By Kacper Rekawek, Julian Lanchès, and Maria Zotova 

In this Report, Kacper Rekawek, Julian Lanchès, and Maria Zotova document how Russia has institutionalised a “crime-terror nexus” in its hybrid warfare strategy by recruiting criminal actors with weak societal ties across Europe to carry out kinetic and non-kinetic operations in support of state policy. They argue that since its full-scale invasion of Ukraine in 2022, this nexus has become central to Moscow’s ability to project power and evade accountability, and they offer policy recommendations to help European states and EU institutions detect, disrupt, and contain these criminally driven hybrid threats.

This report takes stock of Russian hybrid warfare in Europe in the context of its war of aggression against Ukraine. While doing so, it offers more than a catalogue of kinetic incidents attributed to Moscow; it focuses on the perpetrators and situates their actions within Russia’s longstanding reliance on hybrid warfare. This analysis highlights that many of these actors have criminal backgrounds and demonstrates how Russia has built its own state-driven “crime-terror nexus.” The phenomenon recalls earlier patterns seen in terrorist organisations such as ISIS, which recruited Europe’s criminals into violent campaigns under the guise of ideological redemption. This time, however, the state itself actively recruits and grooms socially marginalised, often Russian-speaking individuals residing in Europe to assist in state terrorism against European societies. This strategy complements the “spook-gangster” nexus that has for years underpinned Russia’s governance and operationalisation of foreign policy. Since the 2022 full-scale invasion of Ukraine, this nexus has become even more instrumental in mitigating the economic and geopolitical consequences of Moscow’s aggression. The report shows the extent to which criminality – whether through direct reliance on criminals to conduct attacks or through the “spook-gangster” nexus – constitutes a central pillar of Russia’s hybrid warfare. It opens with an overview of the phenomenon and traces Russia’s experience with hybrid tactics back to at least the 1920s. It then explores Moscow’s enduring use of criminality as a tool of domestic control and foreign policy, with particular emphasis on the post-2022 period. A brief comparative perspective highlights how other hostile state actors similarly integrate criminality into hybrid campaigns waged globally. All of these components build toward the report’s central focus: an assessment of Russia’s kinetic campaign as an integral part of its broader hybrid warfare, and of the actors enabling it. The final section provides practical recommendations to inform policies for both national authorities and EU institutions.

GLOBSEC and the International Centre for Counter-Terrorism (ICCT)2025. 23p.

By Matthew R. Redhead

Over the past decade, Western countries have faced an apparently rising tide of hostile activities perpetrated by state actors and their partners, many of which sit in the “grey” or “liminal” zone between peace and war, using hybrid or unusual methods as vectors of attack (Kilcullen, 2020). This body of activities has become known by a variety of terms, such as “state threats”, “hostile state activity” and “hostile activity by states”. However, much of the current discourse around state threats has been poorly and loosely defined, and has tended to focus more on the topic’s military than civilian aspects. Much research has also failed to ask a variety of basic questions about why the issue of state threats is so important now, both as a phenomenon, and also as a subject of policymaking for Western governments. Many of the activities that fall under the broad umbrella of state threats are well-known covert and clandestine activities such as espionage, sabotage and subversion. There are natural questions of how novel or significant state threats truly are, and indeed, how much Western governments care about them as a result. This research seeks to address these concerns, looking to provide firmer definitional boundaries, and, within them, to explore the scale, scope and character of modern state threats, especially – but not exclusively – from a Western perspective. The research notes that besides the apparent explosion in the volume and range of hostile activities, there is much that is “new” about them, from the combination of traditional intelligence tradecraft with new technologies, attempts to innovate, a willingness to take greater risks, and a growing willingness to contract out violent and/or dangerous clandestine and covert activities to both licit and illicit non-state actors – especially organised crime groups. It is also clear that many hostile activities take advantage of new vulnerabilities in society that have never existed before, such as the ubiquity of social media and societal reliance on technology. Overall, the research shows how state threats have become more important as tools of policy due to “geopolitical climate change”. Perceived changes in global power balances and receding agreement on international norms of behaviour are permitting and encouraging more states – non-aligned and Western, as well as authoritarian opponents of the West – to use hostile acts that mostly fall short of war to achieve their political ends. Although current evidence suggests that the results of these kinds of activities are mixed at best, their relative cheapness and apparent lack of political risk are likely to make them an attractive form of coercive statecraft in the medium term. While this might be bearable for highly resilient states in the short term, this is unlikely to be the case for less stable societies, and if sustained over the long term, could even have more severe effects on open societies that have robust protections in place.   

SOC ACE Research Paper 32. University of Birmingham. 2025. 223p.