Russia using criminal networks to drive increase in sabotage acts, says Europol

Russia and other state actors are driving an increase in politically motivated cyber-attacks and sabotage of infrastructure and public institutions in the EU, the bloc’s police enforcement agency has found.

Europol’s 80-page serious and organised crime threat assessment for 2025 also describes in detail how “hybrid threat” actors have established a “shadow alliance” with organised criminal gangs in Europe to try to destabilise the functioning of the EU and its member states.

It identifies “a broad range of criminal activities and tactics” being deployed by “criminal proxies” including sabotage, arson, cyber-attacks, data theft, and migrant smuggling.

The report does not specifically identify Russia as a “hybrid threat actor”, though it notes: “There is an increase in politically motivated cyber-attacks against critical infrastructure and public institutions, originating from Russia and countries in its sphere of influence.”

The EU commissioner for internal affairs and migration Magnus Brunner said at the launch of the report: “Criminal networks that work on behalf of foreign powers – that is something new. Some threats enter our union in less than a second as an encrypted message, for instance, ordering an assassination of a rival drugdealer. Some threats enter in a few days, like a bus full of migrants, paid by the Russians.”

At the launch of the report at Europol’s headquarters in The Hague, the Polish undersecretary of state for internal affairs, Maciej Duszczyk, said a recent cyber-attack on a hospital which interrupted medical care for several hours was linked to a state actor.

He also said migrant-smuggling incidents on the border with Belarus were running to 150 to 170 a day and involved state actors working with criminal gangs in the Middle East and Turkey.

Europol’s assessment of the threat posed by criminal gangs is conducted every four years.

Poland’s police chief Marek Borón warned that, even if a peace deal is struck, the Russian invasion of Ukraine would have a lasting impact, with a potential “increase in the black market in weapons and ammunition and attempts by Russia criminal-speaking groups to exert influence”.

On Monday, prosecutors in Lithuania attributed blame for an arson attack on an Ikea store in Vilnius last summer to the Russian military intelligence agency GRU, which is also suspected of being behind fires in other supermarkets and shopping centres.

In response, Poland’s prime minister, Donald Tusk, said the prosecutors had “confirmed our suspicions that responsible for setting fires to shopping centres in Vilnius and Warsaw are the Russian secret services”.

Two Ukrainian suspects have been arrested – one in Lithuania, the other in Poland – over the attack.

Europol found that criminal networks “increasingly operate as proxies in service of hybrid threat actors” in a cooperation that has mutual benefits.

This “shadow alliance” allows Russia to use criminal networks in an ad hoc fashion, “leveraging each other’s resources, expertise, and protection to achieve their objectives”.

Criminal gangs use a “woodpecker modus operandi”, meaning incidents are “originally assessed as single events, such as sabotage of critical infrastructure, water, energy supply for example, arson intimidation, kidnappings”.

But it can later emerge that the incidents are “part of a larger strategic objective of destabilisation, involving persistent, targeted and cumulative disruptions rather than a single, overwhelming attack”.

“Much like a woodpecker weakens a tree over time through repeated strikes, hybrid threat actors engage in ongoing, seemingly minor actions that collectively erode stability, security, and trust in institutions,” said Europol.

Last year, several EU member states raised the alarm over a number of sabotage and arson attacks.

When criminal networks also become proxies for hybrid threat actors, “there is reason to believe they are intended to destabilise the functioning of the EU and its member states”, by focusing “on democratic processes, social coherence within societies, the sense of security or the rule of law”, says the report.

The Europol report also warns of the increasing use of AI to provide scale and speed to online fraud and cybercrime.

In Germany, it found young people “groomed and recruited” via social media and messaging apps with “script kiddies” provided to help them with the codes needed to carry out hacking and cyber-attacks.

De Bolle said “online fraud has reached epidemic levels” and AI was an accelerant posing a particular challenge to specialists in police networks.