By Kacper Rekawek, Julian Lanchès, and Maria Zotova 

In this Report, Kacper Rekawek, Julian Lanchès, and Maria Zotova document how Russia has institutionalised a “crime-terror nexus” in its hybrid warfare strategy by recruiting criminal actors with weak societal ties across Europe to carry out kinetic and non-kinetic operations in support of state policy. They argue that since its full-scale invasion of Ukraine in 2022, this nexus has become central to Moscow’s ability to project power and evade accountability, and they offer policy recommendations to help European states and EU institutions detect, disrupt, and contain these criminally driven hybrid threats.

This report takes stock of Russian hybrid warfare in Europe in the context of its war of aggression against Ukraine. While doing so, it offers more than a catalogue of kinetic incidents attributed to Moscow; it focuses on the perpetrators and situates their actions within Russia’s longstanding reliance on hybrid warfare. This analysis highlights that many of these actors have criminal backgrounds and demonstrates how Russia has built its own state-driven “crime-terror nexus.” The phenomenon recalls earlier patterns seen in terrorist organisations such as ISIS, which recruited Europe’s criminals into violent campaigns under the guise of ideological redemption. This time, however, the state itself actively recruits and grooms socially marginalised, often Russian-speaking individuals residing in Europe to assist in state terrorism against European societies. This strategy complements the “spook-gangster” nexus that has for years underpinned Russia’s governance and operationalisation of foreign policy. Since the 2022 full-scale invasion of Ukraine, this nexus has become even more instrumental in mitigating the economic and geopolitical consequences of Moscow’s aggression. The report shows the extent to which criminality – whether through direct reliance on criminals to conduct attacks or through the “spook-gangster” nexus – constitutes a central pillar of Russia’s hybrid warfare. It opens with an overview of the phenomenon and traces Russia’s experience with hybrid tactics back to at least the 1920s. It then explores Moscow’s enduring use of criminality as a tool of domestic control and foreign policy, with particular emphasis on the post-2022 period. A brief comparative perspective highlights how other hostile state actors similarly integrate criminality into hybrid campaigns waged globally. All of these components build toward the report’s central focus: an assessment of Russia’s kinetic campaign as an integral part of its broader hybrid warfare, and of the actors enabling it. The final section provides practical recommendations to inform policies for both national authorities and EU institutions.

GLOBSEC and the International Centre for Counter-Terrorism (ICCT)2025. 23p.

By David Lewis and Tena Prelec

This paper provides an analytical overview of how Russian actors and proxies are using illicit financial flows (IFF) to support Russian foreign policy goals. It shows how Russia has used illicit finance to fund political interference campaigns, promote disinformation, and support military operations outside Russia, including the international activities of the Wagner network.

IFF includes a wide range of illicit and illegal cross-border financial activities, including high-level corruption, money-laundering, and sanctions evasion. Illicit finance played a significant role in Russian foreign policy pre-2022 invasion of Ukraine. Subsequent international sanctions against Russia have further amplified Moscow's reliance on illicit business and financial practices.

Russia has become increasingly reliant on IFF in three important areas:

• First, IFF facilitates sanctions evasion and is central to Russia’s efforts to source weapons and dual-use technology.

• Second, IFF is used to fund political interference and information operations globally, with an increasing trend towards activities in the Global South.

• Third, IFF supports Russia's involvement in armed conflicts, through the funding of paramilitary forces such as Wagner and commercial deals that accompany Russian military activities in the Middle East and in Africa.

Unless effectively countered, Russia's growing use of illicit financial and economic tools will give it an advantage in its war against Ukraine. The Wagner network demonstrates how illicit financial networks can support military proxies in ways that pose a serious threat to international security.

An effective response to illicit finance requires a holistic approach, combining effective sanctions with systematic efforts to tackle money-laundering and illicit finance in key financial and logistical hubs, including in the UK and other Western countries.

SOC ACE Research Paper No 17. University of Birmingham. 2022. 43p.