A new joint report by GLOBSEC and the International Centre for Counter-Terrorism (ICCT) exposes how Russia has developed a state-driven crime–terror nexus, exploiting criminal actors to advance its hybrid war against Europe.
The study frames Moscow’s tactics within the context of its full-scale invasion of Ukraine, showing that hybrid operations are not a peripheral strategy but a core pillar of Russian statecraft. Drawing parallels with ISIS a decade ago, which recruited European criminals, the report reveals that Russia is now targeting socially marginalized individuals—often Russian-speaking men with prior convictions—to carry out sabotage, arson, and other attacks on European soil. Unlike a terrorist organisation, these operations are orchestrated directly by a state actor.
According to the report, the pace of such operations increased sharply after Europe expelled over 600 Russian operatives since 2018. Deprived of intelligence officers under diplomatic cover, Moscow turned to Europe’s criminal underworld, outsourcing sabotage missions to “single-use” civilian agents.
The study documents 110 kinetic incidents linked to Russia since 2022, with the highest numbers reported in Poland and France. Authorities identified 131 individuals involved, at least 35 of whom had criminal backgrounds and were often recruited through prisons or organised crime networks. Typical recruits are men in their 30s, Russian-speaking, from post-Soviet states, and living in precarious economic circumstances. Recruitment often occurs online via platforms such as Telegram, as well as through family and friendship networks, creating small, resilient cells that can act locally while sometimes crossing borders to obscure attribution. Financial incentives play a decisive role: minor acts, like graffiti, earn a few euros, while attempts on critical infrastructure can bring substantial payments.
The report also highlights the financial dimension of Moscow’s hybrid operations. Russia reportedly relies on shadow financial networks to move money covertly, pay operatives, and sustain its war economy. These channels allow the Kremlin to bypass sanctions while embedding criminal networks deeper into its hybrid warfare strategy.
The findings underline that illicit finance, criminality, and hybrid operations are not separate threats but elements of a single, coordinated playbook. Russia’s campaign—including bombings, arson, and assassination plots—serves both as retribution for European support to Ukraine and preparation for potential wider conflict.
The report calls for a broader understanding of hybrid threats, stronger cooperation between public and private sectors, and increased investment in Europe’s internal security capabilities.
