Russa’s Non-State Actors

Russia’s employment of non-state actors (NSA) is a staple of its approach to hybrid threat operations. This handbook provides an overarching assessment of Russia’s approach to working with and through various NSAs across different operational domains, mapping both the empirical depth and breadth of the phenomenon. It establishes a much-needed baseline for understanding the logic behind Russia’s use of NSAs and lays the groundwork for determining appropriate measures and countermeasures at a time when operations below and above the threshold of war are on the rise.

Key takeaways

• Non-state actors (NSAs) are central to Russia’s “grey zone” strategy, allowing the Kremlin to project power while maintaining deniability. The use of NSAs is embedded in Russia’s strategic culture, rooted in the Soviet era and the practices of the KGB.

• NSAs can be effective in various conditions, ranging from peacetime to hybrid threats and from hybrid to conventional warfare. Russia has long used NSAs to influence its own population and allies, destabilise adversaries, and even fight enemies on the battlefield.

• Relationships between NSAs and the Russian government are complex, informal, and fluid, often driven by profit, ideology, or both. Nevertheless, there are strong indications of state involvement. At the same time, the coherence and coordination of these activities should not be overstated, as the decision-making process in Russia can often be fragmented and ad hoc.

• Most NSAs maintain ties to several key state institutions, most notably the Presidential Administration, which serves as a strategic hub for planning, decision-making, and coordination, as well as Russian intelligence services, which are directly involved in the practical orchestration of NSAs.

• The Russian regime’s reliance on NSAs, and their reliance on the regime, has likely increased since the invasion of Ukraine, as direct activities by the Russian state have faced increased exposure and countermeasures.

• The NSAs most frequently used by Russia are diverse and often have overlapping roles. They can operate in various domains simultaneously, in a fluid and adaptable manner, rather than in strictly defined silos. Nevertheless, distinct categories with shared characteristics can be identified.

• Armed NSAs form a fluid ecosystem where state and non-state, legal and illegal forces overlap. They serve as enforcers, disruptors, and emissaries of influence for the Kremlin, providing deniability and operational flexibility. Their clandestine and volatile ties to security forces, industry giants, and political elites make attribution to the Russian regime difficult.

• Cyber NSAs are employed for espionage, disruption, and for providing support in information operations. While the backbone of Russia’s offensive cyber programme still lies within state-controlled hacking groups, since 2022 hacktivists and cybercriminals have been used increasingly. Russia’s offensive cyber programme also relies on various enablers, such as research institutes and IT companies, which are necessary for the development of Russia’s offensive cyber capabilities.

• Propaganda and disinformation NSAs are a cost-effective tool in Russia’s hybrid threat toolbox. Their activities are increasingly outsourced to private entities but remain under tight state control. More unconventional and apolitical actors, including social media platforms, influencers, and cultural figures, are increasingly being used to shape narratives in Russia and abroad.

• Social and political NSAs are used to project Russia’s sharp power and to influence foreign legislative processes in its favour. They exploit traditional values, falsify history, work closely with the Russian compatriot community, and, more recently, have stepped up their activities in developing countries.

• Economic and financial NSAs play a crucial role in Russia’s ability to exert economic and financial influence abroad. However, their international reach has been hindered by Western sanctions, resulting in a more inward focus. As sanctions have intensified, these actors, along with others, have been mobilised to evade them.

Introduction

Vladimir Rauta

Whether through attacks on German military and industrial facilities by individuals, sabotage of French rail infrastructure by loosely co-ordinated groups, disinformation campaigns run by private companies, or cyber operations by hacktivist collectives, Russia’s employment of non-state actors (NSAs) is a staple of its approach to hybrid threat operations.

This handbook seeks to provide an overarching assessment of Russia’s approach to working with and through various NSAs across different operational domains, mapping both the empirical depth and breadth of the phenomenon. It establishes a much-needed baseline for understanding the logic behind Russia’s employment of NSAs and lays the groundwork for determining appropriate measures and countermeasures at a time when operations below and above the threshold of war are on the rise.

The handbook is designed for practitioners and readers who may not have prior in-depth knowledge but who require a clear and accessible introduction to the topic.

It asks how and why Russia uses NSAs and, in doing so, touches on several related policy questions:

• Is there a grand strategic approach to Russia’s employment of NSAs?

• How do NSAs orchestrated by Russia differ typologically?

• Are all NSAs orchestrated by Russia proxies?

• What is their strategic utility across operational domains?

• How have these NSAs and their relationship to the Russian state evolved?

The handbook focuses on five categories of NSAs distinguished by their domain of operation:

• Armed non-state actors.

• Cyber non-state actors

• Propaganda and disinformation non-state actors

• Social and political non-state actors

• Economic and financial non-state actors

Each category of NSA is discussed in turn and analysed within the context of Russia’s broader strategy, examining the practices, logics and rationales behind the use of NSAs, their relationship to the Russian regime, and their purpose and role in hybrid threats. The use of NSAs in Russian hybrid threat operations is exemplified by recent case studies that focus on, but are not limited to, Hybrid CoE’s Participating States or regions where their interests are threatened. The handbook also identifies key Russian state institutions that orchestrate NSAs in hybrid threats. It culminates in conclusions and knowledge gaps that point to areas for further research.

This analysis incorporates Hybrid CoE’s established vocabulary and employs the term “non-state actor” as defined in The Landscape of Hybrid Threats: A Conceptual Model, a landmark conceptual document jointly developed by the European Commission’s Joint Research Centre (JRC) and Hybrid CoE.

NSAs are defined therein as “entities that play a part in international relations and that exercise sufficient power to interfere, influence and cause change without any affiliation to the established institutions of a state” and as ranging “from individuals to private corporations, religious institutions, humanitarian organisations, armed groups and de facto regimes in actual control of territory and population”.

The complexity of non-state actors in hybrid threats

Vladimir Rauta

Russia’s hybrid threat and hybrid warfare strategies combine a diverse range of kinetic and non-kinetic means, including physical attacks on infrastructure; disinformation and propaganda; assassinations; cyberattacks; and even the fomenting of coups d’état or secessionist insurgencies through armed proxies. Such operations have been pursued across the full spectrum of military and non-military domains by an ever-expanding mix of state and non-state actors. For Russia, these operations form part of a strategy of placing small bets designed to “square [the] circle of maximal ambitions and weak conventional capabilities”.

Russian hybrid threats are often seen as ambiguous because they involve many operations short of war. This perception often stems from the difficulty of analysing the complex relationships between the Russian state and the NSAs it employs. Furthermore, not all NSAs are used in hybrid threats or act as Russian proxies. As a result, the issue is complex to analyse and undermines the development of effective countermeasure strategies.

This section evaluates two features of NSAs that illustrate how Russia employs and engages with them, helping to explain the reasoning behind their use in hybrid threats:

• NSA typological diversity

• State-NSA relational variation

The notion of NSA lacks a universal definition. It serves as an umbrella term covering a multitude of entities, broadly characterised by their independent existence vis-à-vis sovereign states. NSAs are, therefore, diverse by the very nature of the many actors that fall under this label. NSA typological diversity is evident in Russian hybrid threats in the Baltic-Nordic region, where individuals commit various forms of vandalism against historical monuments; commercial entities purchase strategically located island and coastal properties; the Russian Orthodox Church (ROC) finances construction projects near sites of national security importance; or Russia’s so-called shadow fleet circumvents sanctions on oil exports.

This handbook focuses on five categories of NSAs frequently used in Russian hybrid threats:

• Armed NSAs (ANSAs) include private military companies (PMCs), transnational criminal networks (TCNs), paramilitary formations, militias, terrorist groups, contract killers, and disposable agents.

• Cyber NSAs (CNSAs) range from state-controlled hacking groups to hacktivists, cybercriminals, and cyber enablers such as IT companies and research centres.

• Propaganda and disinformation NSAs (PDNSAs) include traditional media, digital media, influencers, culture and arts actors, and propaganda and disinformation enablers such as PR agencies.

• Social and political NSAs (SPNSAs) comprise think tanks, compatriots, sharp power, history-linked organisations, as well as the ROC, political parties and lobbyists.

• Economic and financial NSAs (EFNSAs) refer to the role played by oligarchs, state-aligned corporations, and sanctions-evasion enablers, often outsourced from other categories of NSAs.

The advantage of this typological assessment lies in its ability to map the breadth of Russia’s use of diverse NSAs, improving our understanding of the complex Russian hybrid threat landscape.

The diversity of NSAs corresponds to the variation in their relationships with state sponsors. In short, just as not all NSAs are the same, not all state-NSA relationships are alike. In the Russian context, most examples are characterised as proxy relationships. While some NSAs are indeed proxies, others are better described as auxiliaries, affiliates or surrogates. Although different types of state-NSA relationships can be identified, it is often challenging to fit them neatly into categories, as information on the underlying relationship dynamics is typically very limited. State-NSA relationship types are described in detail in Hybrid CoE’s key study, Hybrid Threats from Non-State Actors: A Taxonomy.

Russia’s reliance on NSAs in hybrid threats follows the familiar logic of conflict delegation. This refers to “a strategy in which a foreign government commits material resources or military expertise to a non-state armed group to target a perceived adversary”. Although typically associated with armed groups, the logic of conflict delegation applies to non-armed actors as well. The use of NSAs is cost-effective, deniable, and risk averse. It is not surprising, therefore, that using NSAs has been labelled both “the least bad option” and “a superficially seductive policy option”.

The characterisation of NSAs as Russian proxies, however, is difficult in practice, not least because “grey zone” activities thrive on ambiguity and the often-cited blurring of peace and war. This creates an asymmetric playing field in which Russia delegates to NSAs a range of subversive activities that accomplish the desired strategic goals at low cost while providing the strategic benefits of plausible deniability. Some scholars have argued that deniability is hardly bulletproof given how easily and frequently sponsorship can be identified, while others contend that a more accurate concept is, perhaps, that of implausible deniability. As was recently pointed out in an essay on maritime sabotage, the act of naming and shaming is unlikely to deter future attacks by itself.

Non-state actors, hybrid threats and international law

Agata Kleczkowska

At the core of these dilemmas lie issues of attribution, best framed by asking whether it is possible to hold Russia responsible for certain actions under the international legal framework. According to the Articles on Responsibility of States for Internationally Wrongful Acts, to establish that a state has committed an internationally wrongful act, the conduct in question has to be attributable to the state under international law and must constitute a breach of one of its international obligations. Thus, to hold Russia responsible, the actions of the NSAs described below must first be attributed to it.

The conduct of an NSA could be considered an act of a state under international law if the NSA was acting on the instructions of, or under the direction or control of, that state. This standard is often associated with the effective control test, described in the Military and Paramilitary Activities in and Against Nicaragua case, in which the International Court of Justice held that a state’s general control over a highly dependent NSA was not sufficient for attribution, as the state must exercise effective control over the NSA’s actions. The threshold for attribution is therefore very high: a state must give instructions to the NSA concerning each specific wrongful act or exercise effective control over each such act.

The effective control test is not, however, the only standard of attribution. The International Criminal Tribunal for the former Yugoslavia presented the so-called overall control test in the Prosecutor v. Duško Tadić case. Under this test, to attribute an NSA’s actions to a state, it must be shown that the state has overall control over the group, not just by funding and equipping it, but also by coordinating or planning its activities. However, the state does not need to give direct orders for specific illegal acts to the group’s leadership or members.

Both tests have their proponents and opponents. Until the dilemma between them is resolved, states will be able to exploit the “grey zone” that exists within the rules of international responsibility to conceal their involvement in the actions of NSAs.

Secondly, the action attributed to the state must be recognised as a violation of international law. There are no international legal norms specifically tailored to address many of the actions described in this report; this is true, for example, of disinformation, covert influence on legal processes, election meddling, or attacks on critical infrastructure. Some of these may amount to violations of the principle of non-intervention or the right to self-determination, but not necessarily in every case.

A more flexible and broad interpretation of the legal norms may therefore be needed to allow them to encompass these activities.

However, some of the actions described here - such as cyberattacks - have, under certain circumstances, already been recognised as violations of international law by both states and the doctrine of international law. Therefore, if such actions can be attributed to Russia, it could be held responsible for them.

Armed NSAs

Magda Long

Key takeaways

• Armed non-state actors (ANSAs) act as enforcers, disruptors, and emissaries of influence, offering deniability, operational flexibility, and local familiarity that enable the Kremlin to evade attribution, accountability, and legal responsibility.

• While their defining feature is the use of violence, this is not exclusive, as they can also contribute other valuable assets, infrastructure, and capabilities to the regime.

• Security forces, industry giants, and senior political figures have been directly or indirectly implicated in orchestrating their activities.

• Nevertheless, the clandestine and often volatile nature of these relationships complicates efforts to trace direct coordination or responsibility.

Introduction

Russia’s reliance on ANSAs is a deeply embedded feature of its strategic culture – one that extends state power while retaining a veneer of deniability. Although a relatively small subset of Russia’s “grey zone” arsenal, their impact is strategic, lethal, and outsised. From assassinations and manipulation of regional dynamics to territorial occupations and political subversion in Europe, Africa, the Middle East, and Central Asia, ANSAs act as force multipliers and strategic coercive mechanisms serving the Kremlin’s objectives.

The ANSA category includes private military companies (PMCs), transnational criminal networks (TCNs), paramilitary formations, militias, and terrorist groups. Contract killers and disposable agents, who are not necessarily linked to actors in the remaining sub-categories, also fall under this umbrella when deployed for political violence or covert subversion. Driven by ideology, profit, or a combination of the two, ANSAs thrive in spaces where legality is ambiguous, and governance contested. Nationalism often masks profiteering and institutional corruption, while legitimising state-sanctioned irregularity. The Kremlin mobilises ANSAs regardless of their legal standing; what matters is operational utility.

PMCs and TCNs in particular have become integral to Russia’s “grey zone” strategy. Since 2012, when Vladimir Putin publicly endorsed PMCs as a tool for pursuing “national interests without the direct involvement of the state”, ANSAs more broadly have become the Kremlin’s multipurpose instrument - a Swiss army knife rather than a finely tuned scalpel - for covert strategic coercion.

Frequently, ANSAs are interlinked, making it increasingly difficult not only to decouple their activities but also to determine the extent to which these are coordinated – directly, tacitly, or not at all – by state actors. Nevertheless, security forces, industry giants, and occasionally even senior political figures have been directly or indirectly implicated in ANSAs’ activities.

This chapter unpacks the seven sub-categories of ANSAs, highlighting their roles, characteristics, and value to the Kremlin (see Figure A1). While not all Russian ANSAs can be covered comprehensively, short vignettes will be used to illustrate how these actors support Moscow’s aims while shaping the broader conflict environment.

Private military companies

As of 2021, at least 27 Russian PMCs were active and operating in 27 countries – up from four in 2015. They are active throughout Africa, the Middle East, Europe, Central Asia, and Latin America. While their organisational structures, roles, and objectives vary, most maintain ties to the MoD, FSB, GRU, or state-owned energy giants.

PMCs occupy a central role in Russia’s broader coercive diplomacy and hybrid threat strategy. It is therefore crucial to view Russian PMCs not just in terms of force multipliers in combat operations or as the Kremlin’s deniable vehicles, but also in terms of their ability to:

• Expand Moscow’s influence openly;

• Increase revenue streams to elites, officials, institutions, and oligarchs;

• Present Russia as an indispensable mediator and security partner in the Middle East and North Africa;

• Gain military access rights and economic concessions.

PMCs remain technically illegal in Russia, a status that grants the Kremlin deniability and narrative control, shielding it from legal responsibility for activities undertaken by PMCs abroad on its behalf and from accountability at home. PMC casualties are not considered military deaths, and their families receive no state benefits - ironically, the very critique Russian commentators once levelled at the West. At the same time, since at least 2012, President Putin and Chief of General Staff Valery Gerasimov have publicly invoked Western PMC use as evidence of reliance on deniable force projection and imperialism - framing the Kremlin’s own adoption as reactive and justified.

Certain PMCs were evidently permitted to incorporate in Russia, and even those that were incorporated elsewhere became the Kremlin’s useful tool. RSB Group, founded in 2005 by former intelligence officer Oleg Krynytsyn, was incorporated both in Russia and in the British Virgin Islands for missions abroad. RSB, which markets itself as a “military consulting company”, resembles the American PMC model (see Table A1). Its personnel include “professional military personnel, as well as reserve officers” of the GRU and FSB, and it was sanctioned for training Russian forces for the war in Ukraine.

Similarly, Moran Security Group, founded by a former KGB and later FSB officers, was registered in both Belize and Russia in 2011. Moran created the Slavonic Corps, Wagner Group’s predecessor, which was incorporated in Hong Kong in 2013. All three companies had links to the Kremlin, the MoD, the GRU, and the FSB, and have provided services to the Russian state in Africa, the Middle East, and Ukraine. While this Moran Security Group reportedly dissolved in 2017, a company by the same name, which has existed since 1999 according to its website, appears to be active and is led by Igor Nikov, a former Russian Navy officer.

PMC Patriot, backed by Sergei Shoigu, has operated in Burundi, the Central African Republic (CAR), Syria, Yemen, Sudan, Gabon, and Ukraine since it was founded in 2018. PMC Paladin, by contrast, appears to deviate from the Kremlin-aligned messaging. Established in 2022 by Georgy Zakrevsky and based in Moscow, Paladin brands itself explicitly as a PMC and claims deployments in Lebanon, the Democratic Republic of the Congo, and Ecuador, although it has reportedly also operated in Ukraine and possibly in Syria at some point. Most strikingly, in August 2024, Zakrevsky made headlines with a viral video publicly denouncing Putin, holding him responsible for failures in Ukraine and for Russian social and economic decline, and calling for regime change.

The Wagner Group, which emerged during Russia’s annexation of Crimea, became the archetypal Kremlin-aligned PMC, with a hydra-like, clandestine network of shell companies numbering in the hundreds. Wagner may have been the Kremlin’s muscle, it was riding on the back of mafia logistics. Its criminal identity not only attracted criminals but also normalised their behaviour. After its 2023 mutiny, Wagner’s remnants were rebranded as the Expeditionary Corps, including Africa Corps, led by Andrei Averyanov, head of the infamous GRU Unit 29155 and deputy head of the GRU, and the Volunteer Corps. Some Wagner fighters joined the Rosgvardiya Volunteer Corps for deployments abroad, despite Rosgvardiya’s domestic mandate.

What is particularly concerning is that some of these groups have exhibited extreme violence and brutality against civilians - for example, Wagner and its affiliated company Sewa Security Services (see Case Study 1) - as well as the sheer number of clandestine companies and affiliations linked to Russian PMCs. They also often overlap with extreme-right, white supremacist paramilitary formations such as DShRG Rusich and the Russian Imperial Movement (RIM), including its military wing, the Russian Imperial Legion, and are characterised by general criminality.

CASE STUDY 1: Violence by Russia’s PMCs and their affiliates

Wagner fighters have been accused of violating international law and killing civilians in virtually all the countries where they have operated militarily since 2014.

The US Treasury Department designated Wagner a significant transnational criminal organisation, citing serious criminal activities “including mass executions, rape, child abductions, and physical abuse in the CAR and Mali”.

In July 2023, the UK government sanctioned Sewa Security Services (SSS), a CAR-based security company, for undermining and threatening the peace, stability, and security of the CAR, and for providing cover for Wagner operations there.

SSS provides protection for senior CAR government officials and has also been implicated in violent attacks that have taken place in the CAR since the December 2020 presidential election.

Transnational criminal networks

The Kremlin weaponises TCNs as deniable auxiliaries of state power, co-opting them into intelligence operations, sabotage, and influence campaigns. These networks - comprising arms and drug traffickers, smugglers, money launderers, forgers, cybercriminals, and enforcers - are far from mere rogue elements.

The FSB pioneered this tactic in the 1980s, cultivating informants and assets within domestic gangs and extremist circles. Over time, these links evolved into a broader external toolkit for projecting covert power. Since 2014, and even more so after 2022, Russia has increasingly outsourced the “dark aspect” of statecraft to criminal actors with transnational reach and built-in deniability. As RUSI Senior Associate Fellow Mark Galeotti notes, the scale and institutionalisation of this practice under Putin far exceeds that of the Soviet era. As shown in Case Study 2, TCNs are closely linked to other ANSAs and can participate in intricately coordinated and high-stakes hybrid threat operations, such as the 2016 Montenegro coup.

CASE STUDY 2: The interconnected nature of ANSAs: Use of ANSAs against Montenegro

Russia’s attempted coup in Montenegro in 2016 involved a constellation of actors, including GRU Unit 29155, criminal actors, PMCs, paramilitary formations, and militia elements. GRU officers Eduard Shishmakov and Vladimir Popov - sentenced in absentia by the Supreme Court of Montenegro to 15 and 12 years in prison respectively - coordinated with Serbian nationalist and Donbas war veteran Aleksandar Sindjelić to execute a violent takeover of the Montenegrin parliament on election day. Their objective was to prevent Montenegro’s accession to NATO and install a pro-Russian government under the guise of a nationalist revolution. The GRU channelled hundreds of thousands of euros through criminal intermediaries to finance weapons procurement, fake police uniforms, encrypted communication devices, and travel logistics. The network extended to Chechen criminal intermediaries associated with Ramzan Kadyrov, who were tasked with persuading the Muslims to support the coup’s outcome. Other actors included figures like GRU officer Viktor Boyarkin - believed to be linked to sanctioned oligarch Oleg Deripaska, Serbian organised crime figures such as Sindjelic, and former FSB officer Daniil Martynov. Their collaboration highlights the convergence of state intelligence, oligarchic influence, and criminal muscle in Russian hybrid threat operations.

Similar dynamics unfolded in Crimea and Donbas, where the infamous “little green men” and local criminals helped seize territory before being integrated into separatist structures. This trend accelerated following the 2022 invasion of Ukraine, with reports of Chechen TCNs liaising with Ukrainian criminals in an effort to co-opt them - echoing the Kremlin’s 2014 invasion playbook.

TCNs have long been consolidated under the control of oligarchs linked to President Putin or Russian intelligence and have been allowed to profit freely as long as they supported the Kremlin’s priorities. Some of this support includes weapons trafficking, smuggling, laundering of sanctioned assets, and the procurement of dual-use technologies. Europol and European intelligence agencies have observed a surge in sabotage, smuggling, and cybercrime connected to Russia-based networks since the invasion of Ukraine. TCNs also help generate chernaya kassa (“black cashbox”) for the Kremlin, used to bankroll covert operations, pay bribes and agents, run influence campaigns, and provide the FSB and GRU with the infrastructure needed to establish shell companies, safe houses, and smuggling routes.

The increasing trend of layered outsourcing among ANSAs is particularly concerning. Russia-based TCNs subcontract activities to local criminal groups across Europe, and this symbiosis gives the Kremlin access to resources typically reserved for TCNs, allowing Moscow to harvest criminal intelligence, launder resources, and extend strategic goodwill to them when useful. These actors, however, are often unreliable, self-interested, and unpredictable, and their cooperation exposes the state to reciprocal exploitation.

Paramilitary formations

Although the term paramilitary is often loosely applied to PMCs, the two differ in legal status, structure, and purpose. PMCs are commercial enterprises driven by profit, offering services that range from combat support to logistics within a transactional framework. Paramilitary formations are not formal state organs but may operate in alignment with state objectives or ideology. They may receive state support, operate alongside formal military structures, or even be absorbed into official structures while maintaining a degree of autonomy. Table 1 illustrates the spectrum of paramilitary formations; in the Russian context, however, these distinctions are even more convoluted.

▲ TABLE 1. Spectrum of paramilitary formations

Groups such as Rusich and RIM embody the fusion of paramilitarism and other armed non-state activity. These extreme-right, white supremacist militant organisations have long histories of aligning with Russian interests. Both Rusich and RIM fought alongside separatists in Ukraine in 2014 and re-emerged in support of Russia’s 2022 invasion. In 2015, Rusich fighters were filmed mutilating Ukrainian soldiers, yet despite (or perhaps because) of their notoriety the FSB Border Service reportedly engaged Rusich for intelligence operations and to reinforce the border with Finland. RIM was designated a terrorist organisation by the US in 2020 for training white supremacists and neo-Nazis in Europe. RIM’s Partisan training programme provides recruits with tactical training and ideological indoctrination, alongside lectures on NATO and how to interrogate a captured adversary in English, suggesting ambitions that extend beyond Ukraine. This apparent contradiction - invoking denazification in Ukraine while deploying neo-Nazi militants - underscores Moscow’s instrumentalist approach to adversarial symbioses.

Paramilitary formations such as Rusich, RIM, and their ideological successors remain strategically useful to the Kremlin, at least for now. They provide manpower for sabotage, propaganda, territorial disruption, and psychological operations. Operating along NATO’s eastern flank, they seek to undermine regional stability, destabilise neighbours, and erode democratic resilience. The ideological militancy of these formations makes them less controllable than regular forces or even PMCs. However, their violent activities, symbolic provocations, and embedded presence in “grey zone” operations enable Moscow to exert pressure while disavowing responsibility.

Militias

Militias provide a ready-made infrastructure for territorial control, coercion, counterinsurgency, and intimidation without the professionalism or profit motives of PMCs, or the battlefield specialisation associated with paramilitary formations.

Militias serve as shock troops, enforcers, and cultural emissaries for shaping local power dynamics under the veneer of deniability. They originate from volunteer or ideological communities, unlike paramilitary formations that typically operate on behalf of, alongside, or beyond the state. While militias may align with state interests, they remain semi-autonomous coercive entities, lacking formal incorporation into state command structures.

A central example is the Kadyrovtsy - the personal militia of Chechen leader Ramzan Kadyrov - known for cruelty and abuse, while invoking fear and psychological pressure. Formally under the Rosgvardiya, Putin’s own Praetorian guard, the Kadyrovtsy act autonomously and remain loyal to Kadyrov. In return for loyalty and repression in Chechnya, Kadyrov enjoys patronage and influence.

The Kadyrovtsy have been deployed to Georgia, Syria, Libya, and Ukraine. Their units include the Akhmat Grozny OMON, responsible for riot control and policing, while the elite wing, Akhmat SOBR, functions as a regional militia.

In Ukraine, Akhmat units were deployed as volunteers under MoD contracts, demonstrating the loyalty that Wagner later refused. They assumed law enforcement duties around the Zaporizhzhia nuclear power plant and replaced Wagner units in Bakhmut. Some Wagner fighters were even absorbed into Akhmat after the 2023 mutiny, despite prior rivalries between Yevgeniy Prigozhin and Kadyrov.

Ideological militias such as the Cossacks and the Night Wolves represent a long-standing Russian tradition of community-based militarisation. Over 17,500 registered Cossack troops reportedly fought in Ukraine, forming volunteer battalions in occupied territories in Crimea and possibly in Donetsk, Luhansk, Kherson, and Zaporizhzhia. While the Cossacks’ historical role as social enforcers for the regime lends cultural legitimacy, their current value lies in being pre-organised, armed, and deniable auxiliaries motivated by patriotism and regionalism.

The Night Wolves, a nationalist biker gang, act as ideological enforcers and nationalist provocateurs. Although not conventionally armed, their Kremlin and ROC ties, combined with theatrical symbolism, give them political and mobilising influence. They have received public endorsements, state funding, and honours from Kadyrov, Republika Srpska President Milorad Dodik, and Transnistrian President Vadim Krasnoselsky. Their influence is particularly evident in the Western Balkans, where they have cultivated ties with paramilitary and ultranationalist groups such as Srpska Čast and Zavetnici, exploiting nationalism, ethnic divisions, and anti-Western sentiment.

In 2014, the Night Wolves’ Sevastopol chapter actively aided the annexation of Crimea, gathering intelligence, disseminating propaganda, organising protests, securing infrastructure, and coordinating with Russian special forces. They helped establish checkpoints and intimidate officials, blending sharp power, psychological operations, and physical coercion. Although Moscow leverages militias for their utility, it also asserts control when they operate independently. Wagner was previously tasked with restraining unruly Cossack formations and neutralising separatist militias that strayed from Moscow’s objectives.

Terrorist groups

Russia’s engagement with terrorist organisations reflects a flexible, instrumentalist approach shaped by Cold War precedent. During the Soviet era, the KGB provided training and support to a range of anti-Western violent actors spanning a wide ideological spectrum, from Hamas to the Red Army Faction.

While Moscow publicly presents itself as a bulwark against terrorism, its actions suggest otherwise. Russia does not openly sponsor terrorist groups in the conventional sense, but rather co-opts, coordinates with, or exploits them to advance its geostrategic objectives.

In the Middle East, Russia has aligned operationally with Iran-backed actors, including Hezbollah and the Houthis. Russian military forces, including PMCs, fought alongside Hezbollah in Syria, and Russian intelligence collaborated with the group to help the Assad regime evade sanctions. More recently, GRU officers, operating under the guise of humanitarian aid, have provided technical assistance and intelligence for Houthi attacks on commercial shipping in the Red Sea. Disturbingly, the Houthis have also been implicated in human trafficking schemes to recruit Yemeni fighters for the war in Ukraine, according to the US Treasury.

The Kremlin’s ties to terrorist groups also intersect with organised crime. Arms trafficker Viktor Bout has reportedly resumed operations since his release from US custody, facilitating weapons transfers to the Houthis. This overlap between terrorism and organised crime is no coincidence; it is a cornerstone of Russia’s shadow warfare strategy, exploiting illicit economies to sustain influence, destabilise adversaries, and maintain covert influence abroad.

Moscow has also empowered and exploited violent far-right extremist groups such as the aforementioned Rusich and RIM. RIM, in particular, serves as a conduit for connecting Russian-aligned militants with like-minded Western groups. Participants in its Partizan training programme have included members of Germany’s National Democratic Party and The Third Path, as well as Sweden’s Nordic Resistance Movement, whose members carried out bomb attacks in 2017.

Contract killers

Contract killers are probably among the most professionally trained and valued assets on Russia’s roster of deniable actors. According to US intelligence, “the first clear case in the Putin era of Moscow directing assassination abroad occurred in 2004 in Qatar”. Typically linked to state agencies such as the FSB or GRU, these individuals are selected for their reliability, operational skills, and capacity for cross-border violence. Their missions are likely to be tightly coordinated, often including high-value targets with potential diplomatic fallout.

In February 2024, Maksim Kuzminov - a Russian pilot who defected to Ukraine in 2023 - was assassinated in Spain in a killing that bore the signature of professional contractors. Russian authorities had made no secret of their desire to eliminate Kuzminov, and surveillance footage captured two masked men who attacked and killed him. The killers escaped, but the Spanish police noted that the operation pointed “to organised crime, to a criminal organisation, to professionals”.

Such incidents follow a long-standing pattern. In 2019, Zelimkhan Khangoshvili, a Georgian-Chechen exile and former insurgent commander, was assassinated in Berlin by Vadim Sokolov - later identified by German prosecutors as Vadim Krasikov, a Russian contract killer with ties to the FSB. Although sentenced in Germany, Krasikov was reportedly released in an August 2024 prisoner exchange, which underlines how highly the Kremlin values such assets. It is evident that this category of ANSAs is neither opportunistic nor expendable. They are instruments of highly calibrated state violence that the Kremlin reserves for cases where precision, deniability, and message-sending are paramount.

Disposable agents

Disposable agents, by contrast, are expendable actors recruited for availability rather than expertise. These actors, ranging from criminal enforcers and intelligence-linked assets to freelance saboteurs, are used for espionage, assassinations, sabotage, coercion, and other forms of targeted violence. Typically sourced through criminal intermediaries or a gig-economy recruitment approach powered by information communications technology, particularly digital platforms and apps, disposable agents are employed in operations where scale, cost, and deniability matter more than finesse or experience.

The strategic utility of these actors lies in their expendability and general anonymity. Operating across borders, they enable the Kremlin to obfuscate attribution, often mimicking local criminal activity or conducting spectacularly public operations intended to send a message. Since the mass expulsion of Russian intelligence officers from Europe after 2022, reliance on these loosely affiliated, minimally vetted actors has grown markedly, demonstrating a shift from tradecraft to volume.

GRU Unit 29155, in particular, has been linked to assassinations and sabotage carried out by a mix of trained assets, willing criminals, and useful idiots, often outsourced to local hires solicited via online platforms such as the Telegram messaging app. Between 2023 and 2024, the number of such attacks in Europe nearly tripled, after having already quadrupled between 2022 and 2023.

The recent sabotage cases throughout Europe and the espionage trial detailed in Case Study 3 underscore a growing trend: the recruitment of local, previously unaffiliated individuals and amateur sleuths via anonymous digital platforms with little to no oversight.

CASE STUDY 3: Espionage trial in the UK

A high-profile espionage trial in the UK exposed a multi-tiered private spy network run by Jan Marsalek, the fugitive former COO of Wirecard, who acted as a freelance broker for Russian intelligence. Marsalek and his Bulgarian associates built an espionage supply chain involving bugged vehicles, cloned IDs, and amateur spies recruited to surveil NATO military installations in Germany. The group also targeted Cristo Grozev, a Bulgarian who worked for Bellingcat, and Roman Dobrokhtov of The Insider, whom Moscow had reportedly even considered kidnapping, although the plots were never executed.

This volume-based approach has compromised operational quality. Many recruits are clumsy, naïve, and untrained, increasing the risk of exposure. Some appear amateurish, lending credence to the assessment by Richard Moore, former head of the UK’s Secret Intelligence Service, that “Russian intelligence services have gone a bit feral … in some of their behaviour”.

Cyber NSAs

Eginhards Volāns

Key takeaways

• Russia operates one of the world’s most advanced offensive cyber ecosystems, built around a diverse set of cyber non-state actors (CNSAs).

• The ties and degree of proximity between these actors and the regime vary considerably, although most are managed through Russian intelligence services.

• While state-controlled hacking groups remain the most capable and frequently used actors at Russia’s disposal, hacktivists and cybercriminals are increasingly leveraged.

• Russia’s offensive cyber ecosystem is further supported by state-linked research institutes and private IT companies that help to develop essential tools and capabilities.

Introduction

Russia has developed one of the world’s most prominent offensive cyber programmes. Its offensive cyber capabilities align closely with its broader strategic culture, which is shaped by a general threat perception rooted in the narrative of a besieged fortress - a mindset that applies to cyberspace as well. As a result, the Kremlin has regarded cyberspace as a natural arena for geopolitical competition since the beginning of the internet age. This deeply rooted understanding is best exemplified by two of the earliest and well-known state-backed cyber operations, both linked to the KGB and its successor, the FSB (see Table 2).

▲ TABLE 2: Earliest Soviet and Russian cyber operations

Since then, Russia’s cyber operations have evolved considerably and are now conducted and supported by a wide range of CNSAs, whose relationships with and degrees of control by the state vary significantly (see Table 3). The approximate and indicative scope of Russia’s cyber ecosystem is illustrated in Figure A2.

▲ TABLE 3: Framework of state–CNSA relations

For this report, CNSAs are defined as entities controlled by, linked to, aligned with, or influenced by the Kremlin that operate primarily in the cyber domain and leverage cyber power. They take various forms, ranging from state-controlled groups and cybercriminal gangs to lone hacktivists and IT companies contracted by the regime to support its cyber programme.

This chapter maps the CNSAs used by the Russian regime, highlighting their ties to the state, their characteristics, and their value to the Kremlin, while also identifying emerging trends in their role in hybrid threats.

State-controlled hacking groups

Often described in the media as advanced persistent threat (APT) groups, state-controlled hacking groups are almost certainly the most capable cyber assets at the Kremlin’s disposal. They are not typical proxies but can instead be viewed as part of the Russian state itself, as the Russian intelligence services (RIS) exercise de facto control over all of them.

However, Russia has never acknowledged their existence and continues to maintain that they have nothing to do with the Russian government. For this reason, state-controlled groups can be defined as a specific sub-category of CNSAs, even though they are deeply embedded within the Russian security apparatus.

Russia’s state-controlled cyber groups are highly capable, well-funded, and closely aligned with the Kremlin. As fully state-backed actors, they can access other governmental resources and capabilities to conduct highly sophisticated cyber operations. Given their direct ties to the RIS, their operations can be more easily integrated into Russia’s other multidomain information and influence campaigns. For example, they play an important role in election interference, espionage against political opponents, and the use of kompromat to enable smear campaigns.

The scope and capabilities of these groups are exemplified by far-reaching operations such as the 2017 NotPetya attack on Ukraine’s financial, government, and energy sectors, often described as “the most devastating cyberattack in history”, or the 2020 Solar-Winds attack, which affected thousands of organisations worldwide, including the US and UK governments, the EU, and NATO. Both operations were carried out by state-backed groups linked to the GRU and the SVR, respectively.

The backgrounds of individual members vary considerably. Some, such as hackers from the FSB-controlled Turla group, possess more advanced expertise and formal training in IT. Others, such as those from the GRU-controlled Sandworm group, are military officers tasked with conducting cyberattacks as part of their everyday duties.

State-controlled hacking groups are actively employed not only during hybrid threat operations but also in conventional warfare. For example, a GRU-controlled group launched a destructive attack against Viasat’s KA-SAT satellite network just hours before Russia’s military invasion of Ukraine, demonstrating close coordination with military planning. Since then, state-controlled groups have continued to target Ukraine almost daily, although their focus has shifted from supporting military operations to conducting espionage and enabling information operations.

In addition to directly targeting Russia’s adversaries, state-controlled groups often serve as intermediaries between the Russian state and other CNSAs, such as hacktivists and cybercriminals. For example, GRU-controlled groups have established links to several pro-Russian hacktivist collectives, while the FSB’s 18th Centre, which oversees groups such as Gamaredon and Callisto, is known to maintain links to the cybercriminal underground.

▲ FIGURE 1. Shared agency over the Ghostwriter group

Belarus-affiliated groups

Belarus and Russia are believed to cooperate closely in cybersecurity and information operations, including through Russia’s use of third-party CNSAs primarily controlled by Belarus. This unique relationship is best exemplified by the Ghostwriter group, which is assessed to have links to both Belarus and Russia. Although Ghostwriter operates from Belarusian soil, its operations align with Russia’s strategic objectives.

Russian CNSAs, such as GRU-controlled groups, may have supported, trained, or even operated Ghostwriter. As a result, Ghostwriter is used to support the goals of both the Belarusian and Russian regimes. For example, Ghostwriter has targeted Alexander Lukashenko’s opposition, hacked news websites and spread disinformation about NATO in Poland and Lithuania, supported Russia’s military operations, and even targeted Ukrainian refugees. This wide range of targets illustrates the shared and complex agency exercised over the group by both states. While the dual use of state-controlled hacking groups has been observed only between Russia and Belarus, it sets a troubling precedent. Similar cooperation between Russia and other Kremlin allies, such as Iran or North Korea, is not evident at present, but cannot be ruled out entirely in the future.

Hacktivists

Modern-day hacktivism differs markedly from its early ideals. What began as a decentralised community of ethical hackers genuinely seeking to protect information freedom has evolved into a more centralised movement aligned with state objectives, often weaponised in state cyber operations (see Table A2).

The current wave of hacktivists is more sophisticated, politically aligned, and state-tolerated - or even state-linked - than earlier generations. Pro-Russian hacktivism is now increasingly intertwined with cybercriminal activity, which is changing the nature of the attacks from politically to financially motivated, and making the overall pro-Russian cyber ecosystem ever more complicated.

Russia has been at the forefront of this “hybridisation of hacktivism” since its campaigns against Estonia in 2007 and Georgia in 2008. Early on, these campaigns revealed that hacktivists play an essential part in Russia’s hybrid and conventional military operations and that pro-Russian hacktivists are often linked to RIS.

These trends deepened significantly after Russia’s full-scale invasion of Ukraine, during which hacktivists became a key pillar of Russia’s cyber power. By the summer of 2023, an estimated 72 pro-Russian CNSAs were involved in the war, the majority of which were hacktivist collectives. Mounting evidence also suggests that at least some of the hacktivist groups targeting Ukraine and its allies, such as the Cyber Army of Russia Reborn (CARR), are linked to GRU-controlled groups APT28 and Sandworm, emphasising the intermediary role of state-controlled hacking groups.

The war in Gaza has also served as a catalyst for the recent surge in state-backed hacktivism. Many pro-Palestinian hacktivists, allegedly backed by Iran, have emerged and established links with pro-Russian groups, further destabilising the cyber domain. This trend is illustrated by the appearance of new alliances, such as CARR’s High Society and the Cyber Islamic Resistance’s Holy League.

This growing collaboration between ideologically diverse hacktivist groups may indicate a shift in how hostile states such as Russia and Iran coordinate their operations against a common target (see Figure 2).

▲ FIGURE 2. Emerging hacktivist alliances

At the same time, hacktivists have rapidly advanced their capabilities and modus operandi. While their attacks were initially confined to DDoS attacks against countries supporting Ukraine, some groups have since acquired the means to launch destructive cyberattacks targeting water and energy infrastructure. Others have developed cyberespionage capabilities or hijacked satellite television broadcasting to support Russia’s information operations. Some hacktivists have become a propaganda staple in Russia, often interviewed by Russian media and spreading pro-Russian narratives to the public.

The increased state reliance on hacktivists is justified by their ability to provide greater deniability and legitimacy than state-controlled groups. First, they are used to suggest that the attacks are conducted by ideologically motivated individuals without any state links or backing. Second, the notion of an independent community supporting the state’s strategic objectives is ideal for projecting its image as a global cyber power with international support. This is particularly true of pro-Russian hacktivists, who often publicly exaggerate the effectiveness and scope of their attacks.

Hacktivism is no longer just a side phenomenon – it has become integral to modern cyber threats and is actively exploited by hostile states. As these groups become more powerful and acquire more destructive capabilities, the risk of unintended escalation will likely increase, as state backers risk losing control over the groups they empower.

Cybercriminals

The Russian cybercriminal scene has long been highly active and prominent. This is mainly due to the strong technical education system, a legacy of the Soviet Union, and to the collapse of state funding for research and universities in the 1990s, which, together with the rapid and unregulated development of Russia’s internet segment, created ideal conditions for cybercriminals to thrive.

These groups have developed impressive destructive capabilities, as demonstrated by the 2021 attacks on the US Colonial Pipeline and Brazil’s meat processing company JBS. Both attacks were carried out by Russian-speaking cybercriminal groups DarkSide and REvil, and resulted in significant fuel shortages and disruptions to the meat supply chains in the US. Their prominence is likely growing, as recent research shows that 69% of global ransomware proceeds are linked to Russian-speaking groups.

In the 1990s and 2000s, the RIS actively exploited the newly established cybercriminal “talent pool”, recruiting hackers either through direct employment or by blackmailing them into working for the Kremlin. This was particularly true of the FSB, whose 18th Centre is formally tasked with countering cybercrime. As a result, the FSB cemented itself as the service with the most extensive links to the cybercriminal underworld (see Case Study 4).

CASE STUDY 4: Intricate ties between the FSB and cybercriminals

The complex relationship between cybercriminals and the RIS is exemplified by Dmitry Dokuchaev, a former hacker hired by the FSB’s 18th Centre. In 2014, the US accused Dokuchaev of hacking Yahoo, an operation conducted using outsourced cybercriminals. Despite his role in the FSB, he was charged with treason in 2016, after being accused of passing classified information to the CIA. Dokuchaev was believed to have recruited the hacktivist collective Shaltai Boltai without FSB authorisation. This may have led to friction between Dokuchaev and other FSB branches and his eventual downfall.

While relations between Russia and cyber-criminals have historically remained informal, these ties now appear increasingly “direct and explicit”. Both Microsoft and Google have observed an increasing overlap between Russia’s objectives and cybercriminal activity, with Google noting that “Russia has drawn on criminal capabilities to fuel the cyber support for its war in Ukraine”. Similarly, the Insikt Group has concluded that cybercriminals and the RIS have a “tacit understanding” and that their relationships are “established and systematic”.

The Kremlin places high value on the services that cybercriminals can provide to the Russian state. These services extend beyond offering additional, deniable destructive cyber power to include expertise in illicit financing schemes, which the regime needs to circumvent sanctions (the role of cybercriminals is discussed in more detail in the chapter on EFNSAs).

Their value in the eyes of the regime is best exemplified by recent prisoner exchanges involving several notorious cybercriminals. During a 2024 prisoner exchange between Russia and the West, Moscow secured the release of two prominent cybercriminals, Roman Seleznev and Vladyslav Klyushin. Seleznev was a hacker with close ties to the regime, while Klyushin was an IT company executive with links to the state. Another cybercriminal, Aleksander Vinnik, was released in 2025, and Russian authorities also facilitated the extraction of cybercriminal Oleg Nefedov after his detention in Armenia.

Cyber enablers

Various CNSAs are used to support the previously discussed state-controlled hacking groups by developing custom cyber tools or providing information essential for conducting cyber operations.

Russia’s cyber programme relies heavily on private IT companies. These firms do not carry out cyberattacks directly but assist state hackers through software development. Examples include companies such as NTC Vulkan, which, according to leaked internal documents, has developed tools for the GRU-controlled Sandworm group. Similarly, leaked documents from IT company SyTech exposed its links to the FSB. The US Treasury Department has also acknowledged the close relationship between the RIS and IT developers by sanctioning at least six Russian companies. The FSB has a particular advantage in establishing relations with the private IT sector, as it is responsible for issuing information security certificates and can therefore exert additional influence over private entities.

In addition to software development, some companies are also used to recruit talented individuals. For example, Positive Technologies hosts hacker competitions such as Hacker Days and The Standoff, which the RIS can use to identify and approach young hackers for recruitment into state-controlled groups.

Some foreign companies have also been contracted to support Russia’s cyber programme. For example, the Scientific Research Institute Kvant, known for its ties to the FSB’s 16th Centre, contracted Milan-based company Hacking Team to purchase software capable of remotely accessing cell phones and computers.

Most research centres in Russia also maintain ties to the RIS. Some act as intermediaries between the RIS and private IT companies, while others have re-established themselves as private entities. Many of these research centres date back to the Soviet era or even earlier, when they established strong ties to the KGB or the Russian military. In many cases, these links remain intact. A clear example of these historical ties is the Central Scientific Research Institute of Chemistry and Mechanics, established at the end of the 19th century to support Russia’s military-industrial complex even before the 1917 Bolshevik Revolution. It continues to operate today, developing custom cyber tools for Russian hackers.

▲ FIGURE 3. Selected FSB-linked research facilities and IT companies

Propaganda and disinformation NSAs

Eginhards Volāns

Key takeaways

• Propaganda and disinformation non-state actors (PDNSAs) form the backbone of the Kremlin’s influence over domestic and foreign audiences, as they are cost-effective and can achieve a high impact without direct confrontation.

• While traditional media remains important for reaching the domestic population, social media, influencers, and other unconventional actors are increasingly used to advance Russia’s goals abroad.

• Since 2022, PDNSA activities have become increasingly outsourced and covert, mimicking genuine and legitimate actors, which makes them difficult to identify, track, and attribute to Russia.

• PDNSA operations are increasingly backed by various private-sector entities, such as PR agencies and IT companies, which are necessary for setting up the infrastructure and further blurring the lines between PDNSAs and the Russian regime.

Introduction

Since its invasion of Ukraine, Russia has significantly intensified its information confrontation with the West. The Kremlin has sought to undermine Western support for Ukraine and, more recently, to influence democratic processes in several Western countries. It has also worked to weaken Western interests in other regions, particularly in the so-called Global South. These trends have been acknowledged by experts and democratic leaders alike.

Russia’s reliance on propaganda and disinformation to exert influence and weaken adversaries is nothing new. During the Cold War, this practice was commonly referred to as “active measures” and was widely employed by the KGB. Modern-day Russia has largely adapted these Soviet-era tactics, enhancing them through recent technological advances.

Russia’s hostile activities in the information domain have evolved over time, becoming more professional, unified, and tightly controlled by the Kremlin - and therefore even harder to detect and counter (see Table 4). At the centre of these activities lie NSAs, whose ties to the Kremlin are often challenging to prove, enabling them to evade direct sanctions while claiming freedom of the press and exploiting other democratic values. As a result, greater clarity is required on this issue.

▲ TABLE 4. Institutionalisation of Russian propaganda and disinformation

While most NSAs wield some form of media power - particularly those discussed in the chapter on “Social and political NSAs”, this chapter focuses on those that are primarily active in the information domain, collectively referred to as PDNSAs. They take various forms, ranging from lone influencers to coordinated troll factories, from fringe media projects to state-of-the-art media conglomerates. Their connections to the Russian state range from informal and blurred to almost directly state-controlled, all while presenting themselves as impartial and independent.

This chapter defines several distinct sub-categories of PDNSAs and clarifies the blurred lines between them and the Russian state, highlighting their roles, characteristics, and value to the Kremlin.

Traditional media

Traditional media – including television, radio, print, and even books – have been the primary instruments for controlling narratives within Russia for decades. Although formally independent, these outlets are often managed by conglomerates loyal to the Kremlin and either rely on state funding or have strong ownership ties to the government. For instance, NMG, one of Russia’s largest media companies, is de facto controlled by Yuri Kovalchuk, a close associate of Putin.

Today, almost all Russian traditional media outlets act as appendages of the Russian state. Russia’s 2025 budget plans include record-high weekly spending of approximately 2.6 billion roubles on propaganda, demonstrating the importance placed on this tool. Despite their declining popularity, most of the spending is dedicated to Russia’s TV channels, which remain central to the regime’s propaganda ecosystem.

TV has also proved to be an effective means of reaching Russia’s compatriots abroad. This poses a significant threat to countries with large Russian communities, particularly the Baltic states. For instance, a 2018 study found that in Latvia, where 23.4% of the population are ethnic Russians, around 82% of non-ethnic Latvians watched Russian TV daily. In addition, some channels, such as Perviy Baltiyskiy Kanal, have been explicitly designed to influence Russian-speaking audiences abroad.

Although Russian TV is now blocked in the Baltics, it has adapted and found covert ways to continue influencing audiences, essentially becoming even harder to detect, track and counter. For instance, Latvian journalists have reported that Russian TV content remains accessible via YouTube and various mobile apps and continues to attract local viewers.

The RT network is an essential tool for global influence, capable of reaching audiences beyond the Russian diaspora. Although formally managed by an “autonomous non-profit organisation” (NPO), RT is entirely funded and controlled by the Russian government. RT has significantly expanded its operations post-2022 and is known to operate bot networks and hundreds of covert websites. Moreover, the US Department of State notes that RT has developed cyber capabilities and is engaged in military procurement activities, making it a highly versatile asset for the Russian regime.

Russian traditional media increasingly targets audiences in the Global South as well. Projects such as TV BRICS are aimed at establishing networks between journalists, training new journalists and spreading pro-Kremlin narratives worldwide. Additionally, media outlets such as Venezuela’s TeleSur work closely with RT to amplify and legitimise narratives in Latin America.

The international influence of the Russian press and radio is limited, although exceptions exist in countries with Russian communities. For example, the New York-based World Association of Russian Press supervises the development of Russian-language newspapers in around 80 countries. Additionally, Russia has used Radio Sputnik to disseminate propaganda to international audiences through independent stations in the West. In Latvia, for instance, Sputnik shows were aired daily on the local Avto Radio, owned by a local pro-Kremlin politician. Similarly, Sputnik continued to reach US audiences through Missouri stations even after 2022.

Digital media

Russia increasingly relies on proxy websites that masquerade as independent outlets, while social media platforms are often manipulated or coerced to amplify pro-Russian messages.

State entities, such as the RIS, along with NPOs, think tanks and PR agencies, play a key role in creating and managing various digital media projects. For instance, the GRU operates the Institute of the Russian Diaspora, which manages proxy websites such as InfoRos, an effort that has led to the creation of approximately 1,300 other Russian-language websites alone. Meanwhile, the SVR is known to operate the Strategic Culture Foundation and to use its front organisation, Myrotvorets, to carry out other covert operations in Europe, while the FSB orchestrates websites such as NewsFront and SouthFront.

Russian propaganda has also been advanced by entire social media platforms. Odnoklassniki and VK, both under direct Kremlin influence, promote Russian propaganda while censoring criticism of the Kremlin. As a result, countries with large Russian-speaking user bases, such as the Baltic states, have restricted access to these platforms.

Concerns have likewise been raised about Russia’s influence over Telegram, which has gradually evolved into a hub for Russian propaganda. Russia has used Telegram to target Ukraine, Moldova and Georgia, among others. While there is no solid evidence of direct ties to the Kremlin, the platform’s owner, Pavel Durov, frequently visits Russia and maintains business associations with individuals linked to the RIS, suggesting potential cooperation with the Russian government.

CASE STUDY 5: Telegram

Telegram was launched in 2013 by the Durov brothers after they were forced to sell their previous project, the immensely popular social network VKontakte, to pro-Kremlin oligarch Alisher Usmanov. The app quickly gained popularity and was seen by the Russian population as one of the last spaces free from the regime’s censorship.

In 2017, the Russian government targeted Telegram to gain access to its encryption keys. Telegram’s refusal to cooperate led to the app being banned in Russia in 2018. However, the ban was effectively unenforceable, as Russia lacked the technology to block access at that time.

By 2020, the Russian regime had de facto lifted the ban and altered its strategy to exploit the platform instead. Russian politicians, state institutions, and media outlets became active users of Telegram, and covert propaganda networks were created. During the COVID-19 pandemic, Telegram’s popularity expanded outside Russia, particularly within conspiracy theory communities. Following Russia’s invasion of Ukraine, Telegram became one of the main hubs for Russian propaganda.

Influencers

The Kremlin relies heavily on traditional opinion leaders, including journalists, political scientists and historians, to lend legitimacy to its narratives. Some are explicitly tasked with influencing foreign audiences in post-Soviet countries, where the Presidential Administration (PA) has developed networks of professional influencers. Under the guidance of the RIS, these figures are used to organise protests, establish pro-Russian organisations, and engage in media manipulation. Leaked emails from Kremlin ideologue Vladislav Surkov explicitly highlight the significance of influencers, indicating that maintaining such networks is central to Russia’s foreign interference efforts.

Beyond the post-Soviet space, international audiences are also being targeted. British national Graham Phillips and Australian Simeon Boikov exemplify Russia’s use of foreign nationals to whitewash its military aggression against Ukraine. Western nationals working for the Kremlin often have personal or ideological ties to Russia, motivating them to spread Kremlin propaganda. For instance, Boikov’s parents are ethnic Russians, while Phillips was exposed to pro-Russian views while living in Eastern Ukraine.

A broader strategy can be identified in Russia’s reliance on local networks to legitimise pro-Russian narratives and shape public opinion abroad. This includes funding popular American right-wing influencers through Tenet Media, and hiring South African influencers through a local influencer marketplace to spread anti-Zelenskyy messages.

Influencers participating in the Kremlin’s operations are often contracted through regime-linked advertising companies such as AdNow, which manipulated bloggers to spread disinformation during the COVID-19 pandemic and was involved in interference in the 2024 Romanian presidential election.

Since 2022, Russia has increasingly relied on military bloggers (voenkory) to shape narratives about the war. These figures have gained significant prominence within Russia - meeting with Putin and receiving medals for their service. Some, such as Mikhail Zvynchuk, founder of the Rybar blog, have also sought to influence foreign audiences, including conducting operations against the US and organising media training courses for Balkan bloggers in Republika Srpska.

Culture and arts actors

Culture and the arts have been used to engage and entertain audiences under the semblance of being apolitical. This grants the Kremlin additional deniability and is crucial for targeting those not predisposed to support Russia’s agenda. As with digital media, links to the Kremlin are indirect and often obscured through various intermediaries such as foundations and NPOs.

Musicians, actors and even poets are frequently employed as propaganda tools by the Kremlin. The late Iosif Kobzon served as a key voice in the occupied Donbas region, while patriotic singer Shaman has become a symbol of Russia’s invasion of Ukraine. This has led some countries, especially the Baltic states, to impose entry bans on Russian musicians, whom they rightly view as the Kremlin’s pawns. Moreover, evidence from Moldova’s 2024 election interference suggests that Russia is also willing to hire foreign musicians to spread anti-Western messages.

In a sense, every aspect of modern-day Russian culture has become heavily securitised. Russian theatre has come under pressure to promote pro-war messages, and a new military-patriotic theatre is even planned in Moscow. The war has also given rise to a distinctive cultural phenomenon of pro-war poets and a significant increase in pro-war cinema.

CASE STUDY 6: The Social Design Agency

The operations of the SDA are extensive, and the company is likely one of the most significant and highly capable entities in the Kremlin’s PDNSA toolkit. To this end, it:

• Operates a vast network of proxy websites that often replicate and imitate legitimate Western sources.

• Produces original content, including news articles and memes.

• Employs influencers and journalists to promote Kremlin narratives worldwide.

• Runs bot farms to propagate its content online.

• Utilises modern technologies, such as AI and deepfakes, to enhance operations.

• Monitors and evaluates the effectiveness of its operations.

Propaganda and disinformation enablers

Various enablers, such as think tanks, PR agencies, NPOs, and IT companies, support the operations of PDNSAs. While not all of them can be classified as PDNSAs themselves, they play a vital role behind the scenes. In most cases, they are financially motivated to work for the regime and often maintain informal ties with high-ranking Kremlin figures.

PR agencies have become key enablers of Russia’s information confrontation and are directly curated by the Presidential Administration. They frequently collaborate with other private entities, such as IT companies, to build the digital infrastructure required for proxy websites. The Social Design Agency (SDA), referred to in leaked documents as Russia’s “centre for psychological warfare”, is among the most prominent companies serving the Kremlin. It is responsible for several well-documented operations, including Doppelganger, Undercut, and Matryoshka. Along with its affiliated IT company, Struktura, it is led by Ilya Gambashidze, a political technologist with close ties to the Russian government.

The SDA’s operations have proved highly effective in reaching global audiences and convincingly imitating authentic online behaviour and opinion. For instance, content produced by the SDA has reportedly been shared by many authentic Western internet users, including prominent figures such as Elon Musk and Donald Trump Jr.

IT companies such as TNSecurity, DPKGSoft International, and Netshield play a crucial role in supporting these operations. Some, like Aeza, are registered in Russia, while others are based in the West. In some cases, these companies are registered by individuals from post-Soviet countries with no direct connections to Russia, making them difficult to trace and dismantle.

Approximately 15 different NPOs are reportedly involved in orchestrating and funding Russian propaganda since 2022. Dialog is the primary NPO involved in orchestrating the activities of the aforementioned PR agencies. Along with the Expert Institute for Social Research, Dialog develops the ideological frameworks for Putin’s regime. Since 2022, both entities have been heavily engaged in Russia’s information confrontation with the West. The Presidential Foundation for Cultural Initiatives has also been used to fund artists who promote a favourable image of Russia’s war in Ukraine.

Think tanks, while categorised primarily as SPNSAs, are also known to act as intermediaries for PDNSAs under the guidance of the RIS. For instance, the Russian Institute for Strategic Studies (RISI) has been described by Western analysts as SVR’s “PR arm” and was allegedly involved in interference in the 2016 US presidential election. In turn, the GRU is linked to the Centre for Geopolitical Expertise, led by Kremlin ideologue Aleksandr Dugin, which is used to manage parts of the remnants of the notorious Internet Research Agency.

Social and political NSAs

Andis Kudors and Agata Kleczkowska

Key takeaways

• Russia employs a wide range of social and political non-state actors (SPNSAs) to manipulate, influence, and fragment foreign societies and their decision-making processes.

• Most of these actors project sharp power under the guise of cultural diplomacy and thrive on exploiting democratic values and principles.

• Russia is also using these NSAs to shape legislative processes abroad in ways favourable to the Kremlin.

• Many of these NSAs originate outside Russia, maintaining ambiguous, indirect, or limited ties to the Kremlin, which makes attribution and response by targeted states a highly sensitive and complicated matter.

Introduction

Russia’s democratic transition began to slow sharply at the end of Putin’s first presidential term and came to a halt during his second. During this period, significant changes were implemented in Russian foreign policy, and the use of SPNSAs expanded in order to pursue two major goals:

• Reducing US influence in international politics, emphasising the need for a multipolar world order; and

• Establishing Russia as one of these poles of global power, positioned to control the former Soviet republics.

To achieve these goals, the Kremlin planned to use soft power instruments, which may be more accurately described as sharp power: a set of methods and actors designed to perforate and shatter the information space and political environment of democratic states. The Kremlin sought to build a new normative basis for an international order rooted not in common rules and norms, but in brute force.

A wide variety of SPNSAs have been employed to promote such narratives, both within Russia and abroad, including NGOs, think tanks, compatriots living abroad, and religious organisations. These actors have been used both to advance Russian foreign policy and achieve specific goals, and to weaken democracies in the long term.

Reliance on SPNSAs provides certain advantages compared to state institutions in that they usually have greater public legitimacy and effectiveness. Legitimacy in this context refers to public support for SPNSAs such as NGOs, which are perceived as being free from subordination to a political regime. Effectiveness in the context of SPNSAs refers to the ability of NSAs to adapt swiftly to a new environment and new “rules of the game”, to make quick decisions, and to influence processes with relatively few resources.

This chapter examines the types of SPNSAs employed by Russia, as well as their operational methods. It also analyses the activities of specific actors supporting the Russian authorities. While this analysis is not intended to be a comprehensive study of the entire field of SPNSAs, it aims to provide insights into the most significant and typical cases in the field, which may arouse readers’ interest in conducting further in-depth and expanded research.

Think tanks

The Kremlin has sought ways to challenge the principles of international law and human rights in order to reduce or rebuff criticism of its own domestic disrespect for human rights. Russia has attempted to undermine the notion of the universality of democratic and human rights norms through organisations such as the Russian Institute for Democracy and Cooperation (IDC), which was founded in 2007 with this objective in mind.

Several other think tanks have been established for different purposes and audiences. For example, the Russian International Affairs Council was set up to engage foreign policy experts and encourage them to support Russia’s goals. The council has close ties to the state, as it is chaired by former Minister of Foreign Affairs Igor Ivanov, and Putin’s press secretary Dmitry Peskov sits on its presidium.

Another think tank controlled by the Russian government is RISI, which until 2009 operated under the SVR. Since then, it has been formally subordinated to the Kremlin and consistently headed by former high-ranking SVR officers, including Mikhail Fradkov and Leonid Reshetnikov.

Additionally, the Institute for CIS Countries, Diaspora and Integration (CIS Institute) was established in 1996 but expanded its activities under Putin, with the aim of conducting research on sociopolitical processes in the “near abroad” and providing legal, political and cultural support for compatriots living abroad. The CIS Institute is headed by State Duma member Konstantin Zatulin. According to the Estonian Foreign Intelligence Service (EFIS), the CIS Institute has long been closely associated with the FSB, specifically the 5th Service, which played an important role in advising Russian foreign policy decision-makers before Russia’s full-scale invasion of Ukraine.

Compatriot organisations

Numerous NGOs are involved in implementing Russia’s policy towards Russians living abroad, whose hearts and minds Moscow seeks to win. These organisations focus on three main areas:

• The protection of human rights;

• The popularisation of the Russian language, culture and Orthodoxy;

• The falsification of the history of Russia and its neighbouring countries.

One of the most important entities dealing with compatriot issues abroad is the Foundation for the Support and Protection of the Rights of Compatriots Living Abroad (Pravfond), established in 2012. Its stated mission is to defend Russian compatriot activists by providing legal assistance. Since its establishment, the foundation has financed the activities of Kremlin influence agents and paid for lawyers when legal problems arise. Several of these individuals are currently on trial for aiding Russia and inciting hatred. The person responsible for the Baltic states at Pravfond, Vladimir Pozdorovkin, was identified by the Estonian Internal Security Service (KAPO) as an SVR officer.

Pravfond has been particularly active in countries with large Russian populations, such as Latvia, where the largest recipients of funds were the Legal Protection Centre (TAC) and the Latvian Human Rights Committee (LCK). Both TAC and LCK reportedly received a total of 718,000 euros over a ten-year period to cover the legal expenses of Russian influence agents.

Pravfond also provided financial assistance to the European Russian Alliance (ERA), created by LCK’s leader Tatjana Ždanoka and registered in France in 2014. ERA’s stated goal was to support Russia’s foreign policy objectives within the EU.

Sharp power organisations

Sharp power organisations differ from compatriot organisations in that they seek to influence a much broader global audience through cultural diplomacy, although their activities may overlap.

In Russia’s case, cultural diplomacy frequently functions as an instrument of sharp power and hybrid threats, emanating from several organisations closely aligned with the state. One such entity promoting Russian culture and language abroad is the Russkiy Mir Foundation (RMF), established in 2007. The foundation’s name draws on the concept of the so-called “Russian world” (Russkiy mir), which envisions the unification of Russians and Russian-speaking non-Russians in a cross-border formation. Vyacheslav Nikonov, a political scientist with close ties to the Russian government, was appointed executive director of the foundation. The RMF actively cooperates with and distributes financial support to various NGOs, particularly in countries with a large proportion of Russian speakers, with the aim of promoting the Russian language and Russia’s historical interpretation.

Another important entity is the Alexander Gorchakov Public Diplomacy Foundation, established in 2010. It is chaired by Foreign Minister Sergei Lavrov, and its board of directors includes the US-sanctioned oligarch Alisher Usmanov and the head of the Rossotrudnichestvo agency, Yevgeny Primakov Jr. In 2022, the EU imposed sanctions on the foundation, stating that it actively supports the Russian government responsible for the annexation of Crimea and the destabilisation of Ukraine. Ukraine had already closed the foundation’s office in Kyiv in 2015 for spreading anti-government propaganda.

CASE STUDY 7: Falsification of history in the Baltic states

Russian NGOs promote 9 May as Victory Day in the Baltic states, ignoring the fact that Latvians, Estonians and Lithuanians celebrate the end of World War II on 8 May alongside the rest of Europe, while 9 May is associated with the second Soviet occupation. Russian historical propagandists exacerbate the cultural trauma experienced by the Baltics that resulted from the Soviet occupation, when tens of thousands of Latvians, Lithuanians and Estonians were deported to Siberia because of their ethnic and social origin.

This messaging is often channelled through local organisations. One such NGO in Latvia is the 9 May Organisation, which has received financial support from Russia and has pledged to play an active role in organising the Victory Day celebrations in Riga and distributing St George’s ribbons in Russian minority schools. The ribbons have become a symbol of Russia’s occupation of Crimea and its aggression against Ukraine.

History-linked organisations

During Putin’s time in office, history has become increasingly politicised. In order to instrumentalise interpretations of the past that serve the goals of the Russian leadership, the Historical Memory Foundation (HMF) was founded in 2008. The HMF organises events such as discussions, conferences, and seminars, and publishes books and journals on various historical topics. Its director, Alexander Dyukov, who has been declared persona non grata by Latvia, is known for “cherry picking” documents from the FSB’s Central Archive to produce HMF publications. This practice illustrates the FSB’s interest in promulgating a biased interpretation of history to achieve the Kremlin’s goals.

Estonia in particular has suffered from destructive activities in the sphere of history politics. For instance, pro-Russian organisation Night Watch, established in 2007, played a central role in the violent protests against Tallinn’s decision to relocate a monument dedicated to Soviet soldiers who fell in World War II from the city centre to the Defence Forces Cemetery. During these riots, police detained around 1,200 people, another 50 were injured, and one person was killed. KAPO later reported that Russian-speaking extremist groups in Estonia, including Night Watch, sought to incite national hatred by exploiting differing interpretations of history.

The Russian Orthodox Church (ROC)

Religious organisations provide states with a platform to reach segments of society in target countries that secular actors are unable to reach. The ROC has been participating in Russia’s public diplomacy since 2003, when it concluded a cooperation agreement with the Ministry of Foreign Affairs (MFA).

Orthodoxy is heavily securitised in Russia, meaning that military and security institutions pay particular attention to the Moscow Patriarchate. The ROC has signed cooperation agreements with several state institutions, and Orthodox chapels have been installed in the Moscow office of the FSB as well as in Russian diplomatic missions abroad. Alignment between the ROC and the security apparatus can be seen in Case Study 8.

CASE STUDY 8: The role of the Russian Orthodoxy in justifying military aggression against Ukraine

Two weeks before the annexation of Crimea, Vsevolod Chaplin, head of the Synodal Department for Church and Public Relations of the Moscow Patriarchate, issued a statement indicating that the ROC had called on the Ukrainian side not to resist Russian military operations in Ukraine. This stance aligned with the primary task of Russia’s information confrontation: compelling the Kremlin’s adversaries to surrender. Moreover, it directly corresponded to the goals of official Russia in the occupation and subsequent annexation of Crimea. According to Moscow’s plan, the process was to unfold swiftly, with minimal casualties among Russian soldiers and little or no resistance from the Ukrainian side.

After the full-scale invasion of Ukraine, the Moscow Patriarchate became even more openly supportive of Russia’s aggression and promoted the sacralisation of the war. The idea of a holy war, formulated by the World Russian People’s Council under Patriarch Kirill, contributed to the demonisation of the enemy and the escalation of hostilities.

There is also evidence that Russia uses the ROC to influence socio-political processes in other Orthodox states. One example is the Serbian Orthodox Church (SOC), with around eight million members. As concluded by Professor Vesko Garčević, it is not only “more influential and powerful than any individual political figure”, but also serves as “an important node in a network spanning politics, traditional and social media, and academia” across Serbian communities. The SOC provides religious legitimacy to domestic and foreign state policies in Serbia, promotes Serbian nationalism, and supports nationalist and far-right groups and individuals who often advocate closer ties with Russia.

The SOC is “both a channel for Russian narratives, a tool employed by Russia to sow divisions, and a political actor in itself that supports pro-Russian politicians and Serb nationalism”. Although it is not subordinate to the Moscow Patriarchate, clear links exist between the two organisations. One tangible example of this is Russia’s financial contribution to the construction of Belgrade’s St Sava Cathedral. Of the estimated €100 million cost, €10 million allegedly came from Russia, including from the state-owned Gazprom.

The SOC is also highly influential and trusted in Montenegro. In fact, there are two competing Orthodox factions in the state: the Metropolitanate of Montenegro and the Littoral (which is part of the SOC) and the Montenegrin Orthodox Church (which is canonically unrecognised and has operated as an NGO). In December 2019, Montenegro’s parliament adopted the Law on Freedom of Religion, which demanded “broader state insight into the finances of religious communities”. The most controversial provisions concerned “the nationalisation of church property if the SOC cannot provide proof of ownership before 1918, when Montenegro became an integral part of the Kingdom of Serbs, Croats, and Slovenes”. The law drew criticism from the Russian government, the ROC, the Night Wolves, and the SOC, among others, reflecting the interlinked nature of these actors.

Political parties

Russia has cultivated relationships with certain political parties, parliamentarians and individual politicians in other countries. However, in the overwhelming majority of cases, descriptions of these links are based solely on media reports and lack confirmation from official sources.

Through such intermediaries, Russia gains the opportunity to influence national and EU legislation in line with its interests. Politicians associated with Russia, such as the aforementioned Tatjana Ždanoka, have voted against resolutions condemning Russia or supporting Ukraine in legislative bodies. The same politicians have served as observers during elections held in Russia and Crimea. Additionally, some political parties and their leaders have reportedly endorsed the conclusion of favourable investment treaties between their governments and Russia, including in the energy sector, as well as other cooperation agreements related to security and joint military exercises. In general, these actors often promote anti-Western, anti-EU, and anti-NATO rhetoric consistent with the Kremlin’s agenda, or call for closer alliances between their respective states and Russia.

Links between political parties and Russia vary significantly (see Table 5). On the one hand, some parties are allegedly financed by Russia, or Russia has reportedly invested in the regions where these parties operate through complicated schemes and offshore entities registered to Russian citizens with no apparent connection to the Kremlin.

▲ TABLE 5. Forms of cooperation between foreign political parties and Russia

Media sources have also claimed that certain party members have received donations from Russian oligarchs or other individuals linked to the Kremlin. Moreover, some political parties are alleged to have been “guided” and “supervised” by companies affiliated with the Russian government, while their members are said to have undergone training conducted by figures connected to the Kremlin. There are also accounts of meetings between certain politicians and high-ranking Russian officials, as well as visits to Moscow. Some party leaders have even been awarded prestigious Russian medals. Finally, there are several cases of cooperation agreements signed between political parties and Putin’s United Russia. In recent years, however, a number of parties, including Estonia’s Centre Party, Latvia’s Harmony, and Italy’s Lega, declared that such agreements were no longer valid or enforced.

The cases of Béla Kovács, former member of Hungary’s Jobbik party, and Tatjana Ždanoka, former leader of the Latvian Russian Union, are somewhat different and exemplify how Western politicians may be exploited more directly by the RIS (see Case Study 9).

CASE STUDY 9: Western politicians and Russian intelligence

In 2022, the Hungarian Supreme Judicial Council found Béla Kovács “guilty of the crimes of espionage and budget fraud against the institutions of the EU and of the misdemeanour of falsifying private documents”, sentencing him to five years in prison and a ten-year ban from public affairs (Baranya 2022). According to the Mandiner portal, the accusation centred on claims that, between 2012 and 2014, Kovács “provided information to Russian intelligence agencies on, among other things, energy matters, the European Parliament elections, the domestic political situation in Hungary, and the expansion of the Paks nuclear power plant” (Baranya 2022; Hungary Today 2022).

In the case of Tatjana Ždanoka, the Latvian State Security Service initiated criminal proceedings against her on suspicion of her “possible cooperation with Russia’s intelligence and security services”. Investigative journalists have claimed to possess definitive proof of Ždanoka’s collaboration with the FSB (State Security Service 2024).

Lobbyist organisations

This category includes various organisations that, despite their stated aims, work to persuade foreign states to influence legal processes or political discourse in line with Russian policies and rhetoric. A pivotal example is the Human Rights Accountability Global Initiative Foundation (HRAGIF), officially described as “an institution dedicated to making it possible for American families to adopt Russian children”. It was founded by the owner of a real estate investment company connected through family ties to the Russian government. The company was reportedly involved in a tax fraud uncovered by Sergei Magnitsky, a Russian tax lawyer and auditor. Magnitsky’s subsequent death in a Russian prison led to the adoption of the Sergei Magnitsky Rule of Law Accountability Act of 2012, followed by the Global Magnitsky Human Rights Accountability Act passed by the US Congress in 2016. The HRAGIF allegedly campaigned to persuade members of Congress to oppose the bill or at least remove Magnitsky’s name from its title. Despite these efforts, the Global Magnitsky Human Rights Accountability Act was successfully adopted in the US and later became a model for similar legislation worldwide.

Another example is the Canadian Justice for Victims of Corrupt Foreign Officials Act, adopted in October 2017. According to Dan Levin and Jo Becker of The New York Times, when Canadian lawmakers were still working on the Act, the Russian Congress of Canada (RCC) attempted to obstruct their efforts. Canadian Member of Parliament John McKay stated that the RCC coordinated its lobbying activities against the legislation with the Russian Embassy in Ottawa. The RCC allegedly “sent letters to members of parliament calling for Canada to withdraw its support for the Magnitsky legislation”. As in the US case, however, the organisation’s efforts were ultimately unsuccessful.

An additional example is the International Agency for Current Policy (IACP), which vaguely described itself as a “closed association of professionals” that aimed to “cooperate with leading EU parliamentary parties and individual politicians”. According to Tatiana Tkachenko and Martin Laine, the IACP lobbied European politicians to promote “pro-Russian motions (…) largely focused on legitimising Russia’s annexation of Crimea”. Allegedly, its leadership maintained close ties with senior Russian politicians, including one of Putin’s key advisers at the time.

In 2016, the IACP collaborated with a member of the Veneto regional parliament, which became the first region in an EU member state to adopt a resolution on lifting sanctions against Russia. In the same resolution, Veneto also urged Italy’s national government to abandon the EU’s common foreign policy and recognise Crimea as Russian territory. Regional parliaments in Liguria and Lombardy followed Veneto’s example, passing their own resolutions “recognising” Crimea as part of Russia.

The IACP was also active in Cyprus. According to investigative journalists, in 2016 the Agency began working on a resolution “On lifting sectoral economic sanctions against Russia”, intended for adoption by the House of Representatives of the Cypriot Parliament. The IACP’s associates exchanged correspondence, including a draft text, and the Cypriot Parliament subsequently adopted a nearly identical document. The resolution called on the government “to work towards lifting EU sanctions imposed on Russia over its involvement in the Ukraine conflict” and stated that the EU sanctions on Russia had proved “counterproductive and in no way helped to resolve the crisis in Ukraine”. According to the journalists’ investigation, “the documents also detail separate projects for Latvia, Greece, and even the Parliamentary Assembly of the Council of Europe”.

Reportedly, the IACP also organised visits to Crimea for various European politicians. For instance, nine politicians from Austria, Germany, Italy, the Czech Republic, and Poland allegedly attended the Yalta International Economic Forum and received honoraria for their participation in the event. The organisation also helped arrange visits by European observers to elections held in Russia and Crimea. Among them were politicians from the Czech Republic, Slovakia, the Netherlands, Belgium, France, Sweden, and Italy.

Another example is Voice of Europe, officially a media portal with roots in the Netherlands, created and funded by a Ukrainian oligarch allegedly closely linked to Putin. The outlet’s YouTube channel became a platform for some EU lawmakers, including members of far-right parties, to criticise EU policies. There is no suggestion that those appearing on the channel accepted payment. However, according to media reports confirmed by Polish, Czech and Belgian security services, as well as by the prime ministers of Belgium and Czechia, “certain MEPs and candidates in the upcoming European elections [in 2024] have received payment from the Russian government or its proxies to spread propaganda and disinformation and to influence the elections to the European Parliament in various European countries”. Voice of Europe was allegedly involved in these influence operations.

Economic and financial NSAs

Eliza Lockhart

Key takeaways

• The Russian state leverages a network of economic and financial non-state actors (EFNSAs) to generate revenue, maintain economic resilience under sanctions, and wield financial and political influence abroad.

• As Western sanctions have intensified, EFNSAs have been increasingly mobilised to absorb domestic fiscal shocks and support the Kremlin’s broader strategic posture.

• They are often owned and controlled by Russian oligarchs who serve as investors, facilitators and intermediaries for state-sanctioned activities in return for access to state contracts and protection.

• They often act as extensions of state policy, although the exact level of control exercised by the Kremlin can be challenging to determine.

Introduction

Russia’s full-scale invasion of Ukraine in 2022 marked a dramatic escalation in its confrontation with the West – not only on the battlefield, but also across the economic and financial domains. In response to unprecedented sanctions, Russia mobilised a diverse ecosystem of EFNSAs to protect its economy, sustain its military-industrial complex, and circumvent Western financial restrictions.

EFNSAs are individuals, companies, or networks that are not formally part of the Russian state apparatus but nonetheless blur the line between public and private by directly or indirectly advancing state geoeconomic interests and sustaining its financial systems. They include actors who facilitate sanctions evasion, safeguard elite wealth, and enable covert access to capital, goods, and technologies essential to Russia’s war effort and geopolitical ambitions.

Under Putin, this ecosystem has been consolidated and reoriented towards geopolitical objectives. State-aligned banks and companies have become instruments of statecraft, while oligarchs operate as intermediaries and enablers, deploying their corporate assets and international networks to serve the Kremlin’s interests with plausible deniability.

This presents a unique challenge to liberal democracies, as many of these actors operate within the framework of private enterprise and international commerce, giving them the appearance of legitimacy while quietly advancing Russian state goals. Their embeddedness in global markets makes them difficult to isolate or deter through traditional policy tools, complicating enforcement and creating systemic vulnerabilities in Western financial systems.

This chapter examines how EFNSAs align with state interests, while also illustrating how this alignment does not always indicate direct Kremlin control, as EFNSAs often pursue actions that serve both their own interests and those of the state. It then briefly explores how several NSAs profiled in prior chapters - professional enablers, PMCs, TCNs and cybercriminals - also perform key economic and financial functions in support of the Russian state. Together, these actors form a decentralised but coordinated architecture of sanctions resistance that challenges conventional approaches to economic warfare and national security.

Oligarchs

A relatively small group of wealthy business tycoons, known as oligarchs, have played a significant role in shaping the Russian economy in the post-Soviet era. Described as “the engine of Russia’s economic recovery and institutional reform”, oligarchs own or control many of Russia’s largest corporations that are vital to state revenue, employment and strategic infrastructure. Their investment decisions, export activities and access to international capital have historically shaped the country’s economic trajectory. However, oligarchs have also become synonymous with corruption due to their monopolistic control over key sectors and their exploitation of state resources for personal gain. For an explanation of how they rose to power, see Table A3.

During the Yeltsin presidency - a period marked by sweeping privatisation and deregulation - oligarchs were able to wield their economic power with relative independence. However, President Putin has sought to institutionalise the relationship between state and business. Under Putin, oligarchs are expected to “act as custodians of Russian national wealth and, when required, as arms of the state”. As economist William Tompson commented, “Far from being the state’s master, Russian private capital was to be its servant”.

Putin keeps a tight leash on oligarchs’ financial dealings, with almost any transaction over a certain threshold apparently requiring his approval. A senior Western banker told journalist Catherine Belton in 2017 of his surprise that Putin became involved in a “mere” $20 million deal involving a businessman who wanted to sell up and leave Russia - the sale was denied. Moreover, Putin has responded to any political criticism voiced by oligarchs with severe reprisals.

Prior to Russia’s full-scale invasion of Ukraine, oligarchs were key instruments of Russian influence abroad – leveraging their wealth, international business networks and elite access to shape political and economic environments in Western countries. Many invested heavily in real estate, media, and strategic industries around the world, and maintained close relationships with foreign policymakers, especially in Europe.

However, since Russia’s 2014 annexation of Crimea and the 2022 full-scale invasion of Ukraine, many Russian oligarchs have been personally sanctioned by the US, EU and UK, meaning they are subject to travel restrictions and their overseas assets have been frozen. As a result, they can no longer effectively serve as informal ambassadors or economic agents of the state.

In response, the Kremlin appears to have reoriented the role of oligarchs inwards – from instruments of sharp power on the global stage to pillars of the domestic financial system. This shift was starkly illustrated when Putin summoned over 40 oligarchs to a meeting at the Grand Kremlin Palace on the day he ordered the invasion of Ukraine. The purpose of the meeting was ostensibly for Putin to explain his reasons for the invasion, but the implicit message was clear: oligarchs must use their wealth and influence to support the war effort, and dissent from this course of action would not be tolerated.

Since February 2022, Russian oligarchs have been expected to support domestic economic stability and wartime resilience. This includes funding infrastructure and military-linked projects, absorbing economic shocks through targeted investments, and maintaining employment in key sectors. In return, they are granted continued access to state contracts, many in the defence sector. This has proved profitable, with the combined wealth of Russia’s oligarchs reaching US$625.5 billion in 2025, surpassing the previous 2021 record of US$606.2 billion.

However, these economic benefits are conditional on an oligarch’s loyalty to the Kremlin. As one senior Russian state banker told the Financial Times in March 2022, “being on the U.S. sanctions list used to be a status symbol of patriotism. But now it’s a requirement. If you’re not on it, it’s suspicious”. A few oligarchs have spoken out against the war, but they are generally individuals who have cut ties with Russia. For Russia-based oligarchs, the penalty for stepping out of line is, at the very least, prosecution, imprisonment and asset forfeiture, if not death.

State-aligned corporations

Under Putin, many large Russian companies have been integrated into the state apparatus, whether through formal ownership structures, patronage-based appointments, or the implicit expectation that the private sector will act in alignment with state policy. These corporations play a central role in laundering state funds, circumventing sanctions and projecting influence abroad to advance both state and commercial interests. There are three main sub-categories of corporate EFNSAs: state-aligned banks, major companies in strategic sectors, and importers of dual-use or sanctioned goods.

Since the full-scale invasion of Ukraine in 2022, the alignment between these corporations and state priorities has become even more explicit. As Western sanctions have intensified, many of these entities have been repurposed to sustain Russia’s war economy. Just as oligarchs have been reoriented towards the Kremlin’s domestic financial agenda and distanced from their previous role as international powerbrokers, so too have Russian corporations been mobilised by the state to uphold internal economic stability, finance military efforts and maintain strategic trade flows.

▲ TABLE 6. Hierarchy of the Russian banking industry

• A. Banks

Prior to the 1990s, the state had full control over the Russian banking industry, yet following the collapse of the Soviet Union, the banking sector underwent rapid decentralisation. By the end of 1996, 75% of Russian banks had been privatised. Since Putin came to power in 2000, the Kremlin has steadily worked to reassert state control over the financial sector. Under Putin’s leadership the Russian banking industry has, in many respects, come full circle, with most banks once again consolidated under state ownership.

Today, the Russian banking industry is structured into three tiers: the Central Bank of Russia (CBR), state-controlled banks, and small private banks.

Small private banks best illustrate how Russia’s use of commercial entities as EFNSAs is often decentralised and contradictory. A well-publicised example was the 2014 multimillion-euro loan issued by FCRB to the National Front, a French far-right political party. As a private bank, FCRB offered plausible deniability to both the Russian officials and European Members of Parliament involved. Shortly before the bank failed, the loan was briefly transferred to a shell company and then to an aviation firm with ties to the Kremlin. Interestingly, this information only came to light because the Russian government agency responsible for insuring bank deposits sued the former FCRB bank manager, leading to a public court case. The fact that Russian officials facilitated the covert loan, yet the actions of other state agencies resulted in its exposure, highlights a key paradox: while Kremlin influence over EFNSAs is wide-reaching, it is not always centralised, coherent or clearly attributable.

• B. Major companies in strategic sectors

Russian corporations in the energy, mining, defence and infrastructure sectors form the foundation of Russia’s revenue base and geopolitical influence. While some of these entities are formally listed as private or semi-private companies, many are majority-owned by the Kremlin and chaired by oligarchs. These companies often enjoy preferential regulatory treatment, subsidised access to capital from state-controlled banks, and protection from foreign competition. In return, they are expected to fulfil key roles in economic policy implementation and geopolitical influence.

Prior to 2022, these companies wielded significant power across Europe, generating substantial revenue from exports and serving as vehicles for Russian influence. Oil and gas firms in particular have a long history of establishing subsidiaries in Central and Eastern European countries that undermine the host nation’s energy companies, while also providing a channel for illicit payments to local officials, thus entrenching Russian influence and creating a loyal circle of elites. There are documented examples of such “gas intermediaries” making donations to pro-Russian politicians and political parties in Serbia, Croatia, Ukraine and the Czech Republic.

Gazprom, Russia’s state-owned energy giant and the world’s largest extractor of natural gas, exemplifies how the Kremlin uses EFNSAs to advance its geopolitical agenda under the guise of commercial activity (see Case Study 10).

CASE STUDY 10: Gazprom’s activities

While formally structured as a joint-stock company, Gazprom operates as an extension of the Russian state, with its leadership drawn largely from the ranks of former government officials. Its network of natural gas pipelines has enabled Russia to exercise leverage over foreign governments by manipulating energy flows.

The Nord Stream projects, for example, were not merely commercial ventures but strategic infrastructure designed to deepen European energy dependence on Russia while bypassing - and thus financially weakening - transit countries such as Ukraine.

Moreover, the Gazprom corporate empire is so powerful that it can function as multiple categories of NSAs simultaneously. It acts as a propaganda actor through its media holding company, Gazprom Media; as a social actor through its sporting sponsorships; and potentially even as an armed actor through its alleged affiliations with PMCs.

Since the annexation of Crimea in 2014 and, to a greater extent, the full-scale invasion of Ukraine in 2022, Russian firms have been forced to take on greater domestic economic stabilisation functions. As Western financial sanctions have increasingly targeted state-linked corporations and their leadership, companies in strategic sectors have pivoted towards alternative markets, such as China, India, Türkiye, and the Middle East. Gazprom again provides a clear example of this transition. Once the supplier of 40% of Europe’s imported natural gas, Gazprom’s market share shrank to just 9% after the invasion, and the Kremlin barred it from paying dividends for 2023 after the company suffered its first annual loss since 1999. Yet in 2024, Gazprom rebounded with a net profit of 1.2 trillion roubles, driven by increased exports to China, currency stabilisation and higher interest income. Structural vulnerabilities persist, including the loss of key pipeline routes, but Gazprom’s trajectory illustrates how corporate EFNSAs have been repurposed to support Russia’s economic resilience in the face of unprecedented Western sanctions.

• C. Importers of dual-use goods

Despite Putin’s 2023 pledge to make Russia a “self-sufficient state”, the Kremlin remains unable to sustain its military-industrial complex entirely through domestic production. As Western sanctions have deepened, Russia has increasingly come to rely on an ecosystem of importers, front companies, and logistical intermediaries to obtain critical “dual-use goods” - items with both civilian and military applications, including semiconductors, microchips and drone components. These networks form the backbone of Russia’s efforts to maintain military-industrial capacity under sanctions. While they do not always operate under formal command structures, their alignment with Kremlin objectives reflects the decentralised yet state-aligned nature of many EFNSAs.

Importers of dual-use goods typically operate through jurisdictions with weak export controls, legal opacity and neutral or friendly trade relationships with Russia. These conditions make such supply chains inherently difficult to trace, but the scale of the activity can be inferred from the sharp increase in exports of Western goods. For instance, the countries of the Balkans, Caucasus, and Central Asia, as well as Türkiye and the UAE, collectively increased their imports of European and American goods by US$133 billion in 2022-2023. The exponential surge strongly suggests that many companies in these jurisdictions are acting as conduits for Russian procurement.

Oligarch-linked firms are frequently involved in these operations, leveraging offshore corporate structures and trade networks to obscure end users and re-export sensitive goods back to Russia. For example, investigations have uncovered shell companies in Dubai and Hong Kong that act as procurement agents for Russian military contractors to obtain sanctioned military technology. The use of nominally private individuals and companies for this purpose allows the Russian government to deny direct involvement, shifting culpability to private actors operating in legal “grey zones”.

A prominent example is Russia’s use of its “shadow fleet” - a rapidly expanding group of aging, reflagged, and poorly insured tankers that operate outside of traditional maritime tracking systems to transport restricted commodities, most notably crude oil. While the concept has been used by other sanctioned regimes such as Iran, North Korea, and Venezuela, the scale, sophistication and geopolitical implications of Russia’s illicit maritime network are unprecedented. Reports estimate that the Kremlin has spent approximately US$10 billion since 2022 on building and maintaining its shadow fleet. By mid-2024, shadow vessels were transporting an estimated 4.1 million barrels of Russian crude oil every day, fundamentally undermining the G7 oil price cap and enabling Russia to continue generating substantial energy revenues in defiance of sanctions.

Sanctions evasion enablers

As outlined above, EFNSAs play a fundamental role in enabling sanctions evasion, now that circumventing Western financial sanctions has become a central objective of the Kremlin. In addition to domestic actors, the Russian state has increasingly relied on non-Russian EFNSAs to sustain its economy. Foreign banks, businesses and intermediaries have played a critical role in circumventing sanctions, sustaining trade, and laundering funds. Prior to 2022, banks in Latvia, Estonia, the Netherlands and Austria, among others, were investigated for serving as conduits for Russian capital. While many of these European countries have since undertaken significant reforms to effectively enforce sanctions, Chinese financial institutions and professional service providers continue to acilitate Russian access to global markets and critical technologies. These external EFNSAs offer the Kremlin strategic flexibility, enabling it to project economic influence and resilience without direct state involvement or exposure.

Additionally, Russia relies on a wide array of entities not traditionally classified as EFNSAs, such as PMCs, TCNs and cybercriminals, but which nonetheless facilitate sanctions circumvention, money-laundering activities and economic sabotage. These entities are examined in greater detail in the chapters on ANSAs and CNSAs. The financial and economic dimensions of these NSAs are briefly outlined here, with the important caveat that this overview is intended to complement the more detailed analysis provided in the dedicated chapters for each NSA category.

• A. Lawyers and professional service providers

Professional service providers – particularly lawyers, accountants, wealth managers and company formation agents – play a pivotal role in shielding the wealth and activities of the Russian elite from scrutiny. These so-called “professional enablers” are instrumental in structuring opaque financial arrangements that obscure the ownership and origin of assets. Common sanctions-evasion tactics include creating complex offshore networks involving trusts, shell companies, and special purpose vehicles located in permissive jurisdictions such as the British Virgin Islands, Cyprus, and Switzerland. These structures allow sanctioned individuals to move capital, purchase property, and maintain access to Western financial markets without detection. Lawyers also engage in what is known as “lawfare”, the strategic use of litigation not only to silence critics and investigative journalists, but also to delay or prevent asset seizures by Western authorities. These legal challenges are often made within Western legal systems, creating a paradox whereby democratic institutions are used to protect autocratic wealth.

Since 2022, sanctions have increasingly targeted professional enablers, alienating Russian clients from Western professional service providers. Yet demand for their services has only grown, as Russian oligarchs and state-aligned corporations seek new ways to protect their assets. Legal firms in the UAE, China, Türkiye, and post-Soviet states have become key players in restructuring corporate ownership, registering alternative citizenships, and creating financial channels outside the Western sphere. Thus, while not EFNSAs in the traditional sense, these enablers function as critical cogs in the machinery of Russian sanctions evasion.

• B. Private military companies

PMCs intersect with EFNSAs through their role as facilitators of covert economic extraction. While officially independent entities, these groups receive support from the RIS and provide the Kremlin with plausible deniability in operations across resource-rich conflict zones. PMCs have been deployed to prop up Russian-aligned regimes and secure access to strategic commodities, such as gold mines in Sudan and oil assets in Libya. These operations often involve securing economic concessions or engaging in barter-style arrangements whereby security services are exchanged for direct access to extractive revenues. The profits generated through these overseas ventures are funnelled back to Russia through opaque financial channels, often using front companies registered in the UAE.

The role of PMCs underwent a significant transformation after 2022, as the Russian state increasingly centralised control over the war effort in Ukraine. Some elements of Wagner and other PMCs have persisted (albeit under tighter state control or rebranding) and remain active in Africa, where resource extraction continues to fund both Kremlin-aligned actors and broader geopolitical influence campaigns. These operations are often facilitated by oligarch-linked firms that handle the procurement, shipping and resale of extracted resources, thereby embedding paramilitary activity within broader sanctions-evasion and money-laundering networks.

• C. Transnational criminal networks

Russian TCNs are integral to the country’s economy. They specialise in illicit trade, smuggling, and money laundering – skills that closely align with the Kremlin’s need to move restricted goods and funds across international borders without detection. TCN operations increasingly blur the line between criminality and Russian statecraft, with TCNs maintaining a flexible relationship with the RIS while also, as alleged by a 2024 UK law enforcement investigation, providing the “black cash” funds for Russian intelligence operations. TCNs’ expertise in black-market logistics makes them uniquely positioned to operate in high-risk environments and evade international regulatory regimes.

The imposition of sweeping Western sanctions has only increased the utility of TCNs to the Russian state. As RUSI Senior Associate Fellow Mark Galeotti observed, “since the 2022 invasion of Ukraine… the conscription state has shifted into a full ‘mobilisation state’ in which all elements of society - illegal as well as legal - are expected to play their full part in the war”.

In particular, TCNs have become central to the covert procurement of sanctioned technologies and military-grade components, working alongside state-linked importers and corrupt foreign intermediaries. Illicit supply chains now move dual-use goods from third countries into Russia, often concealed among legitimate cargo such as washing machines and refrigerators. These activities not only finance the war effort but also help preserve the illusion of economic normalcy within Russia, reinforcing the state’s resilience strategy.

• D. Cybercriminals

Russia’s cybercriminal ecosystem constitutes a dynamic and adaptive network of actors that have historically operated in a tolerated or semi-directed capacity under Kremlin oversight. Cybercrime has existed since the advent of the internet, but the emergence of cryptocurrency in the late 2010s enabled criminals to anonymously generate enormous revenue from ransomware - an activity that, over the subsequent decade, has evolved into a semi-professionalised industry. Although ostensibly independent criminal enterprises, these groups often refrain from targeting Russian systems and have been suspected of cooperating with the RIS on an ad hoc basis. Since 2022, cybercriminals have escalated their activities in tandem with Putin’s broader economic and geopolitical goals. There has been a notable rise in cyberattacks on NATO member-state infrastructure, banks, logistics networks, and government agencies. These operations are no longer purely financially motivated but are increasingly integrated into the broader Russian strategy of infrastructure sabotage, disinformation campaigns, and asymmetric warfare. Cryptocurrency theft, digital extortion, and data breaches continue to generate income for sanctioned cyber actors, while the attacks hinder Western coordination and sanctions enforcement. In effect, cybercriminals now operate as agents of strategic economic disruption – making them a critical, albeit unofficial, component of Russia’s geoeconomic architecture.

Russian state institutions behind non-state actors

Eliza Lockhart and Eginhards Volāns

When analysing how the Russian regime leverages NSAs to advance its objectives, it can be tempting to try to identify a “master plan”. As the work of international relations scholar Robert Jervis illustrates, governments often overestimate the degree of coherence and coordination behind their adversaries’ actions. Research by RUSI Senior Associate Fellow Matthew Redhead highlights that this tendency is especially pronounced when democratic governments assess the threats emanating from authoritarian regimes.

In such cases, there is often an assumption of centralised authority, top-down decision-making and absolute control being exercised by a single leader. Yet, as political scientist Barbara Geddes and colleagues have shown, decision-making processes within dictatorships can be just as fragmented as within democracies.

Analysts differ in their assessments of Putin’s system of governance, ranging from portrayals of firm hierarchical control to descriptions of loosely coordinated chaos. In reality, both dynamics appear to coexist. While the decision to initiate hostile activities is typically centralised within the RIS, the execution of these acts often unfolds through a less-than-functional mix of state and non-state actors. This has resulted in NSAs frequently being labelled as “proxies”, implying direct state control. However, in the murky realm of covert operations, establishing a clear chain of command between state and non-state actors is often unfeasible.

As Redhead articulates, perhaps the most that can be hoped for is to collect enough material to:

a) identify a probable relationship between a state and a non-state actor, and

b) find consistency and alignment between the state actor’s objectives and the apparent objectives of the non-state actor’s conduct.

Even then, such alignment does not necessarily imply a clear nexus – NSAs may act in ways that advance state interests for independent reasons. Moreover, in an environment where loyalty to Putin is paramount and suspicion of disloyalty is rife, it is not uncommon for various NSAs to try to anticipate what Putin wants, without necessarily receiving direct orders.

As such, identifying the specific state entities that might influence or control NSAs requires care. With this caveat in mind, Table 7 lists the Russian state institutions that regularly interact with the various types of NSAs discussed in previous chapters of the handbook. The links between these NSAs and Russian state institutions are shown in Figure A3.

▲ TABLE 7. Russian state institutions involved in the orchestration of NSAs. The information presented in this table does not claim to represent the objective or comprehensive truth. It draws on publicly available, yet often limited, sources and should be considered indicative of the situation. The table focuses on identifying observable ties between NSAs and state institutions without assessing the depth, nature, or degree of state control over these actors. Furthermore, the relationships mentioned in the table are likely only a partial reflection of the far more complex ecosystem of the Russian state and NSAs. Readers are therefore encouraged to interpret this information with caution and to treat it as a starting point for further inquiry rather than a comprehensive account.

Conclusions and knowledge gaps

Russia’s use of NSAs in hybrid threats is an ever-evolving challenge that continues to shape the modern-day threat landscape faced by democratic states. These actors, often employed or orchestrated by Russia, operate in the blurred space between state and non-state, legal and illegal, and their shifting and fluid nature demands constant re-evaluation by Western governments.

Fully understanding their role in hybrid threats requires not only mapping their activities but also recognising how democracies perceive and interpret them. Western analysis often risks oversimplifying the issue, particularly by: (1) over-homogenising Russia’s use of NSAs; (2) underestimating their complexity; (3) failing to account for the contextual specificities of the operational domains in which they operate; (4) disproportionately focusing on high-profile cases while overlooking less visible actors; and (5) forcing Russian behaviour into Western frameworks, thereby obscuring Russia’s distinct strategic culture.

Russia’s use of NSAs, while often enabled and supported by the state, rarely reflects a coherent grand strategy. Instead, it highlights the opportunism, improvisation, and idiosyncrasies that characterise Russian foreign and defence policy as a whole. The regime’s inherent ambiguity makes the issue even more challenging to grasp fully, and therefore harder to counter effectively.

Looking ahead, anticipating how NSA-related threats will evolve is essential. To effectively track the ever-changing NSA threat landscape, democracies must deepen their understanding of the actors themselves, pay greater attention to overlooked domains in which they operate, and actively seek out new categories of NSAs that Russia may be using or exploiting. Additionally, an in-depth examination of the connections between these actors and the Russian state, as well as the internal systemic changes occurring within Russia, is required.

Effective countermeasures can only be implemented by gaining a comprehensive and shared understanding of the threat among Western democracies and their democratic allies. It is a lengthy, complex, and seemingly never-ending process, but one that is crucial for building resilience against hybrid threats.

To enhance understanding of NSA-related threats, this handbook not only provides a unified and comprehensive overview of the threat landscape but also highlights significant knowledge gaps identified during the research process. Addressing these gaps is essential for developing the heightened awareness required to devise future strategies that effectively counter threats posed by NSAs. These knowledge gaps should be addressed in future research and policy initiatives:

• Lack of transparency in Russia’s decision-making process requires further research to understand how the state controls, influences or manipulates the various NSAs at its disposal. A more in-depth understanding is needed of how the Russian decision-making process operates in practice.

• The degree of direct control that the Kremlin exercises over NSAs remains unclear, as the distinction between control, delegation, cooperation, tolerance, and manipulation is often blurred by design. Greater clarity and concreteness are needed to define state control and the various relationships that can exist between NSAs and the state.

• As Euro-Atlantic vigilance against Russian hybrid threats has increased since the invasion of Ukraine, and the activities of some Russia-linked NSAs have been constrained, there is a growing need to identify how Russia is adapting and leveraging new forms of NSAs to exploit vulnerabilities in democratic systems.

• The lines between the Russian state’s cyber programme and cybercriminals have become increasingly blurred, requiring further examination. The extent of coordination between various CNSAs, and the role of the Presidential Administration in managing them, remains unclear and warrants further investigation. Russia’s close security ties with like-minded countries, including Belarus, the DPRK, and Iran, should also be closely monitored, as these ties have the potential to extend into the cyber domain. Further research is likewise required on the recruitment and development of “cyber talent” through universities, IT companies and hacking competitions.

• As modern information operations rely heavily on IT infrastructure, there is a need for closer examination of the links between IT service providers and the Russian state, or PDNSAs acting on the Kremlin’s behalf. The overall scale, level of control, and hierarchy of the Russian propaganda and disinformation ecosystem remain poorly understood and require further scrutiny. The relationship between Russia and social media platforms such as Telegram also warrants closer investigation. It is equally important to monitor any possible cooperation or coordination in the field of propaganda and disinformation between Russia and other hostile hybrid threat state actors.

• Additional research is needed on how the ideological stances of certain political parties or individual politicians may be influenced by Russia to affect their voting behaviour on Russia-related legislation. Further investigation is needed into the various lobbying organisations active across Euro-Atlantic states that present themselves as NGOs while concealing their ties to Russia and their true objectives.

• The full extent of Russia’s use of alternative payment systems and its level of economic coordination with other hostile states remain insufficiently mapped and require deeper exploration. Similarly, there is limited visibility into the degree of control Russia exercises over TCNs in their role as enablers of sanctions evasion. Understanding these financial mechanisms and arrangements would help disrupt critical revenue streams for the Russian war effort. There is also a need to identify the financial intermediaries that are vital to foreign interference in democratic processes. Lastly, the role of cybercriminals in executing financial sabotage remains murky, and clearer links between state policy and cyber-economic attacks must be established.

Recommended reading

Armed NSAs

• All Eyes on Wagner, blog.

• Global Initiative Against Transnational Organized Crime.

• Mark Galeotti, In Moscow’s Shadows, podcast.

• Seth Jones, “Russia’s Shadow War Against the West”, Center for Strategic and International Studies, 18 March 2025.

• New America’s Future Frontlines.

• Kacper Rekawek, Thomas Renard, and Bàrbara Molas, eds., Russia and the Far-Right: Insights from Ten European Countries (ICCT Press, 2024).

• Uğur Ümit Üngör, Paramilitarism: Mass Violence in the Shadow of the State (Oxford University Press, 2020).

Cyber NSAs

• Andrei Soldatov and Irina Borogan, “Russian Cyberwarfare: Unpacking the Kremlin’s Capabilities”, CEPA, September 2022.

• Google Threat Analysis Group, blog.

• Janne Hakala, Jazlyn Melnychuk, “Russia’s Strategy in Cyberspace” (NATO StratCom COE, June 2021).

• Microsoft Threat Intelligence, blog.

• The Recorded Future, Insikt Group.

• Tim Mauer, Cyber Mercenaries: The State, Hackers, and Power (Cambridge University Press, 2018).

Propaganda and disinformation NSAs

• Andrei Soldatov and Irina Borogan, The Red Web: The Struggle Between Russia’s Digital Dictators and the New Online Revolutionaries (Public Affairs, 2015).

• Atlantic Council’s Digital Forensics Lab.

• EUvsDisinfo.

• Ion Pacepa, Disinformation: Former Spy Chief Reveals Secret Strategies for Undermining Freedom, Attacking Religion, and Promoting Terrorism (Independently Published, 2013).

• Peter Pomerantsev, This is Not Propaganda: Adventures in the War Against Reality (Public Affairs, 2019).

• NATO StratCom Centre of Excellence.

• Thomas Rid, Active Measures: The Secret History of Disinformation and Political Warfare (Profile Books, 2021).

• Viginum.

Social and political NSAs

• Andis Kudors, Russia and Latvia: A Case of Sharp Power, (Routledge, 2024).

• Anton Barbashin and Alexander Graef, “Thinking Foreign Policy in Russia: Think Tanks and Grand Narratives”, Eurasia Center Report (Atlantic Council, November 2019).

• Fredrik Wesslau, “Putin’s friends in Europe”, European Council on Foreign Relations, 19 October 2016.

• Joshua P. Mulford, “Non-State Actors in the Russo-Ukrainian War”, Connections QJ 15, no. 2 (2016): 89–107.

• Orysia Lutsevych, “Agents of the Russian World Proxy Groups in the Contested Neighbourhood”, Russia and Eurasia Programme (Chatham House, April 2016).

• Raphaël Kergueno, “From Russia with Lobbying”, Transparency International EU, 5 July 2017.

• Susi Dennison and Dina Pardijs, “The world according to Europe’s insurgent parties: Putin, migration and people power”, ECFR Flash Scorecard (European Council on Foreign Relations, June 2016).

Economic and financial NSAs

• David Lewis and Tena Prelec, “New Dynamics in Illicit Finance and Russian Foreign Policy”, SOC ACE Research Paper 17 (University of Birmingham, August 2023).

• Catherine Owen, Tena Prelec and Tom Mayne, “The Illicit Financialisation of Russian Foreign Policy”, SOC ACE Research Paper 3, (University of Birmingham, May 2022).

• Greg Rosalsky, “How Putin Conquered Russia’s Oligarchy”, Planet Money, 29 March 2022.

• Justyna Gudzowska, Eliza Lockhart and Tom Keatinge, “Disabling the Enablers of Sanctions Circumvention”, RUSI Policy Brief (RUSI, May 2024).

• Olivia Allison and Tom Keatinge, “Strengthening the Financial Frontline on Russian Trade Sanctions”, RUSI Policy Brief (RUSI, March 2025).

• Matthew Redhead, “Old Wine, New Bottles? The Challenge of State Threats”, SOC ACE Research Paper 32, (University of Birmingham, January 2025).

• Olivia Allison et al., “Wagner’s Business Model in Syria and Africa: Profit and Patronage”, RUSI Occasional Paper, (RUSI, 6 February 2025).

• Spencer Woodman, “How a network of enablers have helped Russia’s oligarchs hide their wealth abroad”, International Consortium of Investigative Journalists, 2 March 2022.

• Tom Keatinge, “Developing Bad Habits: What Russia Might Learn From Iran’s Sanctions Evasion”, RUSI Occasional Paper, (RUSI, June 2023).

Appendices

▲ TABLE A1. PMC archetypes. Source: Adapted from “The Business of War - Growing Risks from Private Military Companies”, Council of the European Union, Analysis and Research Team - Research Paper, 31 August 2023.

▲ TABLE A2. Evolution of the global hacktivist environment. Source: Adapted from Orange Cyberdefense’s “Security Navigator 2025”.

▲ TABLE A3. Evolution of the Russian oligarchy

▲ FIGURE A1. ANSAs by operational domain

▲ FIGURE A2. Russian cyber ecosystem

▲ FIGURE A3. Links between various categories of NSAs and Russian state institutions as of spring 2025

---

Eginhards Volāns is a senior analyst at the European Centre of Excellence for Countering Hybrid Threats (Hybrid CoE). He currently focuses on the role of non-state actors in hybrid threats, with a particular emphasis on the use of proxies in Russian hybrid threat operations. He also co-leads Hybrid CoE’s hybrid threat monitoring group, which tracks major incidents and analyzes the evolving hybrid threat environment.

Vladimir Rauta is the Head of the Department of Politics and International Relations and the Director of the Centre for Global Security and Governance at the University of Reading, United Kingdom.

Magda Long is a specialist in intelligence, covert action, and hybrid threats posed by states and armed non-state actors, with over two decades of combined professional and academic experience in international security. She is a consultant and visiting research fellow at several leading academic institutions in the United States and the United Kingdom. Dr Long is the lead editor and a contributing author of Covert Action: National Approaches to Unacknowledged Intervention, a groundbreaking volume examining covert practices of 20 nations.

Andis Kudors (PhD candidate) was a visiting scholar at the Institute for European, Russian and Eurasian Studies, the Elliott School of International Affairs (George Washington University) in 2021-2022. His research interests include national security, soft power, sharp power, propaganda, disinformation, and informational warfare. He has been a Fulbright scholar at the Kennan Institute (Woodrow Wilson Center) in Washington DC (2014–2015). In 2021, Andis Kudors was appointed Commander of The Cross of Recognition by the President of the Republic of Latvia, Egils Levits, for his contribution to the research of Latvian national security.

Agata Kleczkowska is an Assistant Professor at the Institute of Law Studies of the Polish Academy of Sciences. Her area of expertise covers public international law, including especially the questions of the use of force, hybrid threats, the status of non-state actors, and international organisations. Among other functions, she is a Managing Editor of the Contemporary Central & East European Law journal, a Co-Editor of the Digest of State Practice of the Journal on the Use of Force and International Law, and a member of the NATO STO Research Task Group on the Ethical and Legal Challenges of Cognitive Warfare.

Eliza Lockhart is a Research Fellow at the Centre for Finance and Security (CFS) at the Royal United Services Institute (RUSI), the UK’s leading defence and security think tank. Her work examines matters at the intersection of law, finance and security, with a focus on hybrid threats and economic security. Prior to joining CFS, she was a lawyer at a top-tier global law firm.