Russia maintains network for hybrid warfare in Europe

A study by GLOBSEC and ICCT reveals Russia is employing an extensive hybrid warfare network in Europe, utilizing organized crime and financially vulnerable individuals for sabotage and illicit finance. Between January 2022 and July 2025, 110 Russian-linked acts of sabotage occurred across Europe, primarily in Poland and France, with operations funded through shadow financial channels to bypass sanctions and sustain Russia's war economy. This strategy, leveraging a long-standing nexus between the Kremlin and criminal elements, is viewed as both retaliation for European support of Ukraine and preparation for broader conflict, prompting calls for enhanced EU monitoring of online platforms and a broader definition of hybrid threats to include non-state actors.

Analysis

Russia is actively employing a sophisticated hybrid warfare network across Europe, as detailed by a GLOBSEC and ICCT study. This network, operating between January 2022 and July 2025, has been linked to 110 acts of sabotage and attempted attacks, predominantly in Poland and France, utilizing organized crime and financially vulnerable individuals. This represents a "crime-terror nexus" orchestrated by a state actor, serving as a central pillar of Russian strategy.

The financing of these operations is deeply intertwined with illicit finance and sanctions evasion. Moscow leverages shadow financial operations to covertly move funds, pay operatives, and sustain its war economy, effectively bypassing international restrictions. Recruitment, primarily online via platforms like Telegram, targets individuals motivated by financial incentives, with payments varying based on the severity of the act.

This strategy builds on the Kremlin's long-standing ties with criminal elements, which became integrated into the state system post-Soviet collapse. The kinetic actions, including bombings and arson, are viewed as both punitive for Europe's support of Ukraine and preparatory for broader conflict. The EU's response is complicated by "legal loopholes" and national doctrines that inadequately address non-state actors in hybrid threats.

To counter this, the study recommends enhanced monitoring of online platforms and a broadened definition of hybrid threats to include criminal organizations and profit-driven individuals. Crucially, it calls for stronger public-private cooperation, advocating for a coordinated platform, recognizing private companies' superior detection mechanisms for Russian criminal activities.

Key Decisions for Investors

• Monitor geopolitical risk indicators related to European security and Russia's hybrid warfare, as these operations can disrupt critical infrastructure and supply chains
• Evaluate potential impacts on companies with significant European operations or supply chain dependencies, particularly those vulnerable to sabotage or cyberattacks
• Assess the effectiveness of current sanctions regimes and the potential for increased enforcement or new measures targeting illicit financial networks, which could affect financial institutions and cross-border transactions
• Consider investments in cybersecurity and defense sectors, given the identified need for enhanced monitoring and security capacities against sophisticated state-sponsored threats