In the spring of 2026, materials from an investigation by Moldovan law enforcement agencies made it possible to reconstruct in detail one of Russia’s largest hybrid operations. It concerns the creation of a transnational network involving the recruitment, training, and use of agents to destabilize the political situation both in Moldova and beyond its borders. Within this system, Moldova serves as a territory for recruiting agents, while the training infrastructure has been moved to Serbia and Bosnia and Herzegovina—regions offering a favorable environment for covert activities.
Historically, the Balkans have already been used as a space for indirect influence and operations with a high degree of deniability. However, if previously these were limited, targeted actions involving professionally trained personnel, recent years have seen a qualitative shift. The new model is based on scale and low cost—where instead of professionals, dozens or even hundreds of performers with minimal training are employed. This not only broadens the scope of operations but also significantly reduces both political and operational risks.
The recruitment system became the central element of this scheme. According to investigators, it primarily targeted socially vulnerable groups—young people, often without stable income, and frequently holding pro-Russian views. The key feature was “masking”: potential participants were offered “paid nature trips” or “recreation camps.” For two weeks of participation, they were promised between $300 and $500—a sum attractive enough amid economic instability. At the initial stage, the true purpose of the trip was not disclosed. Only after candidates agreed were they contacted by coordinators—believed to be based in Russia—who gradually revealed the real nature of the activities.
Recruitment was conducted through personal contacts, social networks, and messaging apps, including Telegram. The system employed the principle of maximum information fragmentation: each participant knew only a limited part of the chain. This structure makes the network resilient to exposure since the arrest of one link does not automatically collapse the system. Local intermediaries and proxy structures play an important role. Investigation materials mention possible financial connections to businessman Ilan Shor, as well as the involvement of networks associated with former paramilitary organizations, particularly the well-known Wagner Group and entities like “The Farm.” Cryptocurrencies serve as an additional tool, helping obscure money flows and leaving minimal traces.
Practical training of recruits takes place outside Moldova. In Bosnia and Herzegovina, the courses are mostly theoretical—participants learn crowd psychology, methods of organizing and escalating protests, and principles of object reconnaissance. In Serbia, the emphasis shifts to hands-on training—drone operation, making explosive devices, breaking through police lines, and evading law enforcement. According to the investigation, at least 11 foreign instructors were involved, including Russian citizens. President Aleksandar Vučić confirmed the presence of Russians at one such training site, although no official accusations were directed at Moscow.
The training program itself demonstrates a conceptual shift in sabotage operations. It no longer focuses on traditional saboteurs but on hybrid operatives capable of functioning in urban environments and participating in destabilizing actions. They are taught not only technical skills but also how to behave during mass unrest, provoke and intensify conflicts, and avoid accountability.
The scale of the operation is confirmed by tangible figures. According to Moldova’s Ministry of Internal Affairs, the investigation covers more than 80 people, of whom about 20 have already been charged. In September 2025, on the eve of parliamentary elections in Moldova, dozens of searches were conducted, resulting in 74 arrests. Drones, communication systems, satellite internet equipment, fuel and explosive substances, and manuals were seized.
According to investigative assessments, the operation’s initial objectives focused on destabilizing Moldova’s internal situation—particularly before the 2024 presidential elections and the referendum on European integration. However, collected evidence points to a broader plan. Network participants appear in cases related to provocations in France and the potential preparation of operations in Germany. This indicates the cross-border nature of the network and its potential use in various countries depending on political conditions.
The response of the states hosting the training bases has been restrained. In Serbia, local organizers were detained but soon released. In Bosnia and Herzegovina, several instructors, including Russian nationals, were arrested, but no systemic reaction followed at the state law enforcement level. This situation only underscores the region’s vulnerability and its role as a “gray zone” for such operations.
Ultimately, a new model of Moscow’s hybrid influence is emerging. It is based on a combination of cheap mass recruitment, training infrastructure located outside target countries, and flexible use of operatives in different geographic areas. In this scheme, Moldova becomes not only a target but also a source of human resources; the Balkans serve as a training ground, and Europe becomes the arena for destabilizing actions.
The primary danger of this model lies in its scalability. Whereas such operations once required significant resources and preparation, they can now be reproduced almost assembly-line style. This makes such networks one of the key challenges to European security today.