By Kacper Rekawek, Julian Lanchès, and Maria Zotova 

In this Report, Kacper Rekawek, Julian Lanchès, and Maria Zotova document how Russia has institutionalised a “crime-terror nexus” in its hybrid warfare strategy by recruiting criminal actors with weak societal ties across Europe to carry out kinetic and non-kinetic operations in support of state policy. They argue that since its full-scale invasion of Ukraine in 2022, this nexus has become central to Moscow’s ability to project power and evade accountability, and they offer policy recommendations to help European states and EU institutions detect, disrupt, and contain these criminally driven hybrid threats.

This report takes stock of Russian hybrid warfare in Europe in the context of its war of aggression against Ukraine. While doing so, it offers more than a catalogue of kinetic incidents attributed to Moscow; it focuses on the perpetrators and situates their actions within Russia’s longstanding reliance on hybrid warfare. This analysis highlights that many of these actors have criminal backgrounds and demonstrates how Russia has built its own state-driven “crime-terror nexus.” The phenomenon recalls earlier patterns seen in terrorist organisations such as ISIS, which recruited Europe’s criminals into violent campaigns under the guise of ideological redemption. This time, however, the state itself actively recruits and grooms socially marginalised, often Russian-speaking individuals residing in Europe to assist in state terrorism against European societies. This strategy complements the “spook-gangster” nexus that has for years underpinned Russia’s governance and operationalisation of foreign policy. Since the 2022 full-scale invasion of Ukraine, this nexus has become even more instrumental in mitigating the economic and geopolitical consequences of Moscow’s aggression. The report shows the extent to which criminality – whether through direct reliance on criminals to conduct attacks or through the “spook-gangster” nexus – constitutes a central pillar of Russia’s hybrid warfare. It opens with an overview of the phenomenon and traces Russia’s experience with hybrid tactics back to at least the 1920s. It then explores Moscow’s enduring use of criminality as a tool of domestic control and foreign policy, with particular emphasis on the post-2022 period. A brief comparative perspective highlights how other hostile state actors similarly integrate criminality into hybrid campaigns waged globally. All of these components build toward the report’s central focus: an assessment of Russia’s kinetic campaign as an integral part of its broader hybrid warfare, and of the actors enabling it. The final section provides practical recommendations to inform policies for both national authorities and EU institutions.

GLOBSEC and the International Centre for Counter-Terrorism (ICCT)2025. 23p.

By Mark Galeotti

In May 2022, Lithuanian police raided two underground factories where counterfeit cigarettes worth some €73 million were being produced.2 This happens all the time, and even the involvement of a Russian-linked organized crime group was hardly unusual. However, as the investigation extended to Belgium (where the goods would be transhipped to Britain), it became clear that behind the gangsters lay Russian intelligence officers, who were using the business – or at least part of its profits – to raise operational funds for their activities in Europe. With Putin regarding himself as ‘at war’ with the West, at a time when Europol chief Catherine de Bolle is warning that organized crime is on the rise across Europe,3 and Thomas Haldenwang, head of Germany’s counter-intelligence agency, is assessing ‘the risk of [Russian] state-controlled acts of sabotage to be significantly increased’,4 it is perhaps unsurprising that gangsters and spies would find themselves brought together in his campaign. It has, after all, become commonplace since the full-scale invasion of Ukraine in February 2022 to characterize the relationship between Russia and the West as some shade of war: economic, political, but typically more than just cold. Indeed, even as he insists that his invasion is not a war, just a ‘special military operation’ (SVO) – actually calling it a ‘war’ can conceivably get Russians a 15-year prison sentence5 – Putin freely uses the term when describing his country’s engagement with the West. However, it is less clearly understood just how significant and long held this view of his may be. In this context, it does seem in hindsight that Putin has considered himself as de facto at war with the West – or, more precisely, that the West has been warring against him – since at least around 2012. After stepping back from the presidency to the position of prime minister in order to observe the letter, if not the spirit, of term limits, all the while clearly still running the country, when Putin announced he would be returning to the Kremlin, this was for many the last straw. Demonstrations that became known as the Bolotnaya Protests were mastered and dispersed, but Putin seems to have been unable or unwilling to accept that they were a genuine, organic expression of dismay. Instead, he chose to see them as spurred by the US Department of State, after then-Secretary of State Hillary Clinton ‘gave the signal’ to opposition leaders.6 There had been a growing school of thought within Russian security circles that the West was using ‘political technologies’ to topple hostile governments, and support for civil society, democratization and the rule of law were seen as part of this campaign. As a former Kremlin insider put it, Putin was scared, then angry. As far as he was concerned, this was it, this was a sign that the West – the Americans – were coming for him. So he was determined to fight back, and that didn’t just mean defending himself, the repressions and arrests, it meant going on the attack. He was clear, he made it clear to us all: if the West was coming to mess with him, we would mess them up worse, by whatever means necessary.

Russia’s transition from a “conscription state” to a full “mobilization state”, after the 2022 invasion of Ukraine, has intensified the involvement of criminal groups in operations tied to sanctions-busting, cyber warfare, and intelligence. Organized crime networks provide Russia with access to restricted goods, such as advanced electronics for its military, and facilitate money laundering and illegal financial flows. Notably, Russian intelligence services have relied on criminal syndicates to supplement their espionage activities, including sabotage, cyberattacks, and assassinations.

The report also highlights Russia’s weaponization of migration, using smuggling networks to create political instability across Europe. Meanwhile, Putin’s regime has blurred the lines between state and criminal actors, using them as tools to evade international sanctions and expand Russian influence globally.

“Gangsters at War” reveals how Russian-based organized crime operates as a tool of Kremlin foreign policy, focusing not just on profits but on weakening geopolitical rivals. From sanctions evasion to destabilizing societies, criminal networks have become a key element in Russia’s geopolitical arsenal. The report calls for increased vigilance, international cooperation, and stronger countermeasures to address this growing threat to global stability

Geneva: Global Initiative Against Transnational Organized Crime.2024. 62p.

By Julian Rademeyer.

Much has been written about state-sponsored North Korean criminal activity in Asia and Europe. But relatively little attention has been devoted to North Korea’s illicit activities in Africa, which run the gamut from trafficking of rhino horn and ivory to gold and tobacco. This report – which draws on hundreds of pages of documents, academic research, press reports and interviews with government officials, diplomats and defectors in Southern Africa and South Korea – presents an overview of evidence implicating North Korea in criminal activity ranging from smuggling and drug trafficking to the manufacturing of counterfeit money and black market cigarettes. It examines North Korea’s current involvement in Africa, the complex history of African-North Korean relations and allegations that the country’s embassies in several African states are intimately connected to a complex web of illicit activity aimed at bolstering the Kim Jong-un regime and enriching cash-strapped diplomats. An analysis of press reports and other publicly available information conducted by the Global Initiative Against Transnational Organised Crime shows that North Korean diplomatic passport holders have been implicated in at least 18 cases of rhino horn and ivory smuggling in Africa since 1986. Despite North Korea’s waning influence on the continent, incriminating evidence linking its diplomats to ivory and rhino horn smuggling continues to emerge. The report includes interviews with a number of high-level North Korean defectors about their knowledge of, and stated involvement in, a range of criminal activities. They claim that smuggling by North Korean diplomats is widespread, with couriers traveling regularly to Pyongyang and Beijing in China with diplomatic bags stuffed with contraband. “[D]iplomats…would come from Africa carrying rhino horn, ivory and gold nuggets,” explained one defector who ran a North Korean front company in Beijing. “Every embassy [in Africa] was coming two or three times every year.” The persistent abuse of diplomatic immunity by North Korean diplomats and agents poses a particularly vexing problem for law enforcement. Increasing economic sanctions and isolationist policies designed to cripple North Korea’s nuclear weapons capabilities are likely to fuel the expansion of the regime’s illicit activities and statesponsored criminal networks.

Geneva: Global Initiative Against Transnational Organized Crime, 2017. 40p.

By Arthur Conan Doyle .

Sir Arthur Conan Doyle came to the fore to publicize the dreadful massacres and genocidal crimes of Belgium’s King Leopold, who, fraudulently bought up all the land that he could then call it his Congo. He actually “owned” his own country. He then proceeded to exploit the indigenous peoples of the Congo to rob the Congo of its “riches.” He treated all the Congolese peoples as his personal slaves and used them to produce sugar, rubber and whatever else he could export and build his own riches and the lavish mansion in France and Belgium. An influential writer like Conan Doyle was needed to expose Leopold for the evil tyrant that he was, because, incredibly, Leopold achieved all his horrible gains under the guise of “humanity” and “charity” in helping the Congo people to become civilized.

NY. Doubleday. (1909) 156 pages.