How Russia Built an Agent Network from the Underworld for Sabotage in Europe

WISE NEWS PRESS / BRUSSELS, BELGIUM — Nov. 11, 2025

While continuing its war against Ukraine on the front lines, Russia has simultaneously established an agent network linked to the criminal underworld for sabotage acts across Europe, raising concerns among experts about the necessary steps to counter Moscow's hybrid warfare strategy.

Russia has built a new agent network for its hybrid warfare against Europe, where state agencies are intertwined with organized crime groups. A new study reveals that the Kremlin is recruiting individuals with criminal records to carry out sabotage acts across the continent.

These findings were detailed in a joint study titled, "Russia’s crime-terror nexus: The role of criminal networks in the hybrid war in Europe," prepared by the GLOBSEC (Global Security Forum) think tank and the International Centre for Counter-Terrorism (ICCT). The report's conclusions were presented to the European Parliament's special committee on the European Defence of Democracy Shield (EUDS).

The study emphasizes that Moscow's hybrid warfare tactics are directly linked to its ongoing conflict against Ukraine. Researchers note that these operations "are not a secondary front but central to Russia’s strategy." The report compares the method to ISIS tactics, which "used individuals with a criminal past in attacks," but in this case, the perpetrator is a state, not a terror organization.

Recruiting Russian-Speaking Convicts

The report identified 110 Russia-linked sabotage or attempted attacks in Europe (mostly in Poland and France) between January 2022 and July 2025. Eighty-nine of these were successful, while 21 were prevented. However, experts suggest the real number may be much higher due to undisclosed cases by secret services.

A total of 131 individuals were identified in connection with these incidents. At least 35 had criminal records and were reportedly recruited in prisons or through organized crime networks.

The Kremlin typically selects Russian-speaking men, around 30 years of age, who face financial difficulties and often hail from former Soviet countries. Recruitment efforts are mainly conducted via Telegram or through close associates. Financial incentive is the most significant factor. The report states that the amounts paid for tasks—ranging from distributing propaganda leaflets to preparing sabotage against critical infrastructure—vary from a few euros to thousands of euros.

Retaliation for Ukraine Support?

According to experts, Russia also uses illicit financial flows to fund these operations. These networks function both to circumvent Western sanctions and to integrate criminal organizations into the hybrid warfare strategy. The report states: "Illicit finance, organized crime, and hybrid operations are not independent; they are parts of a single plan."

Moscow's sabotage campaign in Europe, which includes bombings, arson, and attempted assassinations, is seen both as retaliation for support given to Ukraine and as a rehearsal for a potentially larger conflict.

A State Intertwined with the Underworld

Dominika Hajdu, a GLOBSEC expert, emphasizes that Russia's relationship with criminal organizations is not a new phenomenon. She recalls that following the collapse of the Soviet Union, anti-corruption efforts did not become a priority in Russia. Instead, bribery and illegal methods became a permanent part of the state mechanism.

Hajdu reminds that by 1994, more than 500 criminal organizations in Russia controlled approximately 40,000 companies. "In the early 2000s, the security bureaucracy, especially former KGB members, took control of the state. Thus, the ties with the underworld became a permanent part of the state system."

Recommendations for the EU

The report's authors propose a series of measures for the European Union:

• Tighter Online Monitoring: Online platforms, especially Telegram, should be monitored more strictly.

• Broaden the 'Hybrid Threat' Definition: EU countries are advised to broaden their definition of "hybrid threat" as many national strategies do not adequately account for informal actors like criminal organizations, ideological proxies, or financially motivated individuals. These gaps provide Russia with a "deniability space" for attacks and sabotage.

• Closer Public-Private Cooperation: Hajdu calls for closer cooperation between public institutions and the private sector: "Private companies have more sophisticated mechanisms than public institutions for detecting Russia's illicit activities. Therefore, a joint coordination platform must be established."

Experts believe such a platform could play a key role in preventing Russia's hybrid attacks in Europe.

www.wisenewspress.com

Source : DW