Tracing the Criminality of Russian Gray Zone Warfare
As its war in Ukraine remains in a protracted stalemate that has sapped Russian resources and hobbled its economy, the Kremlin has increased its use of irregular gray zone tactics – including sabotage, subversion, and coercion – to try to undermine EU support for Ukraine. The key characteristics of Russian gray zone tactics are cheap and deniable actions that are difficult to defend from a traditional military viewpoint, posing a severe threat to European security, global U.S. military installations, and NATO defense capacity. While the escalation of gray zone attacks in Europe since the start of the Ukraine war has been a point of focus for analysis, Russia has considerable global influence – in the Sahel, Sudan, Venezuela, Colombia, and elsewhere – and could use such tactics in those locations, threatening U.S. interests more directly.
In the United States, there has been a bipartisan push for successors of the private military company Wagner Group to be labeled as terrorist networks rather than organized crime networks. In February 2026, lawmakers introduced the Holding Accountable Russian Mercenaries (HARM) Act 2.0. Meanwhile, the U.N. Special Rapporteur’s model definition limits terrorism to serious, publicized, ideologically motivated crimes that intentionally cause death, serious bodily injury, or hostage-taking to incite terror. The U.N. further advocates to differentiate political violence from organized crime for profit as a way of protecting human rights.
While designating Wagner successor groups as terrorist organizations enables broader prosecutorial powers, the organized crime label is more accurate to their manner of operating and the political context from which they developed. Therefore, the U.S. House should adopt the HARM Act 2.0 recognizing Wagner successor groups as terrorist elements but add nuance to prosecution and security postures by recognizing that these attacks are coordinated like organized crime. It should also go further and recognize these patterns and target responsible individuals at every level with sanctions and criminal charges when possible.
Russia’s Motivations
Escalating gray zone attacks in Europe are a central part of Wagner Group’s legacy, and the current organized crime designation suits the group, its successors, and its tactics more accurately than a terrorist designation. Additionally, the options available to combat attacks also point toward a transnational criminal organization designation, as calls to publicly recognize Russian gray zone attacks as a systemic campaign do not align with typical highly publicized terrorist acts.
As Russia enters its fifth year of war with Ukraine, President Vladimir Putin’s desperation is becoming more evident as he faces a faltering economy and an overheated military production dynamic that has created severe domestic labor shortages, high inflation, and structural exhaustion within the military-industrial complex. Russia’s true financial state is kept hidden from international viewers through manipulation of economic data and hiding war debts, but analysts describe a bleak financial state that is increasingly dependent on China for support.
Putin has staked his political legitimacy on winning his war in Ukraine, justifying the excursion with promises to restore Russian greatness. Therefore, Putin cannot acknowledge a defeat without risking political backlash. Russian grand strategy for its war with Ukraine has failed to achieve several objectives: political subjugation of Ukraine, economic sustainability, regime stability, and international standing. Only territorial control remains. While the Russian military contends with a shortage of troops and equipment, at home, there has been an increase in violent crime attributed to returning soldiers traumatized by the frontlines, many of them former Wagner Group fighters. Mounting pressures make it difficult for Russians to continue to dismiss the war as a special military operation. In response, the Kremlin will increasingly utilize gray zone activities to achieve Russian objectives.
The Tactics
Gray zone attacks include sabotage of defense infrastructure, subversion of political disinformation, and coercion through systematic military incursions and demonstrations. Russia’s full-scale war with Ukraine since 2022 has now gone on for longer than direct U.S involvement in World War II, mutating the war and European support for Ukraine into a test of wills. This is what gray zone tactics aim to break down.
Sabotage could target Europe’s expanding defense production infrastructure as well as critical supply chains, impacting physical aid for Ukraine. Ammunition factories, infrastructure, and Ukrainian-owned businesses are all prime targets. Poland and Lithuania in particular have seen an unprecedented rise of attacks, such as an arson attack on a Vilnius shopping center in 2024. Civil society subversion in the form of information warfare and disinformation could surge around key European elections. Despite former Hungarian Prime Minister Victor Orbán’s loss at the polls, political disinformation was rampant in the run-up to Hungary’s April 2026 parliamentary elections, amplifying rhetoric based on a binary of peace versus war.
Attempts by Russia to coerce and intimidate via military incursions and demonstrations of strength have escalated from irregular to systematic. These include naval and air violations, nuclear deterrent rhetoric, and displays of force. Examples include the Gulf of Finland incident in September 2025, when three MiG-31 Russian fighter jets violated Estonian airspace for 12 minutes. Further, Russian attack submarines violated U.K. territorial waters in December 2025 and April of this year. This tactic aims to conflate continued support for Ukraine with danger for European homelands. If not deterred, these actions could undermine civilian trust in NATO’s defense capabilities and damage popular support for Ukraine while remaining below the threshold of conventional military confrontations.
Tracing Gray Zone Tactics to Wagner Methods
The Wagner Group’s primary benefits for Russia were its alleged self-sufficiency and separation from Russian state apparatus, posing a unique threat to Western interests in Africa and the Middle East. The Group offered a “package” of services: a combination of cyberattacks, political disinformation, violent combat operations, opposition suppression, and security training for local forces. This package embedded Russian interests in theater at limited economic expense for Russia.
The Wagner Group – and later Russia’s Foreign Intelligence Service, the SVR, which conducts intelligence and espionage activities outside of the Russian federation – has enabled Russia to dominate narratives in Africa. Pro-Russian propaganda includes statues commemorating Wagner fighters, paid-off local journalists writing pro-Russian articles, propaganda movies about Wagner fighters, and generalized propaganda via billboards and cultural exports. Russia did enjoy strong support in Mali, Burkina Faso, the Central African Republic, and Niger. However, as atrocities mount and insurgents gain ground, African support for Russia has faded. For example, Russian influence in Africa impacted U.S. security missions, hastening a troop withdrawal from Niger due to the arrival of Russian mercenary forces, thus undermining the U.S. and NATO counterterrorism mission in the Sahel.
After the fall of the Wagner Group in 2023 following its ill-fated coup attempt targeting the Kremlin, Russia’s foreign military intelligence agency, the GRU, absorbed military functions, while the SVR took over Wagner’s political and information warfare apparatus. While the Wagner Group has been marginalized and currently only operates in the Central African Republic as bodyguards for President Faustin-Archange Toudéra, its legend, mythos, and symbols continue to be utilized beyond the official group. Wagner Group’s legacy of personnel networks, combat experience, and influence structures remain embedded in Russia’s wider security ecosystem. Stanisław Sadkiewicz, author of a recent book covering “post-Wagner” architectures, argues that the legend of the group remains alive in both Russian society and the military. Volunteer units within the military refer to Wagner Group traditions and are often commanded by former Wagner fighters.
Echoes of these services linger in Russia’s gray zone warfare tactics. For gray zone actors to achieve plausible deniability, a dynamic has emerged of hiring local criminals in a “gig” model to carry out various attacks. This saves cost, provides deniability, and is difficult to deter. Arson attacks by low-level drug dealers, access and information trading, minor military incursions into territory, and swarms of social media bots make up a varied picture but indicate a systematic structure of Russian interference.
Western officials reported in February 2026 that recruiters and propagandists previously working for the Wagner Group emerged as the main conduit for state-backed sabotage attacks in Europe. Although earlier diplomatic expulsions reduced the number of European-based Russian covert agents, by using disposable proxies, the Russian state can weaken support for Ukraine and propagate societal divisions. Using proxies also provided a degree of deniability between these petty criminals and Russian intelligence agencies like the GRU and SVR. The Wagner Group had a similar relationship with the GRU in its time, always cloaked in layers of deniability, but using the same passport office.
Wagner’s Criminal Structure
Many analysts have argued that Russia’s regime is structured like a criminal enterprise, facilitating its irregular approach to pursuing foreign policy goals. Russia’s political-economic governance structure has been compared to a feudal hierarchy, with lines blurred between public and private. With economic benefits strongly tied to political favor under Putin, there is a pattern of Russian oligarchs and organized criminal groups representing or furthering Russian state interests, not purely their own commercial ones.
These siloviki, or “men of force,” are oligarchs who owe their wealth and power to Putin and are more subordinate to the state, including not only the founder and public-facing leader of the Wagner Group, Yevgeny Prigozhin, but men like Putin’s de facto deputy and Rosneft CEO Igor Sechin, who have facilitated closer ties with China and Venezuela with Russian-built civilian nuclear projects.
Analysts have argued that Russia pursues a policy of strategic state-sponsored criminality. The Kremlin utilizes sanctions evasion, illicit trade, disinformation campaigns, and cyber warfare to gain influence and destabilize opponents. Roberta Koleva and Atanas Rusev posit that criminality is embedded in Russia’s statecraft through a “militarized-criminal hybrid model.” This model is disguised through legal, market-based, and democratic structures, and is therefore deniable. They point to Russia being culpable for assassinations and targeted violence, cyber operations, weapons smuggling, sanctions evasions, illicit economic networks, disinformation and subversive actions, migration weaponization, money laundering, and use of mercenaries. Mark Galeotti, an expert on Russian politics and organized crime, argues that Russia’s use of illicit tactics shifted from opportunistic to strategic when sanctions and diplomatic isolation following the invasion of Ukraine blurred the boundaries.
The Wagner Group was an extreme example of this symbiotic relationship, constituting a criminal network that served as a mirror image of the way the Russian state operates. Analysis has gone as far as positing that the group’s objectives were to install corruption in target countries operating as an organized crime group sanctioned by the Russian government. Prigozhin, the figurehead of the Wagner Group, operated smoothly through the criminal networks of 1990s St. Petersburg, reportedly opening a business while serving a sentence for robbery. His rise through the ranks to nominal legitimacy was achieved when he became Putin’s “chef” as his catering company Concord was contracted by the Kremlin. Firms associated with Prigozhin were also granted catering contracts with the military and school system. His venture into mercenaryism was a clear symbiosis of miliary operations and business ventures. Wherever Wagner fighters were stationed, resources were extracted and funneled back to Russia. Prigozhin himself amassed a huge fortune from Wagner Group contracts, but in keeping with the feudal system, the Russian government assuredly benefitted. While the Wagner Group emerged as an elite group of specialists, it expanded in Syria to become less selective, entering into financial deals with the regime of former Syrian President Bashar al-Assad to become self-funded, positioning itself at the nexus of military operations and business ventures.
Wagner’s role within both licit and illicit economies, its operations in the military and security space, and links with Russian politics are similar to the way Russian criminal networks evolved, especially those active in Africa. Analysts have argued that when organized crime became more controlled by the state, its makeup shifted from violent enforcers to “criminal businessmen” with a global footprint, embedded in the local economy and politics.
Examples of these previous entrepreneurial individuals operating in Africa include arms trafficker Viktor Bout and cocaine smuggler Konstantin Yaroshenko. However, as state control over organized crime strengthened, Russian organized crime shifted to act as “service providers” to the illicit economy. A prominent example is the case of Russian state-produced arms linked to state arms exporter Rosoboronexport being transported to South Sudan in violation of sanctions regimes, via Kenya and Uganda. When viewed in conjunction with the Kremlin using criminal networks to pursue their own interests, the Wagner Group provides an extreme example of an ostensibly private entity being utilized to further Russian foreign policy.
Another example can be seen in Bulgaria. Despite its sidelining, in February 2026, an active Wagner Group base facility was discovered in the Pernik region. The civic organization Bulgaria United with One Goal reported that the base was heavily guarded, with Wagner insignia and the Russian flag visible on individuals and buildings. Bulgaria, having experienced eight parliamentary elections in the past five years, presented as a ripe, chronically unstable environment on which the group could capitalize. Former Bulgarian President Rumen Radev and his Progressive Bulgaria party recently emerged victorious with a mandate to govern without a coalition. While Radev is known for his pro-Russia views and could halt Bulgarian military and financial support for Ukraine, analysts predict his approach to the EU and Russia will be pragmatic rather than confrontational. With a majority government, his policies are more likely to be approved. This very recent case demonstrates the group’s continued influence and ability to lie low and reemerge at opportune moments. Underlining that, the structure of the Russian government means they continue to find use for the group and its capacity to affect significant harm to resilience in Europe.
Criminality of Gray Zone Attacks
Wagner recruiters now recruit volunteers domestically and internationally for Ukraine and gray zone activities. These recruiters use the Wagner Group’s reputation as part of their pitch. The group is recognized as an elite unit that pays well and enjoys the supposed glamour of violence and legend, and these associations are used to persuade potential volunteers. Despite Prigozhin recruiting criminals from Russian prisons, with half of Wagner fighters being former prisoners at its peak, recent recruits are motivated, as Wagner fighters were, by the money and allure of criminality and violence. An infamous example is the case of petty criminal and U.K. national Dylan Earl, who contacted the Wagner Group and was directed to carry out an arson attack on a London warehouse filled with aid bound for Ukraine. Earl recruited five other men to carry out the attack, and counterterrorism police concluded all six were primarily motivated by money. Communications between Earl and his handlers on Telegram point to ideological motivations, as a handler told Earl he was their “dagger in Europe.” However, the messaging was arguably intended to highlight the glamour of violent activities to coerce a young petty criminal who felt lost in life.
The Financial Times reported in February 2026 that former Wagner Group recruiters were being used by the GRU to enlist “economically vulnerable Europeans” to carry out arson, vandalism, and disinformation inside NATO member states. The article also quotes a source who states that those targeted are recruited online, had no prior links to Russia, were primarily motivated by money, and had the benefit of being completely disposable agents. The structure of the system has also been described as a “gig worker model,” a rapidly deployed, outsourced method of operating that is difficult to predict. Russian recruiters have also targeted individuals with experience in law enforcement or the military, shifting aims from creating complex “sabotage cells” to “closed structures” like those used in organized crime.
Examples of people involved in gray zone activities who use their criminal connections to facilitate action include Davor Savičić, a Bosnian Serb who became a prominent foreign member of the Wagner Group, recruiting Serbs and others to the Russian military. He uses construction companies like Wolf Group LLC as fronts to register fighters as temporary workers, circumventing laws and prosecution against mercenaries. Analysts point to his extensive criminal and security networks as a key link facilitating Russian intelligence and military operations.
Savičić’s case is seen as a leading example of the irregular paramilitary units Russia increasingly relies on. However, the Russian tactic could introduce substantial long-term liabilities at home. What Russia gains in scale and frugality, it loses in competence and secrecy. Recruits are not trained agents, and more attacks are stopped than succeed. These gray zone tactics could backfire by expending resources on incompetent petty criminals for limited gains and appearing to the world as desperate. While costs are comparatively low, Russia is still a nation at war facing growing debt and weakening fiscal discipline.
- The U.S. Congress should adopt the Holding Accountable Russian Mercenaries (HARM) Act 2.0: If passed, the U.S. can expand its deterrence ability through greater law enforcement powers and resources, allowing individuals who aid these organizations in any way to be prosecuted. The act targets successor Wagner Groups actively involved in recruitment, which includes Russian Ministry of Defense-affiliated formations.
- Greater nuance should be added to how the HARM Act frames Russian security postures by recognizing how these attacks are coordinated akin to organized crime: While designating Wagner successor groups as terrorist organizations enables broader prosecutorial powers, an organized crime label more accurately describes their manner of operating and the political context from which they developed. As the Wagner Group (and then its successors) were acting as quasi-state agents and for financial gain, they were not autonomous nonstate actors pursuing their own political agenda. Wagner Group activities and the more recent gray zone attacks are deliberately deniable, and both fighters and criminal recruits were primarily motivated by financial gain.
- A Foreign Terrorist Organization designation for Wagner successors could have significant impacts on foreign relations: As Wagner Group successors are integrated into the Russian state, adoption of the Harm Act could lead to complications in engaging with other governments who have contracted the Wagner Group and its successor Africa Corps. This would be particularly significant in the Sahel, where governments like Mali’s have publicly turned away from French and U.S. security missions in favor of Russian fighters while remaining a key partner in U.S. counterterrorism efforts.
- Consider the wider implications of gray zone tactics: Cheap and deniable warfare is difficult to defend against without a strong and cohesive posture. Attacks by Russian-backed mercenaries on Western infrastructure could undermine U.S. defense resilience, especially at a juncture where the United States’ hegemonic position is receding. The U.S. must take an active stance in facing these evolved threats from a country so closely allied to China.
- Take further efforts to counter Russia: Governments should recognize these systematic linkages, publicize events, bolster infrastructure defenses, and target responsible individuals with sanctions and criminal charges when possible.
- The U.S. should increase international collaboration with NATO partners to implement effective sanctions: A uniform approach based on principles organized around criminal network deterrence conducted via increased NATO engagement will prevent a fractured and weakened response.
The views expressed in this article are those of the author and not an official policy or position of New Lines Institute.
Polish Prime Minister Donald Tusk and Interior Minister Marcin Kierwinski inspect damaged railway tracks on a line connecting Warsaw and Lublin in Poland on Nov. 17, 2025. Polish officials accused two Ukrainians of planting the explosive device that disrupted train travel in a plot directed by Russian intelligence agents. (Photo by KPRM/Anadolu via Getty Images)
