As Russia continues a long-running campaign of irregular warfare against the United States and its European allies, it has increasingly turned to criminal elements to carry out kinetic sabotage operations and attacks on people. Thus far, the U.S. government has failed to adequately counter this tactic, which Moscow uses as part of a broader strategy to impose costs on its adversaries and shape policymakers’ strategic perceptions while staying below the threshold of armed conflict. While significant attention has been paid to other gray zone tactics, including cyberattacks and electronic warfare, the evolving nature of this kinetic sabotage campaign requires closer examination.
The U.S. Department of Defense should increase its focus on gray zone operations as a critical theater of great-power competition. It should be the policy of the DOD and other U.S. government departments and agencies to recognize as an active and urgent threat Russia’s use of criminal networks and lone wolf criminal actors to commit acts of kinetic sabotage. From Russia’s perspective, there are several strategic advantages to aggressive gray zone warfare, to which Moscow is utilizing a “whole-of-government” approach to re-shape the European security landscape in its strategic interests. If Russia is permitted to sustain its gray zone campaign in Europe undeterred, its security apparatus will be emboldened to carry out increasingly aggressive and destructive acts that counter U.S. national security interests and risk escalation into open conflict.
Current U.S. policies are insufficient in deterring Russian gray zone warfare and the Russian crime-conflict nexus, which has emerged as a security threat as the Russian state increases collaboration with various criminal actors. While the national security strategies during President Donald Trump’s first term and under President Joe Biden addressed hybrid threats from Russia, they focused primarily on cybersecurity and information warfare. Kinetic operations, such as bombings, arsons, or killings, which are more likely to lead to escalation, were not adequately addressed. While the second Trump administration’s formal National Security Strategy document has yet to be finalized, a recent draft proposes a strategic shift away from deterring Russia and China toward countering Latin American criminal networks in the Western Hemisphere. The allocation of a significant amount of resources to this theater would likely result in a reduction of those aimed at monitoring and deterring Russian hybrid threats. Continuing to shift focus away from Russia focus would undermine the confidence of traditional European allies, further embolden Russia, and increase the likelihood of a confrontation involving NATO.
Russia’s Gray Zone Tactics
After the fall of the Soviet Union, Russia pivoted aggressively toward “gray zone tactics” or “hybrid warfare,” which it rates as a level of conflict below direct warfare. The economic strategic, and diplomatic cost of prosecuting this strategy is lower for both Russia and its targets while falling short of traditional markers of war, making direct proportional retaliation difficult to justify. Gray zone tactics allow Russia to degrade an opponent’s materiel capabilities and sow discord within or intimidate an opposing population, making Russia’s strategic goals easier to achieve. These tactics work best when they are difficult to attribute to the Russian state.
As tensions between the West and Russia have escalated, so have Russian hybrid warfare efforts including espionage, election interference, information warfare, and cyberattacks. Kinetic actions have resulted in physical sabotage or even injury and death, including cutting energy and communications cables on the sea floor, arson, and even assassination. In some cases, authorities suspect Russian intelligence hired local criminals to carry out operations. After all, these actors are relatively inexpensive compared with trained operatives, and they provide a high level of plausible deniability.
The Possibility of Escalation
Russian gray zone operations intended to cause physical damage, especially injury or death to people, increase the risk of escalating tensions into open hostility. As such, it is in the national security interest of the United States and other Western nations to actively counteract and effectively deter Russia’s gray zone tactics, especially kinetic actions.
However, when it comes to attribution or prevention, not all Russian hybrid warfare actions are equal. While some can be predicted, such as election interference and information warfare in the run-up to a presidential election, the timing, targets, and methods of others are less certain.
While kinetic actions of this nature were rare prior to Russia’s invasion of Ukraine in 2022, they have since increased markedly, targeting not only Ukraine but also European members of NATO. Crucially, Russia has relied on local criminals to carry them out, for the most part. These low-level actors are rarely connected with Russia or organized crime before being approached to carry out an attack, which makes them especially difficult to counter as they generally are not monitored by law enforcement. Using these actors is less expensive than dispatching highly trained operatives or using sophisticated methods of attack. In addition, in Russia’s eyes, these actors are considered more expendable. Large pools of potential recruits already reside in countries of interest, further reducing costs and increasing the volume of operations that can be conducted.
On the other hand, unaffiliated criminal actors are more difficult to modulate. This may result in less-effective operations, including a greater likelihood of the actor being caught or stopped, not to mention a lesser responsiveness to Russia’s strategic goals. Rather than not be effective enough, it is conceivable that an operation carried out by one of these actors could be too escalatory, for example, killing people in an untargeted way, thus increasing the risk of a result that causes direct confrontation with Russia.
Proxy Actors: Petty Criminals and Hate Groups
Suspected Russian-backed operations in Europe have employed a variety of criminal proxies, including “patriotic hackers” and Russian-based organized crime groups. Increasingly, however, groups and individuals not traditionally affiliated with Russia have been utilized. A patchwork of actors, including hate groups, football hooligans, and small-time petty criminals have been employed for a variety of attacks. These attacks vary widely not only in the proxy used, but also in their targets. In March 2024, local criminals in London were convicted of an arson attack on a warehouse storing aid for Ukraine. U.K. investigators have since stated Russian intelligence ordered the attack. That June, a Ukrainian-Russian national was jailed after a failed plot to bomb a hardware store outside Paris. Five months later, Russian-employed saboteurs were arrested after smuggling incendiary devices into cargo planes ahead of planned flights from Europe to the U.S. and Canada, presumably as a test of cargo flight security for future attacks. Through 2025, at least a dozen attacks have been attributed to Ukrainian petty criminals who were commissioned over Telegram to deliver bomb packages they believed were harmless, including one that killed the carrier and wounded eight Ukrainian soldiers. In November 2025, two Ukrainian men who authorities said were working with Russian intelligence blew up a Polish rail line key to delivering supplies to Ukraine.
Targeted assassinations or assassination attempts have also been conducted. Most notably, Ivan Voronych, a senior officer in the Security Service of Ukraine (SBU), was assassinated in Kyiv in July 2025. The U.S.-based hate group The Base took credit for the assassination. The Base has expressed pro-Russian sentiments, and the group’s founder Rinoldo Nizzaro has been suspected by his own group members of being a Russian asset. Notably, the Base is considered a terrorist organization by the European Union, demonstrating Russia’s increasing nexus with both explicitly violent organizations as well as organized crime. The next month, former Parliamentarian Andriy Parubiy, a prominent Ukrainian nationalist and participant in the 2004 Orange Revolution and 2013-2014 EuroMaidan Revolution, was killed by eight gunshots from an assailant dressed as a deliveryman in Lviv. Following the arrest of Parubiy’s alleged assassin, Ukrainian officials are investigating suspected Russian orchestration of the killing, issuing a statement saying that the assassination had the hallmarks of a “contract killing.”
While these proxy attacks appear to be opportunistic and have been difficult to predict or intercept, a handful of trends have emerged. Russian intelligence handlers appear to consistently use Telegram or other messaging and social media apps to contact and recruit criminal proxies. Thus, Russian personnel can safely orchestrate operations from within Russia, reducing the potential cost of carrying them out. For example, a man who surveilled a U.S. military base in Germany held pro-Russian sentiments, as did the attempted bomber in France. According to leaked Russian communications, its intelligence agencies made efforts to identify pro-Russian social media pages of workers at major German plants.
Individuals who are not sympathetic to Russia but who are financially desperate have also been targeted. According to the SBU, of the 700 vulnerable people in Ukraine arrested on suspicion of sabotage in 2025, the majority were unemployed or addicted to drugs. Oftentimes Russian handlers will not disclose their nationalities to avoid putting off potential recruits. Ukrainian criminals reported being approached by Russian operatives who claimed to be working for Ukrainian intelligence, and one would-be Ukrainian suicide bomber believed he was working for an anti-war Ukrainian civilian.
The Russian Calculus and Its Dangers
In Moscow’s effort to bend the European security landscape towards it strategic interests, Russia views gray zone tactics as an extension of its conventional war in Ukraine. Comparatively, the current U.S. approach to furthering its security interests in Ukraine and the rest of Europe is fragmented. Until recently, the Trump administration has been reluctant to impose its own threats of aggressive new sanctions against Russia for fear of detriment to its own diplomatic objectives, despite the Kremlin continuing to escalate its war against Ukraine and gray zone operations across Europe unabated while pushing for favorable strategic terms at the negotiating table.
The sustainable, low-cost nature of using criminal proxies presents a significant advantage from the Russian perspective. Plausible deniability also allows Russia to favorably alter adversarial objectives and strategic perceptions at a low cost to its diplomatic objectives, such as negotiating an end to the war in Ukraine that favors Russian strategic interests.
Based on the lack of a strong Western policy response, Russian security officials likely perceive that they can escalate their gray zone attacks to impose greater costs against their adversaries, including NATO member states, without significant risk. In future conflict scenarios, Russia could utilize these tactics to influence the decision making of U.S. allies, especially in an era when the confidence of traditional allies in U.S. support is at a historic low.
With the Trump administration’s uncertain commitment to European security, the Kremlin will be increasingly emboldened to act aggressively toward the West. Russia views gray zone warfare as an integral part of its efforts to shape the future of Europe’s security landscape and influence adversarial strategic perceptions and choices. It is escalating a campaign of targeted assassinations and sabotage to support these efforts amid a time of insecurity for its European adversaries. Ukraine and other European allies have voiced concern over the increase in kinetic gray zone operations, fearing the difficulty of preventing these attacks and the possibility of significant damage to infrastructure and harm to people. This concern may prove to be warranted, so long as Russia feels emboldened to sustain its irregular warfare campaign against the U.S. and its European allies undeterred.
Policy Recommendations
The U.S. government should recognize Russia’s gray zone threats as a priority in its national strategy documents. Because deterring and countering Russia in the gray zone will require coordinated and sustained interagency effort, the National Security Council should ensure that the National Security Strategy adequately recognizes and frames Russia’s gray zone activities as an irregular warfare campaign being waged against the United States and its allies. Additionally, the Office of the Assistant Secretary of Defense for Special Operations and Low-Intensity Conflict should ensure that future revisions of the original 2020 Irregular Warfare Annex within the National Defense Strategy adequately address threats from Russia’s irregular warfare campaign, with operational and force planning input from the U.S. Special Operations Command, the Joint Staff J5, the service branches, and other relevant entities within DOD.
Funding priorities should recognize and reflect the threat. The Office of the Director of National Intelligence (ODNI) should review National Intelligence Program (NIP) funding priorities to assess whether current programmatic planning and resources are adequately allocated to intelligence collection on Russian gray zone activities. The ODNI should ensure that out-year NIP planning accounts for the seriousness of this strategic threat to the United States. When doing so will not harm ongoing U.S. and allied intelligence efforts, the U.S. government should publicize the attribution of Russian gray zone attacks to increase the diplomatic and political cost of those actions. The FBI’s counterintelligence division and the Department of State’s Bureau of International Narcotics and Law Enforcement Affairs should, where applicable, mirror these efforts.
The United States and its European allies should increasingly unify efforts to impose costs on Russia by jointly expanding the utilization of frozen Russian assets to aid Ukraine and frame this policy choice as nonkinetic retaliation against Russia for conducting gray zone attacks along with its conventional aggression in Ukraine. Furthermore, the U.S. and its European allies should shape Russian perceptions and impact strategic thinking by attributing future sanctions, secondary tariffs, intelligence-sharing agreements and aid packages to Ukraine as responses to gray zone attacks along with failure to negotiate in good faith over a peace agreement. While there has been some movement in this direction, there is no shortage of U.S. actions and statements that have degraded these efforts.
The United States should organize a gray zone/irregular warfare-focused entity modeled on the National Counterterrorism Center. The U.S. has vast human capital in terms of counterterrorism subject matter expertise from former and current intelligence, military, and law enforcement officials to support allied efforts to strengthen infrastructure and tactics, techniques, and procedures to counter domestic counter gray zone threats. The deterrence factor of gray zone warfare is an inherent element of great-power competition. There is crossover with counterterrorism efforts to consider when it comes to disrupting state-orchestrated plots of kinetic sabotage and recruitment of lone wolf perpetrators.
The views expressed in this article are those of the author and not an official policy or position of New Lines Institute.
