Russia's Criminal Proxy Network: From Mafia to Hybrid Warfare

Europol and recent investigations reveal Moscow has built a 'shadow alliance' with organized crime to destabilize Europe through coordinated sabotage, violence, and disinformation.

Russia has turned increasingly to criminal networks as instruments of hybrid warfare against Europe since 2022, coordinating organized crime groups to carry out sabotage, political interference, and campaigns designed to spread division and extremism. Recent evidence includes an investigation into 11 Serbs arrested for a coordinated Europe-wide campaign inciting inter-communal tensions, with connections traced through organized crime to Russian intelligence. Researchers documented 151 known cases of crime-terror nexus activities between February 2022 and February 2026, with activity accelerating in late 2025 and early 2026. Europol has warned in its 2025 organized crime threat assessment of a "shadow alliance" between state actors and criminal networks designed to destabilize European states. Intelligence reports confirm a fourfold increase in Russian sabotage operations across Europe from 2024 compared to prior years, with the surge continuing through 2025 and into 2026. Tactics include weapons smuggling to Italian mafia clans, counterfeiting operations that fund intelligence activities, money laundering through European financial systems, and direct sabotage targeting critical infrastructure. The Kremlin views itself as in a state of war with the West, making organized crime a cost-effective tool: operations that could destabilize societies and undermine European support for Ukraine cost a fraction of military expenditure. Criminal networks provide operational funds, plausible deniability, and access to local cells across Europe. Russian intelligence officers recruit petty criminals through existing transnational mafia connections, coordinate disinformation campaigns amplifying incidents of violence or inter-communal tension, and direct sabotage attacks on infrastructure. Since Putin's 2022 invasion of Ukraine, Russian intelligence has accelerated cooperation with organized crime, tying criminal activity directly to geopolitical goals. The blurring between security agencies and criminal gangs—already present since the 1990s—has intensified, with organized crime now functioning as an extension of state hybrid warfare doctrine. European law enforcement remains challenged by resource constraints and fragmented coordination, leaving significant investigative gaps.

How could this affect you

Traced by who's actually in the path of this — not everyone is.

Direct

European citizens and critical infrastructure operators

Russian-directed criminal networks conduct sabotage, arson, and violent attacks designed to destabilize public confidence and damage essential services; incidents accelerated significantly in 2025-2026.

Likely

European political leaders and electoral systems

Criminal proxies execute coordinated campaigns to incite inter-communal violence, spread disinformation, and amplify social divisions in order to weaken EU cohesion and undermine political support for continued Ukraine aid.

Likely

European law enforcement agencies

The hybrid nature of organized crime-state coordination makes attribution and prosecution difficult; under-resourced police forces struggle to distinguish criminal activity from state-directed operations and coordinate transnational responses.

Possible

NATO and transatlantic security planners

Criminal networks operating under Russian direction could conduct intelligence gathering, sabotage, or asymmetric attacks on NATO member infrastructure or personnel, exploiting the deniability that criminal cover provides.

Off-Lens

Who is covering this — and who is not.

1 source reviewed

🌐DE

100%

🌐ip-quarterly.com

Perspectives not in sources

🇷🇺 Russia🌐 European Union

Chanakya's Move

Whose move this was, what they're betting on, what could counter it.

Russia's move is a low-cost hedge against military constraints. Facing battlefield losses and economic pressure, Moscow is outsourcing destabilization to criminal proxies that require minimal coordination overhead and provide plausible deniability. The strategy serves multiple goals: it weakens European political will to support Ukraine, sows internal division that could fracture EU and NATO cohesion, and tests Western resolve below the threshold of direct military response. The counter is for Europe to treat hybrid incidents as a coordinated campaign rather than isolated crimes, establish rapid attribution mechanisms, and impose unified costs on Russian intelligence operatives and their criminal intermediaries. If Europe continues to respond piecemeal, Russia will read that as tolerance and escalate.