The practice of Russian intelligence services using organized criminal groups dates back to the KGB era of the Soviet Union. Under Vladimir Putin’s rule, the Kremlin regime has put this activity on a systematic footing, more actively involving foreign criminal networks in espionage, sabotage, the elimination of Kremlin opponents, and the destabilization of the situation in European countries. In October 2026, it became known that German law enforcement agencies were investigating possible links between representatives of Turkish-Kurdish youth mafia groups and Russian state structures and intelligence services. These are the so-called “Generation Z mafia” — criminal groups of the younger generation distinguished by particular brutality, the display of firearms on social media, and participation in shootouts on the streets of German cities.
On 25 October 2026, the German newspaper WELT published an investigation titled “The Bloody Trail of the Turkish-Kurdish Generation Z Mafia and the Russian Trace,” devoted to the activities of international criminal groups in Germany and their possible contacts with Russia. German law enforcement agencies are currently verifying information about cooperation between representatives of these criminal structures and the Russian side.
One of the most well-known representatives of this criminal environment is the international group Daltons (Daltonlar), which originated in Turkey and later expanded its activities to Germany and other EU countries. Members of the group are involved in criminal proceedings related to murders, armed attacks, extortion, and illegal arms and drug trafficking. In Germany, the victims of attacks are predominantly entrepreneurs of Turkish and Kurdish origin, who are forced to pay money under the threat of physical violence. To counter the activities of Daltons and other similar groups, a specialized police unit called Ferrum and a prosecutor’s office unit called Telum have been established in Berlin.
On 12 March 2026, the German television company ARD, in its program Kontraste, released an investigation into the criminal activities of Daltons. In particular, a man who introduced himself as “Ahmet from Daltons” demanded €250,000 from the owner of several supermarkets, threatening to blow up his stores. Shortly afterward, two supermarkets were shot at, and the perpetrator of the attack was later detained and sentenced to two years and nine months in prison. According to the Berlin authorities, as of March 2026, the specialized prosecutor’s office was investigating more than 200 criminal proceedings related to the activities of Daltons and other similar groups.
One of the leaders of Daltons is 29-year-old Berat Can Gökdemir, known as Can Dalton, who is currently on Russian territory. Turkish law enforcement agencies accuse him of involvement in murders, organizing armed attacks, and other serious crimes. Despite Turkey’s extradition request, Russia has still not handed B. C. Gökdemir over to Turkish authorities. According to some unofficial information, he is under the protection of the Russian authorities, provided with housing, and continues to remotely manage the group. ARD journalists also discovered social media videos from the combat zone in Ukraine in which individuals presented as members of paramilitary formations congratulate B. C. Gökdemir on his birthday. In addition, some representatives of the group have posted photographs with Russian symbols and messages in support of Vladimir Putin.
A possible connection between Daltons and Russian sabotage operations attracted attention after the arson on 23 September 2026 of equipment at a Starlink ground station in the village of Wola Krobówska near Warsaw. At this site, the Polish state company Exatel provided data transmission services and hosted telecommunications infrastructure that was used to ensure internet connectivity, including with Ukraine. According to Polish law enforcement, the arson was almost certainly organized by Russian intelligence services with the aim of disrupting the operation of this infrastructure.
On 16 October 2026, ARD journalists reported that four days earlier in Nürtingen (Baden-Württemberg), German law enforcement officers, at Poland’s request, detained two Turkish citizens aged 34 and 38 — Müslüm T. and Ümit E. They are suspected of involvement in the arson of the Starlink station, and journalists link the detainees to the Dalton criminal group. The coordinator of the Polish special services, Tomasz Siemoniak, stated that there is evidence indicating the involvement of Russian intelligence services in organizing the sabotage.
Russian intelligence services are increasingly recruiting third-party perpetrators for sabotage in Europe through intermediaries for monetary rewards. On 12 October 2026, the president of the Federal Office for the Protection of the Constitution (BfV), Sinan Selen, stated that Russian intelligence services are making ever greater use of organized crime structures. This mechanism, known as Crime as a Service, allows the recruitment of criminal groups that already have networks of operatives, access to weapons, and international connections. At the same time, the use of such structures makes it more difficult to identify the true customers of the sabotage and their links to Russian intelligence services.
Links between the right-wing extremist milieu and organized crime have also been documented in Germany. The federal government of the FRG has confirmed contacts between neo-Nazis and the biker groups Hells Angels and Bandidos, while members of the right-wing extremist association Turonen/Garde 20 have figured in criminal proceedings related to drug trafficking and money laundering. Against this background, the position of the AfD is indicative: the party actively demands a tough fight against clan crime among migrants, yet does not demonstrate the same public consistency regarding the criminal connections of the German far-right milieu. At the same time, the party has never issued a public condemnation of the involvement of Russian intelligence services in sabotage in Europe.
Russia uses sabotage, covert operations, and political influence to weaken European unity, destabilize the situation in EU countries, and, above all, to stop support for Ukraine. The Kremlin is expanding the practice of involving international criminal groups in carrying out tasks for its intelligence services. The use of criminal networks provides Russian intelligence services with access to operatives and allows them to conduct operations through third parties, concealing the involvement of the Russian state. In the absence of proper countermeasures, Russian intelligence services will gain greater opportunities to expand their agent networks, recruit new operatives, and organize sabotage in EU countries. Further penetration of Russian intelligence services into the European criminal environment will complicate the work of law enforcement agencies and intelligence services of European states in detecting and stopping such activities.
