![\"\"](\"https:\/\/igp.org.ua\/wp-content\/uploads\/2025\/04\/altart5.png\")
<\/a>According to numerous sources, since 2022 Russia has been intensively conducting the so-called \u201cshadow war\u201d. This includes, among other things, mysterious fires at defense plants and military warehouses, sabotage of infrastructure by cutting underwater cables and pipelines, attacks on railway lines, and arson and explosions in industrial areas, often related to supplies for Ukraine.<\/p>\nAccording to the Center for Strategic and International Studies [1], the number of such attacks in Europe nearly tripled between 2023 and 2024, coinciding with the intensification of the Russia-Ukraine war. Many of those actions are attributed to Russian military intelligence (known as GRU), which carries out the Kremlin\u2019s orders as part of a large-scale \u201cshadow war\u201d: disguised operations of subversive and sabotage nature.<\/p>\n
It is noteworthy that in the context of mass expulsions of Russian \u201cdiplomats\u201d and numerous failures of well-known groups (such as the infamous military unit 29155 [2]), the GRU is increasingly turning to \u201coutsourcing\u201d. It recruits local criminals and people from marginalized strata of society, which, according to the US and European intelligence services, constitutes \u201ccheap labor force\u201d that can be easily discarded in case of failure. As a consequence, it is also more difficult to prove direct links between those people and Russia.<\/p>\n
Criminals \u0430s an Effective \u0430nd Cheap Proxy Agentura<\/h2>\n
The report also shows that such people are often happy with small amounts of money (a few hundreds of euros) or rewards in cryptocurrency, which keeps the costs of their activities relatively low. The authors of the report also point out that in case of arrest, the GRU may distance itself from them, and the criminals themselves not always can identify their customers. Therefore, it is more difficult to prove their links to Russian intelligence. In addition, it is noted that criminals usually have contacts that provide access to weapons, false documents or the black market.<\/p>\n As reported by the Financial Times in May 2024, important intelligence residencies in Western countries have been exsanguinated after a large wave of deportations of Russian \u201cdiplomats\u201d. The Kremlin then chose the tactic of \u201cfield recruitment\u201d \u2013 recruiting people motivated first of all by money or ideology (extreme right-wing or left-wing) who are not officially affiliated with Russia.<\/p>\n In mid-January, investigative journalist Hristo Grozev reported that the GRU had created a kind of \u201cuniversity\u201d in Moscow and St. Petersburg to train potential saboteurs. In an interview with the YouTube channel \u201cKotrikadze Dzyadko\u201d, he explained that the GRU unit responsible for sabotage activities in the West has completely changed its working methods.<\/p>\n The reasons are both meticulous journalistic investigations, which revealed the identities of many spies, and the war in Ukraine itself. Since GRU officers cannot travel freely around the world on diplomatic passports, the agency has focused on recruiting and training foreigners, often with criminal records.<\/p>\n Grozev added that some of these \u201cstudents\u201d are from the occupied territories of Ukraine, but citizens of Latin America and Afghanistan are also involved. The training is led by prominent GRU officers, including Anatoly Chepiga and Aleksandr Mishkin, who were involved in the poisoning of Sergei Skripal in Salisbury in 2018.<\/p>\n Among the detained in the case is Aleksandr Bezrukavyi, a Russian citizen with multiple convictions for weapons offenses and ties to the criminal world. He was to serve as a coordinator between the GRU and the perpetrators in Poland, Bosnia and Herzegovina, and Lithuania. It was established that Bezrukavyi and other recruits received instructions from Russia via encrypted messengers, and their remuneration was most often paid in cryptocurrency.<\/p>\n According to the \u201cDossier\u201d Center [5], Bezrukavyi was convicted in 2002 of illegal possession of weapons in Russia. In 2011, he was responsible for robbery as part of an organized criminal group, but the case was closed due to reconciliation of the parties. The data also shows that he is listed in Russian drug and robbery databases. In 2021, he was placed on a federal wanted list, but was later lifted.<\/p>\n In early 2024, Bezrukavyi left Russia for Europe. His case is an exemplary example of the profile of a person recruited by Russian intelligence.<\/p>\n According to estimates by the Ukrainian Security Service and the US State Department\u2019s 2023 report on International Religious Freedom in Ukraine, the Russian Orthodox Church (through its branch, the so-called Ukrainian Orthodox Church of the Moscow Patriarchate [UOC MP]) cooperates with the Russian military. Ukrainian media cite numerous examples of Orthodox clergymen passing information on Ukrainian Army movements and even compiling \u201cpro-scripture lists\u201d [6] on pro-Ukrainian activists.<\/p>\n In the occupied territories, clergymen of the independent Orthodox Church of Ukraine are being replaced by clergymen of the Russian Orthodox Church, who spread the narrative of \u201csatanism of the West\u201d and the \u201chistorical unity of Russians and Ukrainians\u201d. This is intended to legitimize the occupation by portraying Russian aggression as a defense of Christian values and historical commonality with Ukraine.<\/p>\n Among the examples mentioned there are:<\/p>\n According to the counterintelligence\u2019s estimates, ROC parishes are a \u201csecurity zone\u201d for Russian officers and diplomats. Under the guise of religious activities, it is possible to conduct confidential conversations, exchange information, and recruit local collaborators, making it much more difficult to detect and respond to such operations.<\/p>\n For example, the FSB-controlled criminal organizations \u201cSolntsevo\u201d and \u201cIzmailovo\u201d have been maintaining close relations with the Russian Orthodox Church from the very beginning of their activities. Their leaders, such as Sergei Mikhailov (\u201cMikhas\u201d) and Dmitry Pavlov (\u201cPavlik\u201d), finance the construction of churches and participate in ROC charitable programs. Mikhailov was personally honored by then-Patriarch Aleksiy II with numerous ROC insignia.<\/p>\n Subversive actions committed by criminals divert the attention of intelligence services from other, more serious intelligence tasks. Attacks on infrastructure (defense plants, railways) can slow down the aid to Ukraine, causing fear and panic, which undermines the stability of Western countries.<\/p>\n For their part, dynamic Russian Orthodox parishes in European countries justify the \u201choly war\u201d and promote a pro-Russian narrative. Some of them also serve as intelligence channels, collecting information on local infrastructure and public moods. As centers of religious worship, they are a convenient cover for contacts with Russian intelligence.<\/p>\n<\/a>The GRU needs an extensive network of people capable of performing specific tasks: from seemingly simple ones, such as photographing military bases, to more complex ones (e.g., planting explosives in marshaling yards or hacking attacks). The ideal perpetrators turn out to be criminals or people in difficult situations. According to the \u201cDossier\u201d Center report entitled \u201cSabotage from a Safe Distance\u201d (2024), recruiting such people minimizes the risk to the GRU itself. People with criminal backgrounds are more likely to agree to risky, illegal tasks, so recruitment is not a serious problem for the GRU.<\/p>\nSimple \u0430nd Effective Recruitment Methods<\/h2>\n
<\/a>Materials from the \u201cOrganized Crime and Corruption Reporting Project\u201d(OCCRP) [3] and The Grayzone website [4] show that GRU recruiters post ads on social networks (especially Telegram) like: \u201cIf you are in Germany\/Poland\/Baltics and want to help fight the Nazis, write…\u201d. Candidates are initially screened by a chatbot and then given test tasks (like taking pictures of military objects). If they can handle that, they are then offered more challenging assignments: arson, sending packages with incendiary charges, or subversive activity against critical infrastructure.<\/p>\nPackages with Incendiary Charges at DHL<\/h2>\n
<\/a>In the summer of 2024, the interception of packages at DHL warehouses in the UK (Birmingham), Germany (Leipzig) and Poland (near Warsaw) became publicized. According to Reuters and The Wall Street Journal, the parcels, which were listed as massagers or sex toys, contained hidden incendiary devices. The aim was to check for possible fires in cargo planes that were flying to the USA or Canada.<\/p>\nThe Russian Orthodox Church Is an Instrument of Intelligence and Propaganda<\/h2>\n
<\/a>The relationship between the ROC and the state dates back to tsarist times, when the church was subordinate to the tsar. After Vladimir Putin came to power, the ROC regained its status as the \u201cstate church\u201d, and Patriarch Kirill, a former KGB agent with the codename \u201cMikhailov\u201d, is considered one of the Kremlin\u2019s most important allies. In March 2024, a document from the World Russian People\u2019s Council called the invasion of Ukraine a \u201choly war\u201d. The ideology of the \u201cRussian world\u201d closely matches the Kremlin\u2019s propaganda line, which presents military aggression as a struggle in the name of Christian values.<\/p>\nA Spy Network in Europe<\/h2>\n
<\/a>As OSINT company \u201cMolfar\u201d states in its report \u201cThe Russian Orthodox Church as a Spy Network in Europe\u201d, that numerous ROC churches are built near critical infrastructure such as military bases, ports, pipelines or embassy buildings. In Sweden, Norway, Finland and the Czech Republic, ROC clergymen maintain contacts with Russian diplomats and companies such as Rosatom and Gazprom, which can serve for collecting intelligence.<\/p>\n\n
The Synergy \u201cCriminals + Church\u201d As a Pillar of Hybrid Warfare<\/h2>\n
<\/a>At first glance, it would seem that the bandits recruited by the GRU and the clergy of the Russian Orthodox Church have nothing in common. In reality, however, both elements serve the Kremlin to increase chaos and help disguise its operations. It is worth emphasizing that Russia\u2019s leading criminal authorities (especially ethnic Russians) often demonstrate their commitment to the ROC.<\/p>\nWill the West Manage to Stop the Recruitment of Criminals?<\/h2>\n