Russia is recruiting criminals for sabotage across Europe

Rusija uses criminal networks for sabotage across Europe and recruits criminals who speak Russian via Telegram. Its goal is destabilization and revenge on the EU for supporting Ukraine, a new study claims Deutsche says

For the purposes of its hybrid war against the European Union, Russia has created a network of agents in which state institutions are closely linked to the criminal underworld. A joint study by the non-governmental organization GLOBSEC from Bratislava and the International Center for Combating Terrorism (ICCT) from The Hague shows that Russian-speaking people with a criminal past are being recruited to carry out sabotage across Europe. The results of that research were also presented in Brussels, at the session of the Special Committee of the European Parliament for the Protection of Democracy (EUDS).

The study links that tactic to the war against Ukraine, emphasizing that "hybrid operations are not secondary, but a key pillar of Russian strategy." Researchers compare the tactic to the methods of the Islamic State (IS), which has previously recruited criminals in Europe. "This time it is not a terrorist organization, but a state actor conducting recruitment and operations," the study said.

Criminals as saboteurs

From January 2022 to July 2025, 110 attempted sabotage and attacks linked to Russia were recorded in Europe – the most in Poland and France. Of these, 89 were successful and 21 were prevented. The authors of the study believe that the number of attacks prevented is probably even higher, because the intelligence services do not release all the data.

131 persons linked to the incidents were identified, of which at least 35 were previously convicted and recruited in prisons or through criminal organizations. The Kremlin usually recruits men who are around 30 years old, from post-Soviet countries, who speak Russian and are in difficult life circumstances. Recruitment often takes place online, through Telegram, but also through relatives and friends.

The main motive for participating in sabotage is money — from a few euros for distributing pro-Russian leaflets, to large sums for attacks on key infrastructure.

Revenge of the EU for helping Ukraine

To finance these activities, Moscow also uses illegal methods to circumvent Western sanctions. "Those channels allow the Kremlin to evade restrictions and involve criminal networks more deeply in its hybrid warfare strategy," the study said.

"Illegal money flows, crime and hybrid operations are not separate but elements of a single plan of action," it claims. And more: "The Russian military campaign - bombings, arson attacks, assassination attempts - all of this should be seen as a punishment for the EU's support for Ukraine, but also as a preparation for a possible larger conflict."

Crime as a state tool

Dominika Hajdu from Globsec says that the use of criminals by the Russian authorities is nothing new. Citizens who lived "east of the Iron Curtain" remember how shortages in the USSR created dependence on the gray economy, she reminds, and at the same time adds that, after the collapse of the Soviet Union, unlike other post-communist countries, the fight against corruption in Russia was not a priority. Instead, corruption has become the norm and the working method of state institutions, Hajdu claims.

According to her, in 1994, more than 500 criminal groups were active in Russia, which controlled about 40.000 companies. In the early 2000s, former members of the KGB consolidated their control over the state, and their connections with the underworld became part of the state system, according to Dominika Hajdu from Globsec.

The EU must react.

Polish politician Bartomey Sienkiewicz, a member of the European Parliament from the European People's Party (EPP), believes that the Kremlin has long been using criminal methods and the underground to recruit agents in Europe.

"The problem is how to react," he told DW, citing the example of drones that occasionally paralyze airports in the EU. "No one has brought them down. We want to act against the recruited persons, but the activities on Telegram have not been stopped yet, although the EU should control such platforms," ​​suggests the Polish politician.

Recommendations for the EU

And the authors of the study propose a whole series of measures as the EU's response, including better monitoring of online platforms, especially Telegram. They also suggest expanding the definition of "hybrid threats", as many national strategies do not sufficiently take into account the role of "informal actors such as criminal groups, ideological brokers or individuals acting out of self-interest". It is precisely this legal gap that allows Russia to deny responsibility for attacks and sabotage, according to the authors of the study.

Dominika Hajdu emphasizes that it is important that there is cooperation between the public and private sectors: "They must be partners, because private companies in Europe have more sophisticated mechanisms for detecting Russian criminal activities." That is why she advocates for the creation of a coordination platform to prevent Russian hybrid attacks on European countries.

Source: DW