By MARIANA OLAIZOLA ROSENBLAT AND LUKE BARNES

Political violence in the United States has increased in recent years and shows no signs of declining.1 This trend was underscored in September 2025 by the assassination of conservative activist Charlie Kirk at Utah Valley University. In the two weeks before and after Kirk’s killing, shooting incidents in Colorado, Minneapolis, and Dallas seized public attention.2 Executive Summary Amid growing concern about the relationship between online rhetoric and real-world violence, this report examines how violent extremist actors across the ideological spectrum use digital platforms to respond to, amplify, and exploit acts of political violence in the United States. Drawing on opensource intelligence (OSINT) gathered initially from March 24 to June 6, 2025, and then extended to include a period following Kirk’s assassination, this analysis reveals sophisticated cross-platform strategies employed by far-right, far-left, violent Islamist, and nihilistic violent extremist (NVE) actors. This report uses “violent extremist” to refer to individuals who support or commit ideologically motivated violence to further political goals, as well as those who commit violence driven by generalized hatred rather than a coherent ideology. Key Findings • Violent extremist groups systematically exploit trigger events—high-profile incidents of violence—to recruit supporters, justify their ideologies, and call for retaliatory action. • These groups employ multi-platform strategies, using mainstream sites like X for visibility and recruitment while maintaining a presence on private or semi-private platforms for coordination and more extreme content. • Far-right groups capitalized on cases like the Austin Metcalf stabbing and the Iryna Zarutska killing to advance narratives of White victimhood and justify threats against perceived enemies. • Activities of both far-left and far-right networks revealed a troubling convergence around antisemitic targeting. • Violent Islamic groups are more aggressively monitored than domestic groups espousing similar levels of violence. • Violent Islamist groups, facing stricter moderation than domestic extremists, have migrated to decentralized platforms like Rocket.Chat while disseminating symbolic propaganda elsewhere. • Nihilistic Violent Extremist (NVE) communities glorify violence across ideological lines for shock value and digital notoriety, making their threats harder to predict based on political triggers. This report aims to bring clarity to a conversation clouded by vagueness and partisanship. It first maps the domestic threat landscape, offering timely examples of online violent discourse from across the ideological spectrum targeting US individuals or institutions, and sets out a clear definitional framework for types of speech that carry legal significance under US constitutional doctrine. It closes with practical recommendations for online service providers and policymakers.

New York: NYU Stern Center for Businsss, 2025. 36p.

By Katarzyna Jaskoa, Gary LaFree, James Piazzac , and Michael H. Beckerd

Although political violence has been perpetrated on behalf of a wide range of political ideologies, it is unclear whether there are systematic differences between ideologies in the use of violence to pursue a political cause. Prior research on this topic is scarce and mostly restricted to self-reported measures or less extreme forms of political aggression. Moreover, it has generally focused on respondents in Western countries and has been limited to either comparisons of the supporters of left-wing and right-wing causes or examinations of only Islamist extremism. In this research we address these gaps by comparing the use of political violence by left-wing, right-wing, and Islamist extremists in the United States and worldwide using two unique datasets that cover real-world examples of politically motivated, violent behaviors. Across both datasets, we find that radical acts perpetrated by individuals associated with left-wing causes are less likely to be violent. In the United States, we find no difference between the level of violence perpetrated by right-wing and Islamist extremists. However, differences in violence emerge on the global level, with Islamist extremists being more likely than right-wing extremists to engage in more violent acts.

Political violence in the United States has increased in recent years and shows no signs of declining.1 This trend was underscored in September 2025 by the assassination of conservative activist Charlie Kirk at Utah Valley University. In the two weeks before and after Kirk’s killing, shooting incidents in Colorado, Minneapolis, and Dallas seized public attention.2 Executive Summary Amid growing concern about the relationship between online rhetoric and real-world violence, this report examines how violent extremist actors across the ideological spectrum use digital platforms to respond to, amplify, and exploit acts of political violence in the United States. Drawing on opensource intelligence (OSINT) gathered initially from March 24 to June 6, 2025, and then extended to include a period following Kirk’s assassination, this analysis reveals sophisticated cross-platform strategies employed by far-right, far-left, violent Islamist, and nihilistic violent extremist (NVE) actors. This report uses “violent extremist” to refer to individuals who support or commit ideologically motivated violence to further political goals, as well as those who commit violence driven by generalized hatred rather than a coherent ideology. Key Findings • Violent extremist groups systematically exploit trigger events—high-profile incidents of violence—to recruit supporters, justify their ideologies, and call for retaliatory action. • These groups employ multi-platform strategies, using mainstream sites like X for visibility and recruitment while maintaining a presence on private or semi-private platforms for coordination and more extreme content. • Far-right groups capitalized on cases like the Austin Metcalf stabbing and the Iryna Zarutska killing to advance narratives of White victimhood and justify threats against perceived enemies. • Activities of both far-left and far-right networks revealed a troubling convergence around antisemitic targeting. • Violent Islamic groups are more aggressively monitored than domestic groups espousing similar levels of violence. • Violent Islamist groups, facing stricter moderation than domestic extremists, have migrated to decentralized platforms like Rocket.Chat while disseminating symbolic propaganda elsewhere. • Nihilistic Violent Extremist (NVE) communities glorify violence across ideological lines for shock value and digital notoriety, making their threats harder to predict based on political triggers. This report aims to bring clarity to a conversation clouded by vagueness and partisanship. It first maps the domestic threat landscape, offering timely examples of online violent discourse from across the ideological spectrum targeting US individuals or institutions, and sets out a clear definitional framework for types of speech that carry legal significance under US constitutional doctrine. It closes with practical recommendations for online service providers and policymakers.

PNAS 2022 Vol. 119 No. 30 e2122593119

By Noor Huda Ismail

SYNOPSIS

The increasing susceptibility of minors to recruitment by violent extremist groups via online platforms poses a clear and present danger. Cases in Singapore and Indonesia illustrate how radicalisation exploits factors such as identity crises, wounded masculinity, and digital isolation. Emphasis on rehabilitation as opposed to punishment is critical, necessitating the involvement of families, schools, and communities to safeguard children through fostering trust and empathy.

COMMENTARY

As a father of two teenage boys, aged 16 and 14, I cannot read the news of radicalised minors without feeling alarmed and deeply concerned. The recent case in Singapore, involving a 14-year-old student, is particularly striking.

Security officials reported that the boy was influenced by a “salad bar” of extremist beliefs, including ISIS propaganda, incel subculture and those on the far-right and far-left. He is not much older than my youngest child, who, like millions of teenagers, spends hours on gaming, social media, and online communities that quietly shape their identity, sense of belonging, and moral compass.

For the unfamiliar, incel stands for “involuntary celibate”. These are mostly young men, expressing deep resentment toward women and society for their sexual frustrations. From a gender perspective, incel ideology feeds on what scholars call wounded masculinity.

Many boys today struggle with identity in a world where traditional markers of male success – financial stability, social recognition, romantic relationships – are increasingly uncertain. Online platforms amplify these feelings, creating spaces where humiliation and anger are validated, sometimes evolving into misogyny or even violence.

By Phil Williams and Sandra Quincoses

The economic and political environments in Latin America have been advantageous for local, regional, and transnational threat networks. Specifically, technology, increased international trade and economic interdependence, heightened interest in natural resources for profit, synthetic drug production, economic disparities, corruption, impunity, and unstable political conditions have led to a complex web of opportunities that requires new, progressive ways to address criminal activities. The creativity of threat networks along with their entrepreneurial strategies have resulted in increasing power and influence. Despite efforts by the United States and some governments in Latin America to combat these networks, the everchanging global environment has worked in their favor. Indeed, some countries in Central and South America are in danger of transforming into what Jorge Chabat described as “criminally possessed states.” Furthermore, gangs in Central America, especially in Honduras where MS-13 has become more closely linked to drug trafficking, have reduced local extortion, become more aware of their nascent political power and have even engaged in rudimentary social welfare provision.

By Kathryn Westmore

Within a relatively short period of time, Chinese money laundering organisations (CMLOs) have become one of the pre-eminent global money laundering threats. Using centuries-old techniques, modern-day CMLOs have evolved into multi-billion-dollar operations, providing quick, cheap and efficient money laundering services to transnational organised crime groups (OCGs). In some countries, such as the US, CMLOs have come to dominate the market, and their activities are growing in the UK and Europe. This paper seeks to explore the reasons why CMLOs have become so successful and how their activities have developed. It identifies that the imposition of strict capital controls by China has created a demand from wealthy Chinese individuals for ways in which they can move money out of the country to access Western currencies. CMLOs are able, for a fee, to provide this from the funds that they launder on behalf of transnational crime groups. CMLOs also take advantage of large Chinese diaspora populations both as potential clients and as part of their operations; for example, through the recruitment of “money mules” to deposit criminal proceeds into bank accounts controlled by the CMLOs. These factors, combined with OCGs’ increasing demand for “professional” money laundering services and the involvement of Chinese groups in the fentanyl drug trade, have created the perfect conditions for CMLOs to flourish. This paper goes on to apply a “state threats” lens to the activities of CMLOs, building on the work of researcher and risk consultant Matthew Redhead,1 to inform readers how countries in the West could respond to the threat. Ultimately, the research concludes that there is no evidence to suggest that the activity of CMLOs is being directed by the Chinese state. While there is evidence that Chinese money laundering schemes can, and do, involve Chinese government officials and members of the Chinese Communist Party, that is very clearly not the same as saying that the schemes are state directed. This conclusion, therefore, prompts a follow-up question, which the paper explores, as to the prospect of collaboration between the West and China in tackling CMLO activity. 

SOC ACE Research Paper 36. University of Birmingham. 2025. 34p.

By Anthony A. Braga, Cory Schnell Brandon C. Welsh

 Broken windows theory suggests that police can prevent serious crime by addressing social and physical disorder in neighborhoods. In many U.S. cities, recent increases in disorder, fear, and crime have initiated calls for an intensification of disorder policing efforts. Disorder policing programs can be controversial, with evaluations yielding conflicting results. Further, a growing number of descriptive analyses of aggressive order maintenance programs raise concerns over varied negative consequences, such as increased racial disparities in arrests of citizens. Systematic review and meta-analytic techniques were used to conduct an updated analysis of the effects of disorder policing on crime. Fifty-six eligible studies including 59 independent tests of disorder policing interventions were identified, representing almost twice the number included in the previous review. As part of the meta-analysis, new effect size metrics were used. The updated meta-analysis suggests that policing disorder strategies are associated with overall statistically significant crime reduction effects that spill over into surrounding areas. The strongest program effect sizes were generated by community and problem-solving interventions designed to change social and physical disorder conditions at crime  hot spots. Conversely, aggressive order maintenance strategies did not generate significant crime reductions. Policy Implications: The types of strategies used by police departments to address disorder seem to matter in controlling crime, and this holds important implications for police–community relations, justice, and crime prevention. Further research is needed to understand the key programmatic elements that maximize the capacity of these strategies to prevent crime

Criminology & Public Policy. 2024;23:745–775 

By Piotr Bąkowski

 As law enforcement agencies carry out lawful interception of electronic communications, they face numerous challenges stemming from rapid technological advancements. The growing use of messaging services and the development of 5G networks, which feature enhanced privacy and security measures such as encryption, have had the unintended consequence of hindering law enforcement's access to crucial data. Policymakers and regulators are working to strike a balance between meeting law enforcement needs and protecting the privacy of communications and cybersecurity. In 1994, the Council of the EU adopted a resolution on the lawful interception of telecommunications, but relevant EU laws also encompass broader rules on data protection and electronic communications, such as the General Data Protection Regulation (GDPR), the Law Enforcement Directive, the ePrivacy Directive, and the European Electronic Communications Code. In recent years, a lively debate has emerged on how best to address the operational needs of law enforcement agencies. The EU faces unique challenges, including the fragmentation of national rules and specific issues related to roaming. To address these concerns, a High-Level Group on access to data for effective law enforcement was established, providing recommendations that informed the Commission's Roadmap for law enforcement access to data, presented in June 2025. This is one of four publications that explore different aspects of the roadmap for effective and lawful access to data for law enforcement. These include a summary of the roadmap, and briefings on lawful interception, data retention and digital forensics.   

Brussels:  EPRS | European Parliamentary Research Service, 2025.

By Raúl Zepeda Gil

Violence rising in Latin America since the early 1990s has puzzled media, policymakers and academia. Characterising high scales of violence in non-political confrontations has been one of the main challenges. The main argument of this essay is that the hybrid criminal nature of violence in Latin America by non-state organisations has pushed the discussion to several misinterpretations and conceptual stretching that produces fog rather than clarity. Instead, this essay proposes a concept of criminal war that can capture the complex nature of violence in Latin America by drawing convergences and divergences from diverse fields of literature and confronting usual mischaracterisations in current Latin American research.

Third World QuarTerly, 2023, Vol. 44, No. 4, 776–794

By Andrew P. Bontemps, Elizabeth S. Hawes, Bailey E. Pridgen, William P. Wagner, Dominique Black, Karen L. Cropsey

Background:Cannabis use has increased in the United States as legalization has spread. While Δ-9 THC remains the most-used federally illegal substance, use of other psychoactive hemp-derived products (Δ-8 THC, Δ-10 THC, HHC, THC-O) has grown. The current study investigated patterns of cannabis use and perceptions of harm and benefit of cannabis across states with differing cannabis laws.

Method

Participants (N=639) were adults endorsing past-90-day cannabis use who lived in one of 15 states selected based on cannabis laws (recreational use, medical use, illegal). Participants completed self-report questionnaires endorsing types of cannabis used, methods of consuming and acquiring cannabis, and ranking of potential harm and benefit of consumption methods.

Results

The majority (N=573; 89.7% of participants) endorsed past-30-day use of Δ-9 THC, regardless of legal status. There was significantly greater use of alternate cannabis forms in states where Δ-9 THC remains illegal (past-90-day: χ2(2)=16.78, p<.001; past-30-day: χ2(2)=9.50, p=.009). Individuals from states with legal recreational cannabis most frequently purchased cannabis legally (52.0%), but high levels of non-legal purchase existed regardless of legal status (47.5%). Participants reported primarily consuming Δ-9 THC through smoking (86.1%), CBD through ingestion (50.5%), and alternative cannabis types through vaping (43.8-57.7%). Average harm rankings were lower for smoking if it was the primary method of consumption.

Conclusions

Individuals purchased and consumed cannabis regardless of legal status and legal status was not significantly associated with harm or benefit rating, controlling for demographic and use data. Individuals appear more likely to purchase through legal means, if available.

Drug and Alcohol Dependence Reports

Available online 14 March 2026, 100431

By Sou Lee 

The purpose of this study is to gain a holistic understanding of the Asian gang phenomenon through the application of a meta-synthesis, which is seldom utilized within the criminal justice and criminology discipline. Noblit and Hare’s (1988) seven step guidelines for synthesizing qualitative research informed this methodology. Through this process, 15 studies were selected for synthesis. The synthesis of these studies not only identified prevalent themes across the sample, but also provided the basis for creating overarching metaphors that captured the collective experience of Asian gang members. Through the interpretive ordering of these metaphors, a line of synthesis argument was developed in which three major inferences about the Asian gang experience were made. First, regardless of ethnic and geographic differences, the experiences of Asian gangs and their members are similar. Second, although extant literature has applied different theories to explain gang membership for individual ethnic gangs (e.g. Chinese, Vietnamese), this synthesis revealed that the dominant theory for explaining the onset and persistence of Asian gangs is Vigil’s (1988) multiple marginality theory. Finally, in comparison to the broader literature, Asian gangs are more similar than they are different to non-Asian gangs because of their overlap in values.

Thesis, 2016. 127p.

By Galen Lamphere-England

Gaming is now the most profitable form of entertainment worldwide, with over 3.42 billion people playing some form of games, accounting for a market of $187.7 billion engaging across consoles, PCs, and mobile devices.1 Nearly nine in ten children in middle and upper-income countries play online games2 . While online multiplayer games foster social connection, creativity, and communitybuilding, they are also increasingly exploited by violent organizations, ranging from non-state armed groups in conflict-affected settings to hybrid criminal networks. These actors use gaming spaces to propagandize, groom, recruit, and organize, leveraging gaming platforms' social and technical features to target children and young players. This policy brief examines how gaming ecosystems are being exploited to socialize and recruit children to participate in organized violence and provides recommendations for policymakers, practitioners working with children, and the gaming industry to safeguard children in online gaming environments. Online gaming is neither inherently harmful nor a direct cause of violence, but its social and technical infrastructure is being exploited at scale by malign actors. 3 Indeed, as the American Psychological Association framed the issue in a 2020 resolution, “attributing violence to violent video gaming is not scientifically sound and draws attention away from other factors.”4 At the same time, specific harms are affecting children via online gaming today. To protect children and young players, industry leaders, regulators, law enforcement, and practitioners working with children must act now, establishing robust prevention, detection, and response strategies that ensure children can enjoy their right to play and their right to be protected from violence. Gaming’s prosperous future depends on ensuring its spaces remain safe, inclusive, and free from children being targeted by violent actors and organizations. This report provides a series of recommendations to help achieve that aim.

By William Downs

Police misconduct is behaviour by a police officer that falls below the standards of professional behaviour for the police.

Cases of police misconduct can arise from concerns raised by police officers or staff, or following incidents where members of the public have been harmed by the actions of the police.

What are the laws on police misconduct?

Legislation specifies how allegations of police misconduct should be handled, though the framework is complex. In short, most allegations of police misconduct are handled in line with rules set out in the Police Act 1996 and Police (Conduct) Regulations 2020. This legislation is designed to support the police in maintaining a disciplined force. The Home Office provides statutory guidance on implementing this legislation.

London: UK Parliament, House of Commons Library, 2025. 23p. 

Socio-economic status, demographic background and criminal history.

By Lisa Westfelt

This study focuses on aspects that have not yet been examined in Swedish research: the socio-economic status and demographic background of victims and perpetrators at the time homicides are committed, as well as the victims and perpetrators’ criminal histories.

English summary of Brå report 2025:5 Stockholm: The Swedish National Council for Crime Prevention (Brå), 2025. 14p.

By Lisa Westfelt, Sara Jonsson and Ulrika Lindstedt

Brå has been commissioned by the Government to survey crime and fear of crime in rural areas. Brå’s commission has included describing the specific nature of criminality and how fear of crime affects people in rural areas. Brå has also analysed the incidence of crimes committed by animal rights activists. The study is mainly based on police report statistics, the Swedish Crime Survey and interviews both with municipal police officers and crime prevention coordinators in rural municipalities and with experts. Less crime and greater sense of safety As with previous studies in this area, the analysis shows that, overall, there is less crime in rural areas. This applies to both reported offences and self-reported victimisation. People living in rural municipalities report less fear of crime than those in other types of municipalities. Crime trends follow broadly the same patterns as elsewhere in Sweden. According to the Swedish Crime Survey, various types of municipalities show no differences in terms of citizens’ experiences with the police, but the survey shows a marginally lower level of confidence in the justice system in rural municipalities. However, several interviewees argue that confidence in the police, as well as in public authorities in general, is lower in certain very sparsely populated rural areas. Specific challenges for crime prevention There are certain conditions in rural areas that, directly or indirectly, impact crime and create challenges for crime prevention. Financial difficulties and skills shortages Many rural municipalities have declining and ageing populations, which leads to a shrinking tax base and financial difficulties. The low population density and declining populations of rural areas have made it more difficult for businesses providing goods and services in rural areas to operate. As public utilities and infrastructure are gradually dismantled, social trust can be negatively affected, and, with it, confidence in the justice system. Our interviews reveal that municipalities experience difficulty in securing necessary skills as well as in recruiting and retaining municipal police.

English summary of Brå report 2025:1 Stockholm: The Swedish National Council for Crime Prevention (Brå), 2025.2025. 8p.

By Lina Fjelkegård and Emma Patel

The number of residential burglaries has decreased sharply in recent years – between 2017 and 2023, they were basically halved. However, many people still become victims of burglary. In 2023, 10,000 residential burglaries were reported to the police, and only 4 per cent were solved. Those affected may experience the burglary as a violation of privacy, and feel unsafe at home.

For these reasons, Brå initiated this study on residential burglaries. The purpose is to provide an overall picture of the nature of residential burglaries, but also to examine the development of this crime over time, and how the police handle residential burglaries. Different methods and materials were used for this. We start from a number of preliminary investigations into residential burglaries, which Brå has coded and analysed. We have also used reporting statistics, data from police records, and interviews with police employees.

By Henrik Angerbrandt, Mariana Dufort and Victor Dudas

This study examines gun violence trends in the criminal milieu since the mid-2000s, analysing how the criminal milieu has changed and what role these changes may have played in gun violence trends.

By Graeme R. Newman and Ronald V. Clarke

In Superhighway Robbery, Graeme Newman and Ronald Clarke provide a grounded, pragmatic analysis of how the digital revolution didn't necessarily create new types of criminals, but rather provided them with a much more efficient set of tools. They move away from the sensationalized "hacker" myths of the early 2000s to focus on the cold reality of Situational Crime Prevention. The book's central thesis is that the internet acts as a vast infrastructure—a superhighway—that significantly reduces the effort required to commit traditional crimes like theft, fraud, and piracy while increasing the potential rewards and lowering the risk of being caught.

By applying their famous CRAVED model to the digital world, the authors explain that data and software are the ultimate targets because they are easily concealable, removable, and available. They argue that the most effective way to stop cybercrime is not to wait for a change in human nature, but to change the digital environment itself. This involves "designing out" crime by making digital targets harder to reach and less profitable to exploit. Ultimately, Newman and Clarke strip away the mystery of the "Information Age" to reveal that cybercrime is essentially a matter of opportunity, and by closing those digital windows of opportunity, we can make the superhighway a significantly safer place.

In the digital realm, the CRAVED model explains why certain data or media becomes a prime target for "superhighway robbery." Concealability is at an all-time high because digital files take up no physical space and can be hidden in encrypted folders or behind innocuous filenames, making them easy to possess without detection. These files are incredibly Removable because they can be copied or moved across the globe in milliseconds, allowing a thief to "steal" an item while the original remains in place. The Availability of these targets is virtually limitless; once a movie or piece of software is uploaded to a server, it is accessible to anyone with a connection, twenty-four hours a day.

The Value of digital goods remains high because they often represent thousands of hours of professional labor or sensitive personal information that can be sold on the dark web. These items are also highly Enjoyable, as they often consist of popular entertainment, games, or high-end tools that people naturally want to use. Finally, they are perfectly Disposablebecause there is a massive, ready-made market of willing buyers or downloaders, ensuring that a criminal can quickly offload their "loot" for profit or social capital without the logistical headaches of physical fencing.

Cullompton, Devon. UK. Willan. 2003.

By Charles M. Larson

In "Numismatic Forgery," author Charles M. Larson pulls back the curtain on one of the most secretive and sophisticated threats to the world of coin collecting.1 Far from a simple historical overview, this book serves as a definitive guide to the dark art of the "super-forger," detailing the methods used to deceive even the most seasoned experts.

Larson provides a deep dive into the technical evolution of counterfeiting—from the crude cast copies of the past to the modern, high-precision struck forgeries that haunt the current marketplace. By meticulously explaining the tools of the trade, including centrifugal casting, pressure casting, and the creation of deceptive dies, Larson equips collectors, dealers, and historians with the knowledge necessary to spot the subtle "tells" of a fake.

Key features of this essential numismatic reference include:

• The Forger's Toolkit: A step-by-step examination of the physical processes used to create counterfeit currency.

• Detection Techniques: Practical advice on identifying "transfer marks," edge filing, and suspicious luster.

• Case Studies: Real-world examples of famous forgeries that have infiltrated major collections.

• The Ethics of the Hobby: A sobering look at how forgery undermines the historical integrity of numismatics.

Whether you are a casual hobbyist or a professional dealer protecting a million-dollar inventory, "Numismatic Forgery"is an indispensable resource for anyone who wants to ensure that the history they hold in their hands is the real deal.

By Luke Rodeheffer

Cybercrime is a growing global threat, causing trillions of dollars in economic damage annually. This report explores how Eastern Europe and Russia have become a significant hub for cybercriminal activity, fueled by historical legacies, economic disparities, and state connections.

The study outlines the key drivers of cybercrime in Russia and neighboring countries, including the rise of ransomware, the exploitation of geopolitical ‘grey zones’, and the blurred lines between hackers and state-sponsored cyber operations.

One of the most significant shifts analyzed in the report is the impact of the Russia-Ukraine war on cybercrime. As the war escalated, cybercriminal groups split along national lines, with some hackers supporting Russian intelligence while Ukrainian cybercriminals turned their efforts against Russia, engaging in financial fraud and targeted attacks.

Ransomware has emerged as the most profitable form of cybercrime in the region, overtaking other criminal activities like credit card fraud and botnet operations. Russian-speaking cybercriminals dominate the global ransomware industry, with an estimated 75% of ransomware revenue going to actors linked to the Russian-language underground. Despite international sanctions and takedown efforts, ransomware gangs have adapted, operating like structured organizations with management teams and even physical offices.

The report also highlights how cryptocurrencies are fueling cybercrime and helping Russia evade financial sanctions. Stolen funds from cyberattacks are laundered through unregulated crypto exchanges, allowing criminals to move money across borders undetected. At the same time, shell companies and illicit financial networks are being used to bypass restrictions imposed by Western governments, creating new challenges for global financial security.

Finally, the study explores the deepening relationship between cybercriminals and the Russian state. While organized cybercrime networks have traditionally operated independently, there is growing evidence that Russian intelligence agencies are leveraging these networks for espionage, cyberwarfare, and political influence operations. Hackers are increasingly targeting critical infrastructure, stealing data from adversaries, and assisting the state in strategic cyber campaigns.

This analysis provides detailed insights into how cybercrime has evolved, the future risks, and key policy recommendations. Understanding the ecosystem behind cyber threats is crucial for global security as cyber threats continue escalating.

Geneva, SWIT: Global Initiative Against Transnational Organized Crime. 2025. 44p.

was prepared by the Research and Trend Analysis Branch, Division for Policy Analysis and Public Affairs under the supervision of Angela Me, Chief, Research and Trend Analysis Branch.

Since the full-scale invasion of Ukraine by the Russian Federation in February 2022, the political economy of Ukraine has been profoundly transformed.1 The aggression affected both licit and illicit trade routes, disrupted criminal organizations, and spawned new forms of informal and illicit exchange at the frontline and in the rear of the country. It has also led to the emergence of new challenges, such as the development of new skills and technologies that could be exploited by transnational organized crime. This report aims to address the following overarching questions: how has the ongoing war against Ukraine affected organized crime and illicit markets in Ukraine, and what are the possible implications for the country, the region and the international community? These questions are addressed through research into the following six areas: • Organized crime structures and their evolution • Drug supply and demand, including production and trafficking • Online scams, and cyber and telephone fraud • Arms trafficking • Economic crime, including smuggling of cigarettes and custom fraud • Trafficking in persons • The facilitation of illegal exit and draft evasion To address the overarching research question about the effects of the war on organized crime and illicit markets, the chapters compare data for the pre-war and post-invasion periods. The report covers the period of January 2021 to June 2024, with background data for 2019-2020 and preceding periods where available and relevant, used for contextualization. It is based on desk research and in-country fieldwork, with analysis of publicly available official statistics and secondary literature, court decisions and key informant interviews. Field data collection and analysis were conducted from December 2023 to June 2024 (see Annex A for more details). The overall purpose of this research is to provide an evidence base to the government of Ukraine and national agencies involved in responding to organized crime, the United Nations (UN) and other international organizations, and other UN Member States, for countering crime-related challenges emerging out of the war against Ukraine. This research focuses on government-controlled parts of Ukraine. Consideration of alleged war crimes is outside the scope of this research.

Vienna: United Nations Office on Drugs and Crime, 2025. 81p.