Russia Uses Mafia-Style Networks to Wage Hybrid War in Europe

German officials have identified Russian-Eurasian criminal networks as a key instrument of Moscow’s hybrid operations in Europe, providing the Kremlin with plausible deniability for sabotage, intimidation, and targeted killings.

Russia is systematically recruiting organised crime networks to conduct sabotage and assassination operations across Europe, according to an unpublished German Interior Ministry response to a parliamentary inquiry, cited by Spiegel on 11 May. The findings were also flagged by Ukraine’s Centre for Countering Disinformation, as reported by United24 Media.

German policing refers to these structures as REOK, Russian-Eurasian Organised Crime networks. The Interior Ministry assessed that they can be deployed for sabotage, intimidation, and targeted attacks while giving Moscow a buffer of deniability. The arrangement works in both directions: Russian authorities tolerate or actively protect certain criminal groups, which in turn can be called on to support state-directed operations when needed.

The shift toward criminal proxies is partly a response to circumstance. Since Russia’s full-scale invasion of Ukraine, European countries have expelled large numbers of Russian diplomats and suspected intelligence officers, significantly narrowing Moscow’s traditional espionage infrastructure on the continent. Criminal networks fill the gap.

Green Party lawmaker Marcel Emmerich described the pattern as Russia and other authoritarian actors using “mafia-style” networks to project political influence and carry out hostile activity inside Europe.

Documented cases illustrate the method. The 2019 contract killing of a Georgian exile in Berlin’s Tiergarten park has been linked by German officials and security experts to Russian state direction. In 2024, an incendiary device was planted in a DHL parcel at Leipzig cargo airport. Ukraine’s Centre for Countering Disinformation noted that both cases fit a broader pattern it has been tracking: Moscow increasingly relies on one-time operatives recruited through Telegram, social media, and criminal channels, people with no formal connection to Russian intelligence services and therefore harder to trace back to the Kremlin.

The CPD added that similar recruitment is also targeting individuals inside Ukraine itself, and that the agency has prepared joint guidance with the Security Service of Ukraine and the Ministry of Internal Affairs to help citizens recognise and avoid such approaches.

European security services, the CPD concluded, increasingly treat Russia not as the source of isolated criminal incidents but as a state running a systematic hybrid warfare programme against the continent.