Russia’s Crime-Terror Nexus: Criminality as a Tool of Hybrid Warfare in Europe
By
Kacper Rekawek
A new joint report by GLOBSEC and the International Centre for Counter-Terrorism (ICCT) uncovers how Russia has built a state-driven crime–terror nexus, exploiting criminal actors to advance its hybrid war against Europe.
The study situates Moscow’s tactics against the backdrop of its full-scale war on Ukraine, showing that hybrid operations are not a side theatre but a central pillar of Russian strategy. Like ISIS a decade ago, which recruited European criminals into its ranks, Russia is now grooming socially marginalised individuals—often Russian-speaking men with prior convictions—to conduct sabotage, arson, and other attacks on European soil. This time, however, it is not a terrorist organisation but a state actor driving recruitment and operations.
The tempo of such operations accelerated after the expulsion of over 600 Russian operatives from Europe since 2018. Deprived of its intelligence officers under diplomatic cover, Moscow pivoted to Europe’s underworld, outsourcing sabotage to “single-use” civilian agents.
The study identifies 110 kinetic incidents linked to Russia since 2022, most often occurring in Poland and France. 131 identified individuals we involved in the incidents, of whom at least 35 had criminal pasts and were often recruited through prisons or organised crime groups. The typical recruit was a man in his 30s, often from a post-Soviet state, Russian-speaking, and living in precarious economic conditions. Recruitment often occurred online via platforms such as Telegram, but also through kinship and friendship ties, creating small, resilient networks that acted locally yet sometimes crossed borders to obscure attribution. Financial incentives were decisive: payments ranged from a few euros for graffiti to substantial sums for attempted attacks on critical infrastructure.
https://www.globsec.org/what-we-do/publications/russias-crime-terror-nexus-criminality-tool-hybrid-warfare-europe
