Russia has created a network of agents to conduct its hybrid war against Europe. The network brings together government agencies and organized crime and Russian-speaking men with criminal records are being recruited to carry out acts of sabotage, according to a study. 

"The study situates Moscow's tactics against the backdrop of its full-scale war on Ukraine, showing that hybrid operations are not a side theatre but a central pillar of Russian strategy," the researchers explain in their introduction. They compared these tactics to the approach of the so-called "Islamic State" (ISIS) terror group that recruited "former criminals who went on to carry out violent attacks in the Levant and Europe." The researcher explained that "today, a new crime-terror nexus has emerged in Europe — this time orchestrated by a state actor – Russia."

The study, entitled "Russia's Crime-Terror Nexus: Criminality as a Tool of Hybrid Warfare in Europe," was conducted by the non-governmental organization GLOBSEC and the International Center for Counter-Terrorism (ICCT), which  presented their findings in Brussels at a meeting of the Special Committee on the European Democracy Shield (EUDS).

110 acts of sabotage since 2022

According to the study, between January 2022 and July 2025, 110 acts of sabotage and attempted attacks were carried out in Europe, mainly in Poland and France, by people with links to Russia.

"Of those, 89 were carried out successfully, while 21 were foiled," the researchers wrote, adding that the number of disrupted plots is likely to be "significantly higher, as intelligence services do not always disclose such information publicly."

They identified 131 perpetrators, of whom at least 35 had previous criminal involvement and were recruited through criminal organizations or from penal colonies. The overwhelming majority were male and the average age was 30. Most were Russian-speakers from a post-Soviet state and vulnerable in socio-economic terms, which led them to be motivated by financial compensation. "Financial incentives were decisive: payments ranged from a few euros for graffiti to substantial sums for attempted attacks on critical infrastructure."

Recruitment was conducted mainly online, particularly in the Telegram messaging app, as well as by friends and family. 

Illicit finance and sanctions evasion

The researchers highlighted that Russia's "hybrid operations are inseparable from illicit finance and sanctions evasion." It found that Moscow had turned to "shadow financial operations to move money covertly across borders, pay operatives, and sustain its war economy."

"These channels enable the Kremlin to bypass restrictions, while simultaneously embedding criminal networks deeper into its hybrid warfare strategy," the researchers said. 

It further demonstrates that "illicit finance, criminality, and hybrid operations are not separate challenges but elements of a single playbook. Russia's kinetic campaign — bombings, arson, assassination plots — should be seen as both punishment for Europe's support to Ukraine and preparation for potential wider conflict."

Kremlin ties to crime are not new

The Russian government's use of criminals is nothing new, explained Dominika Hajdu from GLOBSEC, adding that people who "lived east of the Iron Curtain" still remembered how chronic supply shortages in the Soviet Union created and reinforced society's dependence on the shadow economy. After the collapse of the Soviet Union, the fight against corruption was not a priority in Russia, unlike in other post-communist countries, she said. Instead, corrupt methods became the norm and the authorities' working method.

According to Hajdu, in 1994, there were over 500 criminal groups active in Russia and they controlled around 40,000 companies.

"In the early 2000s, representatives of the security services, including former officers of the KGB domestic intelligence, consolidated their control over the Russian state," she said. "And their connections to the criminal underworld became part of the state system." 

Polish politician Bartlomiej Sienkiewicz, who is a member of the European Parliament and in the European People's Party (EPP) group, agreed that the Russian government's use of criminal methods and its links to organized crime were longstanding practices.

He told DW that he had no doubt that the Kremlin maintained ties with organized crime in order to recruit agents in Europe, adding that the problem was how the EU should respond. Referring to recent drone activity at European airports that paralyzed traffic, he said: "No one shot them down. We want to take action against people recruited by Russia, but the activities on Telegram have still not been stopped, even though the EU should actually be controlling such platforms."

What can the EU do?

The authors of the study attempted to formulate recommendations for possible responses by the EU. These include improved monitoring of online platforms, particularly Telegram. As a further step, the definition of "hybrid threats” should be broadened. Many countries' national doctrines and strategies do not sufficiently account for the role of "non-state actors such as criminal organizations, ideologically motivated proxies, or individuals acting in their own interests." It is precisely these "legal loopholes” that have enabled Russia to deny its guilt or involvement in attacks and acts of sabotage.

In their recommendations, the authors of the study call for "a broader understanding of hybrid threats and stronger cooperation between public and private actors, alongside reinforced investment in Europe's internal security capacities." They suggest that hybrid threats be better defined. "While the EU's definition includes the focus on both state and non-state actors,196 many national doctrines and strategies either completely lack one or fail to account for the increasing role of non-state actors – such as criminal organizations, ideologically motivated proxies, or profit-driven individuals." They argue that it is precisely the "legal loopholes" created that "bolster Russia's deniability."

Hajdu said she believes that close cooperation between public and private actors will be important in combating the threats.

"They must be partners, as private companies in Europe have more sophisticated mechanisms for detecting Russian criminal activities," she said. "We therefore advocate the creation of a platform to coordinate cooperation in order to prevent Russian hybrid attacks on European countries."

This article was originally published in Russian.