online platforms like Telegram, a broadening of the definition of “hybrid threats” to include non-state actors, and stronger cooperation between public and private sectors. As European Parliament member Bartlomiej Sienkiewicz noted, the challenge lies in how the EU responds, particularly in controlling platforms used for recruitment, as evidenced by recent drone activity at European airports. Further information on countering hybrid threats can be found at the NATO website.
Officials stated that the EU will now consider the study’s recommendations and explore legislative options to address the identified vulnerabilities.
