Russia’s Special Operations Abroad: An Integrated Machine of Hybrid Aggression
Over the past two decades, the Russian Federation has gradually transformed the way it conducts its overseas operations. What began as isolated intelligence operations at the start of the 21st century has evolved into a far more complex system combining intelligence agency activities, military operations conducted by proxy forces, legal instruments, and repressive actions targeting political exiles. Research by leading Western think tanks shows that Russia’s strategy regarding its activities abroad is now multi-layered and encompasses both classic intelligence operations and actions of a transnational repressive nature. In this model, political assassinations, sabotage, operations through intermediaries, and new legal norms form a unified system for demonstrating state power. Findings by investigative journalists (notably The Insider) regarding the creation of the so-called Center 795 [1] indicate that the Russian security apparatus is undergoing another phase of reorganization. This can be viewed as an attempt by the Putin regime to create a more integrated structure responsible for conducting special operations outside the RF.
From the point of view of security, the evolution of Russian foreign operations has several significant implications. First, the importance of operations conducted below the threshold of open armed conflict is growing. Most Western analysts emphasize that Russia’s operational strategy in Europe increasingly relies on hybrid operations that combine intelligence activities, disinformation, and sabotage. Second, the phenomenon of transnational repression is becoming increasingly significant, and the actions of authoritarian states against political diasporas are emerging as one of the main challenges for democratic countries. With regard to Russia, this is especially evident in the case of political exiles from that country living in Europe. Third, the development of structures such as Military Unit 29155 [2] and Center 795 indicates the growing professionalization of the Russian Federation’s overseas special operations. This means they can be conducted in a more coordinated manner and be more difficult to detect.
Added to this are legislative changes being implemented in Russia. In particular, they include provisions allowing for the disregard of international court rulings, as well as the potential use of armed forces to protect Russian citizens abroad. These changes indicate an attempt to create a new legal framework for operations conducted outside the country’s territory.
Russian Foreign Operations: From Sporadic Actions to an Institutionalized Architecture of Power Projection
After 1991, the Soviet KGB was split into several separate agencies, and its intelligence capabilities were significantly weakened. Consequently, during that period, the foreign operations of the newly established Foreign Intelligence Service of the Russian Federation and the reformed Main Directorate of the General Staff of the Armed Forces of the Russian Federation (better known as the GRU) were sporadic and quite limited in scope, focusing primarily on traditional intelligence activities.
The situation began to change with the consolidation of the Russian system of power at the beginning of the 21st century. With the rise to power of former KGB officer Vladimir Putin, a process of restructuring the Russian security apparatus began, and the significance of special services within the country’s political system grew. The rule of the Kremlin’s new leader brought about the institutional rehabilitation of structures with roots in the KGB and an increase in the influence of special service personnel within the state apparatus. In the 2000s, there was a gradual restoration of the operational capabilities of Russia’s law enforcement agencies and special services, which included the strengthening of the FSB [3], the Foreign Intelligence Service (SVR), and the Main Intelligence Directorate (GRU), as well as the development of their capacity to conduct operations abroad.
Since the first decade of the 21st century, the Russian Federation’s strategy for foreign operations has become increasingly complex. Analytical studies indicate that it combines political, informational, economic, and intelligence tools. In addition to traditional intelligence activities, Moscow conducts operations carried out by military intelligence units or intermediary structures, including private military companies, and resorts to repression against political opponents residing outside the RF. As a result, these operations create a multi-layered system of power projection that allows Russia to influence the security environment of other countries without the need for open armed conflict.
Legislative Changes as an Element of the Strategy for Foreign Operations
The transformation of Russia’s overseas operations is also reflected in legislative changes. In recent years, the Russian authorities have been gradually adapting the regulatory framework to the growing scale of these operations. For instance, in mid-April 2026, the State Duma passed in the first reading amendments to the laws “On Defense” and “On Citizenship of the Russian Federation”, which allow, under the presidential decree, the use of armed forces abroad to protect Russians facing persecution on the territory of other states [4]. At the same time, it was noted that such action is permitted in situations where Russian citizens are being prosecuted by foreign or international legal institutions whose jurisdiction Moscow does not recognize. These changes are part of a broader conflict between the Russian legal system and international institutions of justice. In December 2025, Vladimir Putin signed a law allowing Russia to disregard the decisions of foreign and international criminal courts if their jurisdiction does not stem from international agreements concluded by the Russian Federation or UN Security Council resolutions.
In reality, this represents a shift in the definition of national interests. The protection of citizens is no longer the exclusive responsibility of diplomacy and consular law but is viewed as an element of national security and the potential use of force. From the perspective of European countries, this approach raises questions about the scope of actions the Russian state may deem permissible beyond its own territory.
Direct State Operations
One of the pillars of Russia’s foreign operations is the activity carried out directly by state agencies – primarily the intelligence services and special forces units of the armed forces. In several high-profile cases of political assassinations committed outside Russia, investigations by law enforcement agencies and investigative journalists have pointed to links between the perpetrators and Russian intelligence agencies, particularly the GRU. Among the most well-known examples are the 2006 murder of former FSB officer Aleksandr Litvinenko in London and the 2018 attempted poisoning of former GRU officer Sergei Skripal in Salisbury.
According to the findings of the British public inquiry, as outlined in “The Litvinenko Inquiry Report”, his murder was carried out by individuals linked to Russian intelligence agencies and was likely approved by Russia’s top leadership. Journalistic investigations have also shown that GRU officers using fake documents were involved in the Salisbury operation. Most experts link these operations to the activities of Military Unit 29155, which was responsible for conducting destabilization and sabotage operations in Europe.
Proxy Operations and the “Shadow War”
The second pillar of Russia’s foreign operations strategy consists of operations carried out by organizations that are formally independent of the state but in fact linked to the RF’s security apparatus.
Research by leading think tanks shows that Russian secret services are increasingly using networks of intermediaries, local agents, and other forms of proxy operations, making it difficult to clearly determine their affiliation. Experts often characterize such actions as operations conducted in the “gray zone,” encompassing sabotage, collecting intelligence, and destabilization campaigns.
The most striking example of this model was the activities of the private military company “Wagner”, which conducted operations in Syria, Libya, the Central African Republic, and Mali, among other places. As noted in the report by the Global Initiative Against Transnational Organized Crime, this PMC’s activities encompassed not only military operations but also the training of local security forces, protection of government agencies, and information operations.
Center 795 in the Context of the Reorganization of Russia’s Foreign Operations Apparatus
Since The Insider’s investigative report describes the history and structure of this new special unit, subordinate to the GRU, in considerable detail, it is worth focusing only on some aspects of its activities.
Unlike other special units, the structure of Center 795 is interagency in nature. It includes officers from different military units of the Russian security apparatus, but the core of the special unit consists of former officers from Directorate “A” (“Alfa”) and Directorate “B” (“Vympel”) of the FSB’s Special Purpose Center.
According to journalists, financial support for the project was provided by individuals linked to the Russian military-industrial complex, including the head of the Rostec Corporation, Putin’s close associate Sergei Chemezov [5], and co-owner of the Kalashnikov Concern Andrei Bokarev. This allowed officers at Center 795 to receive high salaries; for example, the chief of a department was paid approximately $5,400 per month, in addition to his salary from the Russian Ministry of Defense.
A notable feature of the Russian special services – whose personnel must be Russian citizensn – is the presence of Belarusian citizens, Dmitry Drozdov and Sergey Radkevich, among the command staff of Center 795. Since officers from an allied country lack a Russian institutional background, this would make it more difficult for Western counterintelligence agencies or investigative journalists to identify them. To further conceal their identities, both Belarusians were even brought into Center 795 through civilian positions at the Kalashnikov Concern (but, as we can see, this did not help them).
One of the most important themes of The Insider’s investigation was the case of Denis Alimov, who was detained in February 2026 in Colombia, where he had flown from Turkey under the guise of an ordinary tourist. At Center 795, he was in charge of the so-called “Chechen Direction”, which oversaw operations targeting political opponents of Putin’s regime living in Europe [6]. To carry out the operation, Denis Alimov allegedly recruited Serbian national Darko Durovic, who was living in the United States. For each person successfully “deported”, the operatives were promised up to $1.5 million. The main targets of the operation were members of the family of Ahmed Zakayev, a former close associate of President of Chechnya Dzhokhar Dudaev, who resides in the United Kingdom [7]. However, the Russians’ criminal scheme failed. The arrest of Denis Alimov was the result of a joint operation by US intelligence agencies and Interpol. He has been charged with conspiracy to commit murder and supporting terrorism, for which the Russian officer faces life imprisonment. According to The Insider, Center 795 may also have been involved in other sabotage operations and attacks outside Russia, which are still under investigation. The very exposure of this unit’s structure and the arrest of one of its officers represent a serious failure for Russian intelligence services and indicate that the West, so to speak, is keeping a close watch.
In late April 2026, the Prosecutor’s Office of Lithuania announced that charges had been filed against 13 individuals suspected of attempting to carry out two terrorist-related murders on the country’s territory. These were failed assassination attempts on the life of Ruslan Gabbasov, the leader of the Bashkir national movement who resides in Lithuania, and Valdas Bartkevičius, a public figure who raises funds for Ukraine. Nine suspects have been detained, while European arrest warrants have been issued for four others, and an active manhunt is underway. Among the suspects is one Lithuanian, as well as individuals from Ukraine, Russia, Belarus, Georgia, Latvia, Moldova, and Greece. In Vilnius, there was no doubt as to who was behind these intentions. The Prosecutor General’s Office of Lithuania stated: “Recently, we have been dealing with a series of hybrid crimes that are effectively directed against European Union countries, against their national security interests, and against individuals who support Ukraine in one way or another.” It is highly likely that Center 795 was also involved in these actions.
The State, the Military-Industrial Complex, and Business: Patronage Networks in the Russian Energy System
Many Western analytical studies highlight the importance of ties between the state, the defense sector, and business elites. This phenomenon is sometimes described as a patronage system, within which entrepreneurs linked to strategic sectors serve as the financial and organizational backbone for state projects. In this context, analysts often point to the existence of extensive networks of connections between the state, the military-industrial complex, and individual entrepreneurs who, thanks to close ties with the political elite, gain access to government contracts, strategic infrastructure, and projects critical to national security. In turn, they provide financial, logistical, and organizational support for state projects, including foreign intelligence operations.
For instance, the aforementioned billionaire Andrei Bokarev, according to investigative journalists, played a significant role in the network of institutional and financial ties linked to the creation of new operational structures within the Russian security apparatus. He is one of the most influential figures in the Russian defense-industrial complex and has been linked for many years to a number of companies that cooperate with the Ministry of Defense of the RF. He belongs to a group of entrepreneurs who, over the past two decades, have established close ties with the Russian state apparatus, particularly with the defense-industrial complex and law enforcement agencies. He himself has for many years been associated with companies operating in key sectors of the Russian defense industry, including companies that manufacture railway equipment, weapons, and military components.
The Kremlin-linked oligarch brothers Arkady and Boris Rotenberg play a similar role in Russia’s network of economic patronage. They have been among Vladimir Putin’s closest associates since his time in St. Petersburg. For many years, companies linked to the Rotenbergs have carried out infrastructure projects of strategic importance to the Russian state. One of the most striking examples was the construction of the Kerch Bridge [8]. Another figure frequently mentioned in the context of the Russian economic elite is a member of Vladimir Putin’s inner circle – Gennady Timchenko, an entrepreneur involved in the energy sector and commodity trading. For many years, Timchenko was a co-owner of Gunvor, one of the largest oil trading companies in the world.
An analysis of the state of the Russian economy shows that the energy sector plays a significant role in the system of ties between the state and the business elite. Revenues from energy exports are one of the main pillars of the Russian economy, and companies operating in this sector often maintain close ties with the state apparatus.
These examples demonstrate that the Russian economic elite operates within a network of connections in which business activities are closely intertwined with state interests. Experts often refer to this system as a patronage model of state capitalism, in which loyalty to the political authorities is one of the key conditions for the functioning of enterprises. In this model, entrepreneurs linked to the strategic sector can play various roles: as financial sponsors of state projects, operators of logistics infrastructure, partners in economic projects related to foreign policy, and in some cases, organizers of paramilitary structures.
Thus, it can be concluded that Russian operations abroad are not exclusively the domain of the intelligence services or the armed forces. In many cases, they are part of a broader system of ties between the state, the military-industrial complex, and the business elite. Consequently, Russian foreign operations can be interpreted as part of an integrated architecture of power, in which the security apparatus, strategic enterprises, and the associated business elite form an interconnected system to advance state interests. For the states of the Euro-Atlantic community and their intelligence services, this means the need to analyze the described phenomena not only in terms of individual incidents, but also as elements of the RF’s long-term state strategy.
Volodymyr Palyyoda,
expert in international relations
Collage https://theins.ru/inv/290209
Notes:
[1] For more details, see: Center 795: The Insider exposes a new top-secret intelligence unit linked to political assassinations abroad // https://theins.ru/inv/290209
[2] Military Unit 29155 – the 161st Specialist Training Center, one of the units of the Main Directorate of the General Staff of the Armed Forces of the RF. The Center is stationed in Moscow. According to Western intelligence agencies, its mission is to destabilize the situation in Europe.
[3] Under the April 3, 1995, law “On the Federal Security Service”, the FSB was granted the right to conduct intelligence activities. At the same time, its jurisdiction was effectively limited to the territory of post-Soviet states, which the Russian Federation considers its unconditional sphere of influence.
[4] Chairman of the Russian State Duma’s Defense Committee Andrei Kartapolov has pointed out that a “similar” law was adopted in the United States in 2002. According to the MP, the introduction of such provisions into legislation will help prevent situations similar to the arrest in Poland of Hermitage employee Aleksandr Butyagin. However, the adoption of this initiative does not imply the automatic use of military force – after all, the very existence of such powers can influence the behavior of foreign states.
[5] General Colonel Sergei Chemezov is part of Vladimir Putin’s inner circle. In the 1980s, they served together in the Office of the USSR KGB Commissioner for Coordination and Liaison with the Ministry of State Security of the GDR, lived in the same building in Dresden, and became friends.
[6] The number of Chechen political exiles living in Europe and the United States varies depending on the source and estimate. In Europe, the total number of Chechens is estimated at nearly 110,000. In North America (including the United States), this figure is significantly lower – nearly 1,500 people. These figures reflect the total size of the Chechen diaspora, which grew significantly as a result of the First and Second Chechen Wars, leading to tens of thousands of refugees settling in Europe and other regions.
[7] Akhmed Zakayev was granted political asylum in the United Kingdom in 2003. According to media reports, he has been in Ukraine since 2022, where he supports the Ukrainian resistance against Russian invaders alongside Chechen volunteers.
[8] Russia officially refers to this transport crossing as the “Crimean Bridge”, but in the Ukrainian context, as well as for precise geographical identification, the name “Kerch Bridge” is more accurate.
[9] The US government’s official “Rewards for Justice” website has posted a notice seeking five officers from Military Unit 29155 on suspicion of conducting malicious cyber activities against critical US infrastructure. Besides, on the eve of Russia’s full-scale invasion of Ukraine, they launched the “WhisperGate” malware during a series of cyberattacks on Ukrainian government agencies and private-sector organizations. The government of the USA is offering a reward of up to $10 million for information leading to the location of these hackers.
