Last year, 11 Serbs were arrested and charged with being part of a coordinated, Europe-wide campaign to incite inter-communal tensions. They are accused of leaving severed pigs’ heads outside at least nine mosques across Paris. The arrested were essentially petty criminals, paid just €1,000 each, but they were recruited by a more serious criminal, who fled to Moscow. The claim is that he was recruited by Russian intelligence, who connected to him via existing organized crime connections with Russian gangsters.
This appears to have been part of a wider campaign, also involving the vandalism of Jewish sites and Holocaust memorials in Paris and near the Brandenburg Gate in Berlin, which were then amplified by Russian disinformation online networks.
In its use of criminals—often non-Russians recruited through transnational mafia networks, with the goal of spreading disruption, division, and extremism—this operation was characteristic of a new kind of threat coming from Moscow.
A Different Kind of Conflict
Russian President Vladimir Putin himself uses the word “war”—still banned when referencing his “special military operation” in Ukraine—to describe Russia’s relations with Europe. Indeed, for Putin, the war he is fighting in Ukraine is, after all, a proxy struggle with the West. To him, Kyiv is simply the latest instrument—after protesters and civil society organizations—the West has used to undermine his regime and Russia as a whole. It may sound extraordinary to Europeans, but he genuinely appears to consider himself on the defense.
Given that Europe is now essentially bankrolling Ukraine, paralyzing the Europeans through amplifying divisions between and within states and undermining its will and ability to continue to support Kyiv is a crucial battlefront in the conflict. Yet this is not a war in the traditional sense, and despite alarmist scenarios of “little green men” strolling into Estonia’s border town of Narva or Russian missiles descending on British cities, it is a struggle being played out through the range of alternative means I described in my book The Weaponisation of Everything: disinformation, subversion, economic influence, and sabotage.
Moscow has revived what the Soviet KGB called aktivnye meropriyatiya, active measures: a whole range of covert and subversive operations intended to disrupt its enemies. It has also seen the Russian state, on a kind of wartime footing, increasingly demand that all elements of society—illegal as well as legal—should play their full part. From prison camp inmates drafted into military service to artists expected to exalt the “special military operation” in their work, no element of Russian society is entirely immune at a time when there can be no more middle ground between the patriot and the traitor.
In fairness, to a considerable extent, this goes both ways. How else, after all, can we understand sanctions except as economic warfare? However, apart from the fact that Europe does not appear to be killing defectors and burning down shopping malls in Russia, there is one other aspect of this very 21st-century conflict that is so far distinctively Russian: the use of criminals as proxies.
A Long Relationship
Moscow is also exploiting one of the pernicious byproducts of globalization: the rise and increasing interconnectivity of organized crime. There has long been pragmatic cooperation between the state and the underworld in Russia. The tsarist secret police used criminals as agents abroad, just as Bolshevik revolutionaries collaborated with bank robbers to raise funds to publish their underground newspapers. In Stalin’s Gulags, gangsters from the vorovskoi mir (thieves’ world) traditional underworld subculture were used to keep the political prisoners in line. In the 1970s, the KGB recruited prostitutes and black marketeers to compromise foreign tourists.
The chaotic 1990s was a period during which the Russian mafia appeared almost uncontrolled, but since Putin took over the power of the state has been reaffirmed through institutions such as the Federal Security Service (FSB), even though corruption remains endemic. The strong connections between the security agencies and organized crime have been exploited in the past, such as encouraging hackers to join a massive cyberattack on Estonia in 2007.
However, it is the conflict which erupted in 2022 that has seen it turn much more directly and extensively to the underworld to help further its ends in Europe. As Europol warns in its most recent organized crime threat assessment, a “shadow alliance” with criminal networks in Europe has been established in the name of disrupting European states. It does not specifically name Russia as the foremost of the “hybrid actors” in question, but a Europol analyst I spoke to was candid: “There are all kinds of nations involved, like China, North Korea, Iran, but for now the Russians are the more problematic, and probably the most aggressive in recruiting criminals to advance their political agenda.”
In part, this is because the expulsion from Western embassies of some 400 Russian spies working under diplomatic cover has meant that they were forced to operate in different ways, and that often meant finding proxies. It also reflects the particular characteristics of the Russian mafia. When former President Boris Yeltsin infamously warned that Russia was becoming a “superpower of crime,” this was in part rhetorical. Nonetheless, Russian-based criminals (by no means all ethnic Russians) did quickly seek to internationalize their operations and build relationships with other criminals.
Underworld Service Providers
In the 1990s, the Russian mafia harbored dreams of empire building in Central and Eastern Europe, but they were overambitious. The Russian gangsters were tamed, killed, imprisoned, or expelled by local police and criminals. However, a criminal diaspora did emerge across Europe and beyond, especially once Russian networks became not would-be conquerors but deal-making merchant-adventurers. By the 2000s, they were returning to Europe as underworld service providers, offering existing local gangs everything from wholesale supplies of drugs to money laundering operations.
These criminal networks tend to be flexible, entrepreneurial, and profitable. The Russian gang that was broken in Portugal’s Operation Matrioskas in 2016, for example, laundered the proceeds of its operations at home by investing it in struggling European football clubs. That money and those stakes were used to bankroll illegal betting operations across the continent. Although they have particular concentrations, such as in Spain, Israel, and Germany, they are present all across Europe and have a wide range of contacts with local, non-Russian criminals.
They can be and are used not simply as proxies themselves, but as middlemen to widen the range of criminals potentially available to Moscow in its political warfare campaign. One Dutch intelligence analyst told me his real nightmare: “Russian proxies who are not Russians—and don’t even know they are working for Russia.” The rise of internet communications and payments has created an era of “gig geopolitics” and “pay-as-you-go sabotage,” in which not just gangsters but any down-on-their-luck individuals can be recruited for simple tasks and paid in cryptocurrency or through finance apps, all anonymously.
Money to Meddle
Despite the increased controls on movement between Russia and the West, its criminals are still smuggling all kinds of goods in and out of the country, from Afghan heroin to be sold on to European gangs, to sanctioned goods for its domestic market. Most of the sanctions-busting traffic is not done by organized crime so much as “gray market” entrepreneurs who import goods into one country legitimately, then ship it on to Russia. However, criminals do play a minor role in moving embargoed goods across the border.
More significant are the criminal networks laundering dirty money and trading in hard-to-track cryptocurrencies, which now often seamlessly blend money laundering, Kremlin influence operations, and personal enrichment. For example, Igor Chaika (son of former Prosecutor General Yuri Chaika) was an official business envoy to both Moldova and the breakaway, Russian-backed pseudo-state of Transnistria. Announcing sanction against Chaika, the US Treasury alleged that he tried to set up a crypto-mining business in Transnistria, while in contact with the FSB, and allowed his companies to be used by the Kremlin “to funnel money to the collaborating political parties in Moldova,” some of which was “earmarked for bribes and electoral fraud.”
It is not just about laundering money, after all, but also using it in support of Kremlin activities. In late 2022, Kristian Vanderwaeren, head of the Belgian customs service, noted that by “midyear, we had seen a massive increase in traditional illegal activity from Russian-linked groups that appear to have Russian government backing working to develop new revenue streams to replace damage from the sanctions.” The spies are not directly involved in crime so much as, in effect, “taxing” Russian-based gangs operating in the West, forcing them to pay some of their criminal profits into accounts outside Russia that can then be used to support intelligence operations with no direct link to Moscow.
Vandals and Spies
The Paris operation to heighten tensions between Jewish and Muslim communities and allow Russian propagandists to portray France as a country on the verge of violent internal conflict was just part of a range of such efforts to generate internal divisions across Europe. Young Moldovans in Poland have been paid to daub anti-NATO slogans ostensibly from disaffected locals, and then young Poles were recruited over the online messaging service Telegram to spray-paint anti-war graffiti on specified locations for 30 złoty (€7) a time. British criminals burnt down warehouses in east London, linked to a Ukrainian businessman involved in organizing aid for Ukraine.
Criminals—Russian and otherwise—are also being used in more aggressive and direct operations. In 2019, a Russian hitman recruited by the FSB gunned down Chechen anti-Moscow militant Zelimkhan Khangoshvili in Berlin’s Kleiner Tiergarten park. In 2023, Russian helicopter pilot Maxim Kuzminov, who had defected to Ukraine, was killed in Spain, where he had been living under a new identity. Although there has been no prosecution, the current thinking of the investigators is that this was carried out by Russian gangsters based in Spain, contracted by the GRU, Russia’s military intelligence service.
Once, the main form of such outsourced aggression was cyberattacks carried out by hackers engaged or encouraged by the Kremlin. That still happens, although not only have the Russian intelligence agencies expanded their own in-house cyber divisions, but they are not trying to select targets so much as encourage their own hackers to prey on Western companies and governments. It has been made clear to the Russian hacking community that as long as they are attacking Western targets, they will not face prosecution, extradition, or even investigation at home. The West is fair game.
Beyond that, having lost so many of their own intelligence officers in Europe, the Russians are also turning to all kinds of locals as auxiliary intelligence-gathering assets, some of whom again do not even know they are working for Moscow. A private detective agency may think it has been hired to follow someone by a suspicious spouse, but in reality, be monitoring a Russian émigré dissident. A researcher might believe they are working on a piece of investigative reporting, but actually be digging for compromising information to be used for blackmail or character assassination.
Much of the tradecraft of intelligence activity is not especially skilled, depending on such basic activity as collections from “dead-letter boxes” or other drops, simple surveillance, and leaving encoded messages in plain sight (such as chalking a cross on a particular post box): “much the same as the day-to-day activity of, say, a drugs gang,” an officer from Germany’s domestic intelligence service, the BfV, told me.
In some cases, local criminals, operating without the potential stigma of Russian citizens, have been engaged for such activities through their Russian-based organized crime suppliers. For example, in a substantial operation uncovered in Poland, a 23-year-old Ukrainian appears to have been the leader of a 16-man spying network working for the GRU. Mainly impoverished young Ukrainians, Belarusians, or Poles, they were largely tasked with simple activities, especially connected with monitoring the flow of military aid to Ukraine, such as placing cameras along railway lines. Such irregulars have become vital in providing typically low-level support, freeing up the remaining professional intelligence officers for more vital and complex missions.
When Does This End?
Even when the shooting war in Ukraine ends, it is likely that Putin will continue to regard the West as a threat, and so the hybrid campaign may diminish but not stop. Almost as important is that, as the security services and organized crime become ever closer, it will be a hard struggle to try and separate them: The criminals appreciate the security and opportunities provided by their new alliances, and the security officers consider the gangsters not just useful instruments but also partners in enrichment. This will have serious implications for both Russia and its neighbors.
Until their formal annexation by Moscow in 2022, the Donetsk and Lugansk People’s Republics in eastern Ukraine, were essentially criminalized pseudo-states, controlled by Moscow but run by a motley array of gangsters, opportunists, and warlords. One admittedly extreme scenario is that the demands of the war and the lasting damage done to the economy and the state’s legitimacy, as well as the return of hundreds of thousands of battle-scarred and disillusioned veterans, could lead to the “Donbasization” of the Russian Federation. A return to the full chaos of the “wild 1990s” is unlikely but not impossible. Levels of organized, violent, and armed crime in Russia are all rising; the police are 25-30 percent under-strength; and the risk of local alliances forming between organized crime and corrupt authorities are only increased by the state’s desire to use the criminals for its own ends.
More likely is that a Kremlin that has come to appreciate the value of organized crime as an instrument abroad, is desperate for income, and has become reconciled with the fact that, at least as far as the West is concerned, it is a pariah state, doubles down on this strategy. It could turn to Iran for example, where the Revolutionary Guards run smuggling rackets and “tax” criminal networks in the country to fund their operations. Alternatively, it could look to North Korea. Bureau 39 of the Secretariat of the Korean Workers’ Party is, in effect, North Korea’s “ministry of organized crime.” Its global criminal enterprises, from amphetamine trafficking to insurance fraud, bypass sanctions, support the faltering economy, and procure in-demand commodities for the ruling Kim family and their allies and cronies.
One way or the other, the growing instrumentalization of the Russian mafia by the Kremlin is not just a serious security challenge for Europe today; it is likely to be a concern for some time to come. In this context, proper spending on the police, intelligence, and security services as well as campaigns to discourage criminals from becoming Moscow’s proxies are arguably just as necessary as more tanks, drones, and missiles. The threat is complex and often covert, and our responses must be equally imaginative and multi-dimensional.
Mark Galeotti is an honorary professor at University College London and the director of the consultancy Mayak Intelligence. His latest book is Homo Criminalis: How Crime Organizes the World.
