Dr. Gurakuç Kuçi
Senior Researcher at the Institute for Hybrid Warfare Studies “OCTOPUS” and Professor at UNI College
Today, Serbia functions as an active link in Russia’s hybrid infrastructure in Europe. It provides territory, logistics, and state actors for coordinated operations influenced by the Kremlin, including paramilitary training for electoral destabilization, false-flag operations aimed at fomenting interethnic division in the West, and direct surveillance of European Union officials. This role is confirmed by five documented cases: (1) In Moldova, young recruits trained in Serbia and Bosnia took part in attempts to sabotage pro-EU elections and a referendum; (2) In France, under GRU organization, more than 250 Stars of David, a symbol of Israel, were painted in a false-flag operation; (3) Also in France, Serbian nationals were arrested for antisemitic vandalism designed as false-flag acts to blame Muslims; (4) In Brussels, a Serbian trade union representative with ties to the FSB infiltrated EU institutions; and (5) In Kosovo, a Serbian government official was exposed as part of BIA-coordinated wiretapping operations against EU officials.
This document presents evidence that Serbia is not merely a nominal ally of Russia, but an active proxy structure that employs intelligence, organized crime, and propaganda tools to project Kremlin influence into the heart of Europe. Failure to disrupt these networks constitutes a direct threat to transnational security and demands a coordinated strategic response from European institutions and transatlantic partners.
No. | Case | Location | Key Actors | Methods | Objectives | Known Outcome |
| 1 | Sabotage of elections in Moldova | Moldova, Serbia, Bosnia (RS), Russia | Prizenko, Potepkin, Golosokov, Gotko | Paramilitary training, payments via cryptocurrency, special equipment | Destabilization of pro-EU elections, strengthening pro-Russian forces | Arrests, seizure of equipment |
| 2 | Operation of painting the Star of David | France | Anatoliy Prizenko, “Doppelgänger” network | False-flag operation, vandalism with antisemitic symbols | Ethnic/religious division, false blame on Muslims, manipulation of public opinion | EU sanctions against Prizenko |
| 3 | Vandalism of synagogues and Jewish memorials by Serbs | France | 3 Serbian nationals (names not public) | False-flag operation, coordinated vandalism | Ethnic/religious division, false blame on Muslims | Arrests by French police |
| 4 | Wiretapping – briefing published by Politico | Belgium (Brussels) | Novica Antić, Vyacheslav Kalinin | “Gray” agent, infiltration through trade unions | Penetration into EU lobbying structures, pro-Russian propaganda, undermining support for NATO/EU | Meetings with MEPs and NGOs |
| 5 | Published wiretaps of Igor Popović | Kosovo, Brussels | Igor Popović, Bojan Dimić, Kompirović | SIGINT, infiltration of state officials, use of organized crime | Intelligence gathering on the EU, influencing Kosovo–Serbia dialogue | Audio recordings published, no public EU reaction |
1.Infiltration through Serbian and Russian Hybrid Operations in the Moldovan Elections
1.1. Political Context and Russian Objective
In 2024, Moldova held presidential elections in the last months of the year, followed almost immediately by a referendum on European integration. Both processes were crucial for the country’s path toward the European Union. The presidential race featured a pro-Russian candidate, Alexandr Dtoianoglo, and the pro-European incumbent, President Maia Sandu, who was seeking a second term.
Russia’s objective was to see Dtoianoglo and pro-Russian forces take power in Moldova. The strategy to achieve this was to destabilize the electoral process, while simultaneously halting Moldova’s EU integration. To that end, Moscow began implementing infiltration and recruitment methods, targeting young people who, after receiving training, would carry out direct orders from the Kremlin.
In September and October 2024, Moldovan authorities uncovered that young Moldovans, between August and October 2024, had been trained in Russia, Serbia, and Bosnia and Herzegovina (Republika Srpska) to incite unrest during the elections and referendum.
These camps were run by instructors linked to the Wagner Group and The Farm network, with training sessions held in Radenka, Serbia, and in Glamočani, near Banja Luka, in Republika Srpska. Authorities seized equipment including drones, Starlink terminals, flammable liquids, radios, drone-neutralizing devices, VR goggles, and more.
Recruits were paid in cryptocurrency to avoid financial tracking by the authorities. These financial details came to light following the first arrests in October 2024. The investigation also revealed a network of key actors involved.
1.3. Key Actors Involved
Anatoliy Prizenko is a Moldovan oligarch linked to pro-Russian exiled businessman Ilan Shor. He is identified as one of the main recruiters of Moldovan youth for training in Serbia and Bosnia and Herzegovina (Republika Srpska). The EU sanctioned him in December 2024 for his role in the painting of the Star of David in Paris (October 2023), an act carried out on behalf of the GRU.
Mikhail Potepkin was also involved as a training coordinator, reportedly linked to the Wagner Group, and is under sanctions from the United States, the United Kingdom, and the EU.
Konstantin Golosokov, another coordinator in the recruitment of Moldovan youth, previously took part in the 2007 cyberattacks against Estonia.
Aliona Gotko, named by Moldovan intelligence among 13 individuals charged with organizing these actions, is a separatist from Transnistria and holds Russian citizenship.
The group’s task was to incite internal unrest in Chișinău on election and referendum days, creating chaos to undermine the legitimacy of the pro-EU results.
2. Hybrid Operations by Serbia and Russia in France
That Russia and Serbia are engaged in numerous acts of agitation, propaganda, and destabilization worldwide is demonstrated by the following two cases:
2.1. Painting of the Star of David on behalf of the Russian GRU
In October 2023, in Paris, over 250 instances of the Star of David being painted on walls and public buildings were recorded. Initially, it was assumed the perpetrators were Muslim extremists. However, subsequent investigations revealed that Anatoliy Prizenko, a Moldovan national linked to the Russian military intelligence agency GRU, along with the pro-Russian “Doppelgänger” network, was behind the operation. The EU sanctioned Prizenko in December 2024, stating that this was a psychological and provocative operation directed by Russia, aimed at manipulating public opinion in France and delegitimizing Muslim communities.
A similar incident occurred again in Paris, but this time carried out by Serbs.
2.2. Vandalism of synagogues and Jewish memorials by Serbs
In June 2025, three Serbian nationals were arrested for vandalizing synagogues and Jewish memorials in Paris with the intent of blaming Muslims. Security officials stated there were suspicions that the acts were organized by networks operating in coordination with Russian directives. The method of operation, the timing, and the symbolism used matched the pattern of the Prizenko case.
2.3. Objectives of the Operation
The aims of these actions on French territory were:
- To incite ethnic and religious divisions within French society and create chaos;
- To artificially blame the Muslim community for antisemitic attacks;
- To provoke the French state against Muslims;
- To weaken the French state and society, making them more vulnerable to Russian interference.
2.4. Methodology of the Operation
- Both cases follow the well-known pattern of “false-flag” operations, where perpetrators deliberately leave traces pointing to certain groups (in this case, Muslims).
- The objective is to create conditions for the rise of far-right nationalism, social division, and the fracturing of integration policies in France.
- To erode institutional resilience and create a porous system. Although the operational model and strategic interests primarily suggest Russian and Serbian involvement, the possibility cannot be excluded that other state actors, with an interest in curbing France’s “pro-Palestinian diplomacy”, may have contributed indirectly or in coordination with hybrid networks.
- According to security sources, the logistical network uses similar channels for training, payments, and technological equipment.
3. Infiltration into EU Institutions and Serbian Espionage in Brussels
Two separate wiretap incidents revealed that Serbia has been involved in spying on European Union officials and institutions, one case serving Russia’s interests, and the other aimed at undermining the Kosovo–Serbia dialogue.
3.1.Serbian Espionage in Brussels (1)
Novica Antić, head of the Serbian Army Union, was identified as an “active FSB influence agent,” according to a briefing obtained from Western intelligence services and reported by POLITICO.
In October 2023, Antić traveled to Brussels and met with three Members of the European Parliament: Viola von Cramon-Taubadel (Germany, Greens), Alessandra Moretti (Italy, Socialists & Democrats), and Vladimír Bilčík (Slovakia, EPP).
He also held meetings with EU lobbying organizations such as EUROMIL (European Organisation of Military Associations) and EPSU (European Public Service Union).
There is no evidence that the MEPs or the organizations in question were aware of Antić’s links to Russian intelligence, which reinforces the use of the “professional cover agent” method.
3.2.Links to the Russian Network
Antić has worked directly with Vyacheslav Kalinin, a Russian national and editor-in-chief of the “Veteran News” platform, a media outlet linked to the FSB and the Russian Ministry of Defence. Kalinin invited Antić to Russia in 2019–2020 for meetings with senior Russian military officers, including members of the Ministry of Defence and pro-Kremlin organizations.
According to the intelligence document, Russia is using Serbian agents like Antić to:
- Spread pro-Russian propaganda about the invasion of Ukraine;
- Undermine support for the EU and NATO within EU institutions;
- Penetrate European trade unions and civil society structures.
The Antić case is a textbook example of a “gray agent”, a figure operating under the guise of a civil sector representative, infiltrating EU lobbying or diplomatic structures without raising immediate suspicion.
Antić gained access to the European Parliament building, highlighting institutional vulnerabilities to influence operations, especially when actors disguise themselves as trade union representatives or “independent activists.” Unions like EUROMIL and EPSU have been targeted because they provide extended access to the internal structures of European security and bureaucracy without stringent security vetting.
4. Serbian BIA Direct Espionage Against the EU
In the second case, Serbia’s Security and Information Agency (BIA) was directly involved in wiretapping EU institutions.
4.1. Serbian Government Official Serving the BIA in Wiretapping Operations
Igor Popović, Deputy Director of the Serbian Government’s Office for Kosovo and “Metohija”, was arrested in Kosovo in July 2025 on charges of inciting interethnic hatred and spreading destabilizing propaganda (serious constitutional and criminal offenses). He pleaded guilty as part of a plea agreement with the Special Prosecution.
However, investigations following his arrest revealed something far more serious: Popović had been involved in wiretapping operations against European Union officials in cooperation with the BIA. In publicly released excerpts, on 17 September 2020 he is heard placing and activating listening devices in EU offices together with another person, identified as female based on her voice.
4.2. Vertical Links with the BIA and Organized Crime
In another published recording, Popović is shown to be a direct associate of Bojan Dimić, head of the Serbian Security and Information Agency (BIA). Messages exchanged between Popović and Dimić reveal that the BIA continues to employ individuals from organized crime networks in sensitive state functions. This is further demonstrated through the case of Kompirović, a figure mentioned for his role in the operational logistics of the wiretapping.
4.3.Classic SIGINT in the Service of Hybrid Diplomacy
This case differs from “gray agent” or “covert lobbying” scenarios:
- Here, we have an official state structure which, through its own officials, carries out well-coordinated surveillance and wiretapping operations against EU representatives;
- Activities which, by any Western standard, would be considered an act of hostile intelligence against an allied international bloc.
Nevertheless, the EU made no public comment on the audio recordings, indicating a lack of transparency in addressing the incident. This response suggests the matter is being handled through closed channels, avoiding public exposure of institutional security weaknesses and the diplomatic consequences that could arise from them.
Conclusions
The five analyzed cases, from the sabotage of elections in Moldova, to false-flag operations in France, infiltration of EU institutions, and direct wiretapping in Brussels, demonstrate an integrated model of Russian hybrid aggression, with Serbia acting as an operational platform and, in some cases, employing the same techniques solely for its own interests.
Common elements include the use of criminal and paramilitary networks, financing through informal channels, covert operations via “gray” actors, and exploitation of state infrastructure for intelligence collection. This cooperation constitutes a deliberate strategy to weaken and infiltrate state and societal structures until they become controllable. The ultimate objective is the dismantling of the elements that ensure Europe’s security and cohesion, leaving the continent more vulnerable to external influence and pressure.
Recommendations
- Impose targeted sanctions against individuals and entities serving as key nodes in these networks (action from the EU, United States, and the United Kingdom).
- Establish an EU–NATO Task Force to identify and dismantle Russian influence operations that use Serbian territory and infrastructure.
- Implement EU security protocols to screen external actors entering its institutions through NGOs or trade unions (European Parliament, European Commission).
- Publicly expose logistical networks to reduce their ability to operate under the radar and to increase the political cost of the support they receive from Belgrade.
Any delay in action will not only heighten the vulnerability of the European and Western democratic order but will also turn the EU and the broader West into an open battleground for Russian hybrid operations.
© 2025 Argumentum
