The Legal Counteroffensive to Russia’s Hybrid War

Editor's Note: Russia has engaged in sabotage and other gray zone warfare in Europe, but now some states are fighting back. Arizona State's Candace Rondeaux describes Poland's successful prosecutions of Wagner Group members and how this is complicating Moscow's operations there.

Daniel Byman

***

A landmark espionage case in Poland has established a crucial new legal precedent for prosecuting hybrid warfare operations in Europe. On Feb. 14, a Krakow court handed down the first successful conviction of Wagner Group operatives outside of Ukraine since the European Union first sanctioned the Kremlin-backed paramilitary force in 2021 and the U.K. designated Wagner a terrorist organization in 2023. The ruling, by Judge Ewa Karp-Sieklucka in the Malopolska District Court, marks a watershed moment for European security.

Two Russians, Alexei Titov, 37, and Andrei Gontarev, 39, received five-and-a-half-year sentences in Poland for espionage and terrorism-related charges tied to their work with the Wagner Group. Polish authorities arrested them in August 2023 for distributing pro-Kremlin propaganda and conducting reconnaissance operations across the country. The men admitted to placing hundreds of Wagner Group-branded stickers with recruitment QR codes near tourist hotspots and highly trafficked areas in Warsaw and Krakow and documenting their activities on Telegram. Prosecutors revealed their handlers invested at least $24,000 in multiple intelligence-gathering and influence operations, including separate trips to Paris and Berlin for which the men each earned several thousand euros.

It was the second such prosecution linked to Wagner Group-branded sabotage operations outside of Ukraine, exposing Russia’s evolving irregular warfare tactics. In November, just as judicial proceedings against Titov and Gontarev were getting fully underway, a 23-year-old British citizen named Jake Reeves pleaded guilty in a London court to carrying out an arson attack on a warehouse with Ukrainian connections and knowingly accepting payment from a foreign intelligence service. British authorities have not publicly named the foreign intelligence agency in question, but they have said that Reeves and Dylan Earl, another defendant who also pleaded guilty on related charges, acted on behalf of Russia and that they were recruited via a Wagner-linked Telegram channel.

Russia’s employment of paramilitaries and support for irredentist groups in contested territories like Transnistria (1990-1992), South Ossetia and Abkhazia (starting in 1992 and peaking in 2008 with the Russo-Georgian War), and more recently in Crimea and Donbas (starting in 2005 and escalating with the Russian invasion of Crimea in 2014), along with its cultivation of right-wing identitarian networks tied to sports and veterans’ organizations, represents one dimension of what some analysts term “hybrid warfare.” The Wagner Group emerged from this paradigm, initially recruiting experienced VDV Airborne and GRU special forces veterans in 2013 for critical missions in Syria and then evolving into a covert force in Ukraine in 2014.

A defining characteristic of Russian irregular warfare is the deliberate masking of state operations behind ostensibly private actors like private military security contractors or mercenary organizations. In noncombat zones, Russia typically deploys propaganda, surveillance, asset recruitment, and covert support for targeted operations. While analysts debate the specifics of what constitutes hybrid warfare, Russia’s contemporary practices extend directly from maskirovka—a deeply entrenched principle in Russian military doctrine dating back to early Soviet times that emphasizes deception, camouflage, and concealed operations. This doctrinal continuity, though sometimes overlooked or misunderstood by outside observers, provides essential context for understanding Russia’s strategic approach: systematically probing vulnerabilities in adversary systems while psychologically conditioning target populations to minimize resistance to further encroachment.

Until the ruling in Krakow, “hybrid warfare” lacked a legal definition. The ambiguity has created challenges for prosecution and accountability, as traditional laws of armed conflict were designed for conventional state-to-state warfare. Local courts and international judicial venues must instead rely on prosecuting specific criminal acts rather than the broader hybrid warfare strategy itself.

The charges against Titov and Gontarev included espionage, membership and affiliation with a designated terrorist organization, and promoting propaganda on behalf of a foreign intelligence agency. The case the prosecutors made was that these charges and the alleged activities associated with them constituted hybrid warfare.

The case represents an emerging prosecutorial approach that framed these disparate criminal activities as part of a cohesive strategy. Prosecutors used “hybrid warfare” to refer to the blending of conventional military tactics with other methods like disinformation, cyber operations, and covert activities to achieve strategic objectives while maintaining plausible deniability. The prosecution argued that these charges, when viewed collectively rather than as isolated crimes, revealed a systematic attempt to undermine national security through nontraditional means.

It is no coincidence that prosecutors with the Krakow district’s organized crime department spearheaded the case. They were well prepared to demonstrate how the Russian operatives were tied into the networks Russia uses to engage in hybrid warfare. Though defense attorneys for Gontarev and Titov argued that their clients’ actions were akin to acts of speech and fell under legal protections for free speech, prosecutors mapped out direct links between the defendants and Russian organizations with clear and verifiable ties to Russian state-sanctioned paramilitary training programs.

Prosecutors in Krakow worked systematically to pierce the veil of deniability by methodically connecting the dots between the defendants’ communications with their handler in Moscow and their web of ties to Wagner-linked entities and far-right ultranationalist influencers like Alexander Dugin and other Russian operatives with close ties to Kremlin-intelligence agencies. The judge in the case concurred, saying evidence presented in the case pointed to coordinated acts spearheaded by Russia’s foreign intelligence service that posed a “threat to national security.” “Such actions can incite social unrest, deepen divisions and ultimately weaken Poland’s stability,” Judge Karp-Sieklucka said.

The Kremlin-sponsored operations in Poland and the U.K. unfolded during a crucial transition in Wagner’s history. Following Wagner chieftain Yevgeny Prigozhin’s failed mutiny in June 2023, the paramilitary group underwent a dramatic restructuring. Around this time, the deputy director of Russia’s GRU intelligence agency, Andrei Averyanov—previously known for directing GRU operations targeting opposition figures like Alexei Navalny and GRU defector Sergei Skripal—took command of the newly formed Service for Special Activities (SSA). Intelligence sources would later suspect Averyanov’s involvement in Prigozhin’s death in a fiery plane crash that August. As Wagner evolved from a battlefield force spread across Africa and Ukraine into a sophisticated instrument of hybrid warfare, intelligence observers noted increasing coordination between these elements of Russian power projection in Europe.

The significance of this conviction extends far beyond a simple case of caught spies. The case exposed not just individual agents, but an entire ecosystem where designated terrorist organizations, oligarch-funded cultural initiatives, and Russian intelligence operations now seamlessly converge as Putin seeks leverage for negotiations beyond the Ukrainian battlefield. The evidence presented at trial in Krakow against the two Russian operatives revealed an elaborate system linking ultranationalist organizations, mercenary networks, and Russia’s GRU intelligence wing. Both men admitted to having attended specialized military trainings at facilities linked to Russia’s Ministry of Emergency Situations, though their defense attorneys claimed the training was conducted by private organizations. One defendant’s phone contained discussions about weapons purchases from Chinese companies, Israeli contacts, and front companies in Kyrgyzstan, according to a Polish criminal investigator who examined their devices and testified in court.

Polish prosecutors drew special attention to the defendants’ connections to a wider network that has enjoyed special favor from the Kremlin since Russia’s invasion of Crimea in 2014. Both men admitted in court to having ties to organizations backed by Konstantin Malofeev, an ultranationalist Putin confidante known as the “Orthodox Oligarch.” Those links included Malofeev’s monarchist Double-Headed Eagle Society and his media outlet Tsargrad. Malofeev serves as a crucial nexus between Russia’s financial, religious, and paramilitary operations in Europe, binding together traditionalist zeal, fascist ideology and intelligence activities through cultivation of ties with Europe’s far-right factions. He has made no secret of his backing of pro-Putin proxies.

Meanwhile, the defendants’ handler, Stepan Krivosheev, another Malofeev acolyte, had been active in transforming football hooligan networks into military recruitment channels, according to Polish prosecutors. According to Russian media reporting, Krivosheev served for a time as an “assistant director of the Russian Institute for Strategic Studies,” a Moscow think tank affiliated with Russian intelligence services. The two defendants openly admitted to providing active support to the Moscow reconnaissance unit, a detachment of Russia’s 106th Guards Airborne Division. Also known colloquially as the “hooligan battalion,” the specialized paratrooper unit consists primarily of fans of the Russian capital’s Spartak football team and former Wagner Group fighters. According to one popular Wagner-affiliated Telegram channel, the unit was officially formed in January 2023 with the active encouragement of one of Wagner’s leading commanders, Alexander “Ratibor” Kuznetsov, and tacit support of Russia’s military leadership.

The Krakow case gains additional significance when viewed alongside Finland’s ongoing prosecution of Jan Petrovsky, a commander of the Wagner-affiliated Task Force Rusich, a neo-Nazi fascist paramilitary that enjoys public support from prominent ultranationalist Russian members of parliament. The Finnish case, which began trial in December and more recently resulted in Petrovsky’s conviction in March, marks the first war crimes prosecution of a Wagner-linked commander for actions predating Russia’s 2022 invasion. Petrovsky’s unit emerged from the “Partizan” training program run by the Russian Imperial Movement (RIM)—which the United States designated as a specially designated global terrorist entity in April 2020.

Yet the spate of legal cases against Wagner-linked operatives also highlights persistent divisions within Europe over how to counter such threats. Eastern European states, particularly Poland and the Baltic nations, have long pushed for a more expansive legal definition of hybrid warfare that encompasses information operations, economic coercion, and the exploitation of social divisions. Western European capitals, meanwhile, have generally favored a narrower approach focused on traditional espionage and military activities, arguing that too broad a definition risks criminalizing legitimate political expression and civil society activity. Echoes of this criticism could be heard in Vice President Vance’s speech in Munich. This tension has complicated efforts to develop a unified European response to Russian intelligence operations, with some states treating cases like the Krakow conviction as terrorism related while others view them through the lens of conventional espionage law.

But the tangled web of connections between Wagner, Malofeev, Europe’s populist and far-right fascist movements, and Russian intelligence agencies reveals a more insidious challenge emerging alongside the visible fractures in U.S. and European support for Ukraine. Russia has found ready allies in football ultra groups, far-right extremist groups, and related Wagner Group affiliates like the Russian Imperial Movement and Rusich, whose encrypted messaging apps and transnational networks offer both secure communications and natural cover for cross-border operations.

From 2014 to 2022, Russian intelligence cultivated those Wagner-allied networks inside and outside of Russia and Ukraine largely in the virtual realm via viral meme posts and battlefield snuff films shared on Vkontakte, the Russian version of Facebook and Telegram. The GRU shifted its tactics in early 2022 to mobilize recruits to the Ukrainian front and then in early 2023 to stir individuals recruited via Wagner-branded networks to action in Europe and the U.K. In recent months—as Washington’s political establishment grapples with President Trump’s recent public clash with Ukraine’s President Volodymyr Zelenskyy, Vance’s Munich broadside, and the Republican Party’s tacit acceptance of a radical shift in Russia policy—the GRU has been quietly perfecting a new playbook, striking hard at undersea cables in Finland, for example, and placing incendiary devices aboard DHL cargo flights to the West.

Part of this shift was due to desperation. In the wake of Russia’s 2022 invasion of Ukraine, European countries expelled approximately 400 Russian diplomats operating as intelligence officers. Richard Moore, then head of Britain’s MI6 intelligence agency, estimated that about half of Russia’s intelligence operatives in Europe had been forced out. The Kremlin’s move to reel in low-level criminals and the underemployed has proved an effective low-rent strategy for patching up holes in its traditional espionage enterprise. It is another tool in Moscow’s toolkit for throwing NATO off balance.

The Krakow case reveals Russia’s normalization of mayhem and obfuscation within its statecraft, as the Kremlin deliberately expands the gray zone between public and private actors in its ongoing conflict with the United States and European states. This strategic ambiguity has effectively split the transatlantic alliance, fostered a realignment of U.S.-Russia relations under Trump and Putin, and fractured European unity about how to respond to Russian aggression.

The Krakow case proves that prosecuting Russian sabotage operations through organized crime frameworks cuts through Moscow’s deliberately cultivated ambiguity, as investigators mapped concrete financial connections between defendants and state-adjacent entities. This approach succeeds because organized crime units possess the ideal toolkit: established intelligence networks, experience with complex investigations, legal mechanisms targeting support infrastructure, and crucially, the ability to act on lower evidence thresholds while employing financial investigation tools that expose hidden connections—directly attacking the plausible deniability that has otherwise fractured Western responses.

But it is important to acknowledge that prosecuting these cases like organized crime, while effective for building cases, falls short as a deterrent because Russia treats these operatives as expendable assets in a larger geopolitical conflict. The evolution of the Wagner Group brand illustrates how Moscow simply adapts by creating deeper cutouts, using more sophisticated financial channels, and accepting occasional prosecutions as an acceptable cost of operations. Without addressing the Kremlin’s strategic calculations through more consequential diplomatic, economic, or military measures, these prosecutions merely prune the edges of a network designed to regenerate, while Russia continues to achieve its broader objective of creating division and uncertainty in U.S. and European responses.

Despite these limits, systematic evidence-gathering and cross-border collaboration can pierce the veil of Moscow’s hybrid warfare campaign and make it more difficult for Russia to operate. Over the past year, Polish authorities have succeeded in foiling a string of espionage and sabotage plots involving Belarussian, Ukrainian, and Polish citizens caught up in an international dragnet that reportedly spans the Baltic region. Those developments and the Krakow prosecution demonstrate what European prosecutors can achieve when they combine legal innovation with regional security cooperation.