Russia has created a network of criminals to carry out sabotage and wage hybrid warfare in Europe, a recent study shows.
For the purposes of its hybrid war against Europe, Russia has created a network of agents. They carry out sabotage operations in Europe, and Moscow specifically recruits men with a criminal past.
This conclusion was reached by experts from the non-governmental organization GLOBSEC and the International Center for Counter-Terrorism (ICCT) in a joint study entitled "Crime as a Tool for Waging Hybrid Warfare in Europe".
The study sheds light on Moscow's tactics in the context of the war in Ukraine. It shows that "hybrid operations are not a secondary element, but a central pillar of the Russian strategy". The researchers compare this tactic to the actions of the Islamic State (IS) - the terrorist organization that once recruited criminals in Europe.
"However, this time it is not about a terrorist organization, but about an entire state that encourages recruitment and operations," the study emphasizes.
Russian-speaking men with a criminal past
From January 2022 to July 2025, 110 sabotage and bombing attempts linked to Russia were carried out in several European countries - mainly in Poland and France. 89 of them were successful, and 21 were prevented. The authors of the study emphasize that the number of sabotages prevented is probably significantly higher, since the secret services do not always disclose such information.
Experts have identified 131 individuals involved in these incidents. At least 35 of them had criminal records and were recruited in prison or through criminal organizations, the study also learns.
For sabotage actions in Europe, the Kremlin recruits mainly men in their 30s, who in most cases are from post-Soviet countries, speak Russian and are in difficult situations. Recruitment is often carried out online, most often through Telegram, as well as through relatives and friends.
The main incentive for recruiting perpetrators is money. They range from small sums in euros - for distributing pro-Russian leaflets, for example, to significant incentives when it comes to attacks on critical infrastructure, the study says.
Punishment for Europe for its support for Ukraine
To finance these activities, Moscow also uses illegal means to circumvent Western sanctions. "These channels allow the Kremlin to bypass restrictions and at the same time to more actively use these criminal networks in its hybrid warfare strategy", the study authors write.
"Illicit financial flows, criminal activity and hybrid operations are elements of a single action plan", the report also says. It formulates both goals of Russia's military campaign, including bombings, arson attacks and assassination attempts: on the one hand, they are a punishment for Europe's support for Ukraine, and on the other, they are preparation for a possible larger conflict.
The Kremlin's ties to the underworld
The Russian government's recruitment of criminals is nothing new, explains Dominika Hajdu of the think tank GLOBSEC. People who "lived east of the Iron Curtain" well remember how the chronic shortages of goods in the Soviet Union created and reinforced society's dependence on the shadow economy.
Since the collapse of the Soviet Union, unlike other post-communist countries, the fight against corruption has never been a priority in Russia. Instead, corrupt methods have become the norm and the way the authorities work.
According to Hajdu, in 1994 there were over 500 criminal groups operating in Russia, controlling around 40,000 businesses. "In the early 2000s, representatives of the security services, including former officers of the domestic intelligence service KGB, consolidated their control over the Russian state. And their connections with the criminal world became part of the state system," the expert explains.
How is Europe responding?
Polish MEP Bartłomiej Sienkiewicz from the European People's Party (EPP) also believes that the use of criminal methods and links to the criminal world by the Russian government is a long-standing practice. He has no doubt that the Kremlin uses these links to the criminal world to recruit agents in Europe. The problem is "how to react to this", says Sienkiewicz, recalling the recent drone operations at airports in Europe that blocked air traffic. "Nobody is shooting them down. We want to take measures against those hired by Russia, but the activity on Telegram has not yet been stopped, although the EU should actually control such platforms", the MEP emphasizes.
The authors of the study formulate a number of recommendations on how to counter them. Among them are - better monitoring of online platforms, in particular Telegram, expanding the definition of the "hybrid threat" and the removal of certain legal loopholes - for example, the failure to sufficiently take into account the role of "non-state actors such as criminal organizations, ideologically motivated perpetrators, or individuals acting in their own interests". This is precisely what now allows Russia to deny its guilt or involvement in attacks and sabotage.