Russia among hostile states colluding with gangs in attacks on EU member states, Europol warns

The agency’s Serious and Organised Crime Threat Assessment (Socta) 2025 said cyberattacks are linked to states to an increasing extent, with critical infrastructure — such as energy facilities and water systems — the target. Picture: Alamy/PA

The EU’s police agency has warned of “collusion” by criminal gangs and hostile states to attack the security and stability of Europe.

Europol said Russia is among the states using these gangs to engage in hybrid attacks, from sabotage to disinformation campaigns, with the aim of “creating chaos and undermining public trust in institutions” among member states.

The agency’s Serious and Organised Crime Threat Assessment (Socta) 2025 said cyberattacks are linked to states to an increasing extent, with critical infrastructure — such as energy facilities and water systems — the target.

The document, produced by Europol every four years, outlines a wide range of trends and threats from gangland including:

• Fraud across the EU is an “epidemic” and has reached “unprecedented” levels, not only in its scale and reach but also its “sophistication”, and it is accelerated by rapid advances in AI which is expected to “outpace other types of serious and organised crime” in the short term;
• There is a significant rise in volume of child sexual abuse material detected online, including a “proliferation” of self-generated material and sexual extortion, with production and distribution expected to grow further, fuelled by AI;
• The drugs trade is marked by “immense” profits in the cocaine market, with some indications of smaller ports being used, and smaller amounts being trafficked, to avoid seizures of multi-tonne consignments while there are also indications that legal and illegal cannabis markets will be increasingly intertwined in supply;
• There is increasing violence in the drugs trade in many EU states — seen in the likes of Sweden and Belgium — with cases of children as young as 13 being paid €19,000-€20,000 for contract killings, following reports of children being recruited on social media or gaming platforms for drugs and other crimes — including cyber and extremism;
• Despite substantial investment in resources and laws, the confiscation of criminal proceeds in the EU has “stagnated”, with just an estimated 2% of profits nabbed;
• And a cessation of Russia’s war in Ukraine could lead to a glut of firearms, ammunition, and drones on the black market, while the expertise of former soldiers and ex-military cyber experts could go on the criminal marketplace.

'Wake-up' call

Speaking at the launch, Europol director Catherine de Bolle said the report should be a “wake-up” call for the EU.

“Organised crime is growing, evolving and becoming more dangerous,” she said, "but organised crime is no longer just about making money. 

We observe a growing collaboration between criminal networks and actors organising hybrid threats, exploiting geopolitical tensions and undermining our institutions

She said cybercrime is turning into a “digital arms race” and some cyberattacks show a combination of “profit and destabilisation” as they are “increasingly state aligned and ideologically motivated”.

The report cites “collusion” between some gangs and hostile states, and adds: “There is an increase in politically motivated cyberattacks against critical infrastructure and public institutions, originating from Russia and countries in its sphere of influence.” 

Crucial infrastructure being targeted include energy, water supply, and healthcare, all with the aim of “immobilising essential services, creating chaos, and undermining public trust in institutions”.

The EU commissioner for internal affairs and migration, Magnus Brunner, said the recent assessment identified "something new" in that criminal networks are "working on behalf of foreign powers and foreign governments".

He said this could be seen in the "weaponising" of migration, with Russian authorities paying smugglers to bring busloads of migrants into Europe to cause destabilisation.

He also cited a recent case in Poland where the country's largest public hospital suffered a "huge cyberattack", causing very serious disruption to care and services. Authorities in the country are investigating if Russia was behind it.