We continue publishing selected sections of the analytical reports prepared within the framework of the project. The next publication is titled “Russia’s Nonmilitary Operations in Ukraine and Kosovo.”
In December 2025, the team of the Center for Security Studies “CENSS”, in cooperation with the Kosovar Center for Security Studies, finalized a study examining the influence of the Russian Federation and other external actors on Ukraine and the countries of the Western Balkans. The research was conducted as part of the project “Strengthening Resilience to Russian Hybrid Threats through Regional Cooperation” with the support of Open Society Foundations Western Balkans and Konrad-Adenauer-Stiftung Kosovo.
The Russian-Ukrainian war started in 2014 when Russia captured the Crimean Peninsula, not in 2022 with the unprovoked full invasion of Ukraine. Nevertheless, the hybrid war between Russia and Ukraine began before the start of the real conflict. Russia has used media to influence the population, as well as used the Russian Orthodox Church and Russian-speaking Ukrainians as the bases for creating an unavoidable reality for target societies. As such, an informative campaign has been used as a non-military operation to develop influence by amplifying linguistic and cultural differences within Ukraine. 60
Russia has used economic pressure, such as a ban on Ukrainian imports, gas wars (cutting off rising gas supplies at rising prices for nonRussian countries), political instruments such as supporting pro-Russian social and political movements aimed at the integration of Ukraine with Russia, and dissatisfaction with Ukraine’s European integration; drawing Ukraine closer to Russia, direct support for the pro-Russian presidential candidate, Yanukovich (Putin’s visits to Ukraine), delegitimisation of Ukrainian statehood; scholars and spreading the idea of discrimination of Russian-speaking minority rights and using proRussian proxies and Russian servicemen to seize Crimea and eastern Ukraine.
Paramilitary forces and terrorist attacks in hybrid warfare. Case of Ukraine
Russia has used several types of paramilitary forces in hybrid and conventional warfare against Ukraine. All paramilitary formations and units of any type operate in a comprehensive, holistic manner under Russian military command, with support from appropriate military or intelligence units. These paramilitary groups acted as a cover for Russian military forces during the hybrid warfare operations. The intention to utilize them was to deny the direct participation of Russia and support its propaganda efforts to insist on an ostensibly internal conflict among the Ukrainian population.
These groups served several key functions:
- Acting as a “screen” and human shield for regular Russian military forces.
- Seizing strategic facilities, government buildings, and Ukrainian military bases.
- Suppressing opposition and independent mediar.
- Participating in the capture of Ukrainian state and private critical infrastructure assets.
A. Private military companies (PMC)
Wagner is the most famous Russian PMC. PMCs are not formally recognized by the law. At the same time, some norms in Russian legislation allow the creation of such companies under the umbrella of security or intelligence agencies.
Wagner emerged from earlier Russian private military company entities, including those active in Syria in 2013. During this period, Russia explored the utilization of PMCs, examining their roles and relationships with the state. Russian military intelligence, specifically the Main Directorate of the General Staff (GU), reportedly played a role in establishing and overseeing the Wagner Group, including creating training centers near GU Spetsnaz (elite reconnaissance and sabotage units) bases. Wagner syndrome was first recognized as an entity in 2014. It participated in Russia’s annexation and occupation of Crimea, Ukraine.61 The group was involved in Russia’s military operations in eastern Ukraine from 2015 to 2023. Other Russian PMCs used in the warfare against Ukraine include the Black Sea, Slavic Corps, Veteran, and Patriot.
B. So-called “self-defense forces,” which were ostensibly created by locals to protect themselves from national authorities
Conditionally, “self-defense forces” can be divided into two kinds: those with clear political affiliation with local pro-Russia political parties and those without visible political affiliation. For instance, in January 2014, several “self-defense” units were formed in Crimea62 of both types: “Rubezh volunteer formation” created by a former Ministry of Interior’s serviceman, whose father was a Russian Navy officer reassigned from Russian city Murmansk to Sevastopol, and the “Self-defense of Crimea”, created by the Russian Unity Party, which was a Ukrainian political party registered under Ukrainian law. The latter was publicly supported in February 2014 by a member of Parliament of the Russian Federation, Aleksey Zhuravlev, the Leader of the Motherland Party of Russia; the two political parties signed an accord about the creation of an “Anti-fascist Slavic Front.’ The Rubezh volunteer formation played a leading role in seizing the Ukrainian Black Sea Fleet with the concealed support of Russian SOF.
During the Dignity Revolution (late 2013–beginning of 2014), regional officials of Crimea organized and sent thousands of people to Kyiv, the capital of Ukraine, by train and bus to support the pro-Russian government in cracking down on pro-European protests there. Many former servicemen of Russia’s Black Fleet were among them, who later became “building material” for the self-defense forces. There were also a limited number of former Russian intelligence and security agency officers who lived or stayed in Ukraine without any surveillance or control from Ukrainian counterintelligence. Some Ukrainian Afghanistan War veterans and their co-servicemen or members of partnerial organizations from Russia participated in self-defense units.
Paramilitary formations of this type are usually better trained, armed, and united due to their previous experience, well-connected to the Russian Armed Forces or related security or intelligence agencies, and suited for military, subversive, or sabotage actions.
C. Russian Cossacks
The Cossacks can be used as a substitute or supportive force for taking military or police functions. Russian Cossacks, in accordance with Russian legislation, are required to be registered and incorporated into legal entities with a specific status. The Russian Federation’s State Policy Strategy for the Russian Cossacks (2021–2030) grants registered Cossack organizations a distinct legal status, formalizing their dual role as cultural entities and state security partners whose members are legally obligated to perform state service. This strategy explicitly prioritizes the Cossacks’ participation in defense, border security, and maintaining public order, effectively utilizing this identity group as a state-subsidized security auxiliary force. The emphasis on military-patriotic education through the Cossack cadet corps underscores the state’s intent to institutionalize the Cossacks as a continuous source of personnel and ideological influence for national security objectives. There are multiple Cossack units from different regions of Russia, including Kuban, Don, Orenburg, Terek, Siberian, and Astrakhan Cossacks. According to the All-Russian Cossack Society, Cossack units played a crucial paramilitary role during the February–March 2014 annexation of Crimea, with members from the Kuban, Don, Terek, and other voiskos entering the peninsula to reinforce local forces. These groups, often crossing the border under various pretexts like “pilgrimages” or “scientific research,” secured key checkpoints, transport hubs (including Simferopol airport), and government buildings, effectively acting as “local militias” (opolchentsy) to deter Ukrainian military forces and pro-Ukrainian groups. By coordinating with the Russian Black Sea Fleet command and local security structures, the Cossack presence was instrumental in providing armed support and ensuring public order during the transition and the subsequent “referendum.”
Cossacks were particularly widely used also in Luhansk oblast. As early as in the 17th century, several Cossack settlements were formed on this territory, and this fact was used as an additional pretext to justify the allegedly “special historical ties” between Luhansk oblast and Russia. For example, in the name of rural settlement Stanytsia Luhanska the first word alludes to a unit of political and economic organization of Cossacks in the Russian Empire.
One of the examples is the use of “Cossack” paramilitary units that enjoy privileged position in Russia, are governed by a special law and viewed as an ideologically driven instrument of the state, conservative in spirit and heavy-handed in tactics. It is not uncommon to involve Cossacks in keeping of public order (as was the case, for example, during the Soccer World Cup 2018 in Moscow).
Notably, that Russian soft-power institutions in Serbia strategically foreground the historical legacy of Imperial Russian Cossacks who resettled in the region, promoting narratives that emphasize their role in Serbian settlements, collaboration with locals, and strong connection to the Orthodox Church as a basis for contemporary political and cultural alignment.63
D. Members of sports clubs, mostly of fighting sports
Fighting arts sports clubs have become an effective tool of soft power and covert mobilization for Russia. One of the most notable examples is SC “Oplot,” which actively participated in anti-Maidan movements and the undermining of Ukrainian sovereignty. SC “Oplot” was founded in 2011 in Kharkiv by Yevhen Zhilin, who was declared wanted after 2014. During the Revolution of Dignity (so-called Maidan), its members were part of groups whose main goal was to destabilize public order and provoke actions against the participants of the Revolution of Dignity, as well as to pressure and intimidate activists. In Ukraine, such individuals came to be known as “titushky”— after the last name of one of the first members of such types of groups. For example, on January 21, 2014, “Oplot” members transported young men to Kyiv, armed with rebar, to involve them in violent acts against Maidan participants. One of the members, Tavakkul Rahimov, who was already working in law enforcement, introduced himself in court as a “brigadier” and was connected to Zhilin and “Oplot.” Later, it was transformed into a unit of the same name.
E. Russian biker clubs
The biker club “Night Wolves” have been promoting the greatness of the Russian people for decades, including the victory in the “Great Patriotic War” and fraternal Slavic ties, including in the Balkans. The Night Wolves came into being in 1983 as a group of anti-establishment rock music fans and motorcycle enthusiasts. In May 1989, the group formally became known as the Night Wolves MC. During the initial years, the group provided security at rock concerts, and is believed to have operated a protection racket on behalf of an organized crime group. By the early-1990s, Alexander Zaldostanov, known as the “Surgeon”, assumed the leadership of the Night Wolves. It was also during this period that the group went through an initial transformation, changing from a seemingly anti-establishment biker club to an organization with subtle patriotic leanings64 Over the last decade, the relationship between the Night Wolves and the Russian Orthodox Church has strengthened significantly. For example, the Night Wolves sponsor motorcycle pilgrimages to holy sites, and Zaldostanov meets regularly with Patriarch Kirill, the leader of the Russian Orthodox Church and a former KGB agent, to discuss cohosting patriotic events. Club members have also defended the church against protests.65 In addition, the organization was heavily involved in Russia’s operations to occupy part of Ukraine in 2014.
According to US Department of Treasure the Night Wolves biker group had its members serve in the Crimean self-defense forces as early as February 2014 against the Government of Ukraine. In March 2014, the Night Wolves conducted intimidation and criminal activities within Ukraine and also abducted and subsequently assaulted a Ukrainian Border Guard official. This biker group also participated in the storming of the gas distribution station in Strikolkove and the storming of the Ukrainian Naval Forces Headquarters in Sevastopol. In early-April 2014, the Night Wolves helped smuggle a former senior Ukrainian official out of Ukraine and also helped obtain Russian passports for another larger group of senior Ukrainian officials that they helped get into Russia. The Night Wolves have been closely connected to the Russian special services, have helped to recruit separatist fighters for Donetsk and Luhansk, Ukraine, and were deployed to the cities of Luhansk and Kharkiv.66
According to the club’s official website, as of August 2025, it has 125 branches in the Russian Federation and in the occupied regions of Ukraine, as well as more than 20 branches abroad, including Bulgaria, Serbia, Montenegro, Romania, North Macedonia, Poland, as well as the Republic of Srpska, and the unrecognized Transnistria (Moldova).6768
F. Criminal organizations
One of the tools in the hands of Russia’s intelligence agencies is criminal organizations. The case study below demonstrates how Russian intelligence services integrated criminal networks into their hybrid warfare strategy against Ukraine, particularly targeting critical institutions, such as the prison system.
In March 2025, The National Police of Ukraine issued suspicion notices to several crime bosses (“thieves in law”) and a criminal for spreading criminal influence during an organized meeting in Kyiv’s pre-trial detention center. The suspects include natives of Georgia, Kazakhstan, and a Russian citizen, two of whom are known by the nicknames “Bondo” and “Aziz.” Aziz is a 58-year-old Russian citizen and “thief in law” (rus.: Vor v Zakone) who received his criminal status in Moscow in 1993. He was convicted in Kyrgyzstan for murdering government officials and organizing prison riots. Aziz was released from prison through a fake medical diagnosis. Aziz is connected to Ramzan Kadyrov, the leader of Chechnya region of Russia. According to Ukrainian authorities, he now works with Russian intelligence and is currently located in Chechnya. His current activities involve attempting to destabilize Ukrainian penal institutions by organizing riots with his trusted associates. The suspects organized a remote meeting where they granted a Kyiv detention center inmate the status of “wanderer” for his “criminal world” merits. This operation was conducted by the Department of Strategic Investigations and investigators of the National Police in cooperation with prosecutors and the State Criminal Executive Service of Ukraine. Bondo is also a “thief in law” who was born in Georgia and “crowned” (given criminal authority status) in Rome in 2013. He was previously convicted of attempting to organize riots in prisons in Kazakhstan.69
This case study, along with other open sources, provides an understanding of the operational and tactical approaches of Russian intelligence services employed through criminal networks.
- Use of “Thieves in Law”: Russian intelligence services control influential crime bosses who coordinate activities from safe locations in Russia and former Soviet states
- Prison System Targeting: They specifically focus on destabilizing Ukrainian prisons and detention centers through their criminal proxies
- Hierarchy Exploitation: They utilize the established criminal hierarchy, with crime bosses directing trusted associates inside Ukrainian facilities
- Strategic Placement: Their agents coordinate with detained criminals who can influence other inmates and maintain criminal “traditions”
- Regional Coordination: The network operates across multiple regions, with identified activities in Kyiv and other major cities
The key countermeasures by the Ukrainian authorities include the following:
- Joint operations between law-enforcement and intelligence agencies as well as correctional service
- Close monitoring of criminal networks and their communications
- Swift legal action against identified criminal leaders and their associates
- International cooperation between lawenforcement and intelligence agencies
A stark example of the Russian Federation’s integration of criminal figures into subversive activities and active combat operations against Ukraine is the case of Armen Sargsyan, widely known by his criminal alias, “Gorlovsky”. Sargsyan, an individual with a documented history as a criminal authority, transitioned to a military role as the commander of the “ArBat” Battalion. Born in Armenia, he relocated to Horlivka (Donetsk Oblast) in childhood. Beginning in the 1990s, he built a criminal network in Horlivka, controlling shadow economies in the region and later working with Yenakiieve’s criminal structures in the early 2000s.
During the Euromaidan events in 2014, Sargsyan was a key organizer of the “Titushky” groups—thugs used to attack and intimidate anti-government protestors. In the summer of 2022, he founded the “ArBat” (Armenian Battalion), a paramilitary unit that was later formally incorporated into the Russian Armed Forces’ “Piatnashka” brigade. The battalion initially operated on the Donetsk front but was subsequently redeployed to the Kursk Oblast following a Ukrainian incursion. Armen Sargsyan was killed on February 3, 2025, in an explosion at the elite residential complex “Alye Parusa” in Moscow.
This tactic echoed the model of using in 2014 key individuals connected to Russian security services. The first one os Igor Strelkov (Girkin): A former officer of Russia’s Federal Security Service (FSB), Strelkov arrived in Crimea on February 21, 2014, where he coordinated the “self-defense of Crimea” units, which were subordinated to Russian militaryand intelligence commanders. He later admitted to participating in coercing local deputies to vote for the annexation referendum. Following his activities in Crimea, Strelkov, reportedly using an FSB-issued cover document, led the seizure of administrative buildings in Sloviansk in April 2014, becoming a prominent commander in the Donbas conflict.
Another notable person is Igor Bezler (“Bes”or “Demon”). Identified as an agent of Russia’s Main Intelligence Directorate (GRU), Bezler, a Crimean native, commanded a militia company in the peninsula and participated in storming Ukrainian military units. Following the Crimea seizure, Bezler became a prominent field commander, operating primarily in Horlivka. According to Ukrainian authorities, both were considered Russian agents, with Strelkov himself admitting he was a Russian agent until the year before these events.
The Case of Kosovo: Parallels with Ukraine
Since the end of the war in Kosovo, the north of Kosovo has remained divided along ethnic lines. The region’s disputed status, combined with the persistence of parallel institutions often supported by Serbia,70 has enabled a form of self-governance that creates a permissive environment for illicit activities involving both Serbs and Albanians.71 The north of Kosovo has long functioned as a buffer zone between Kosovo and Serbia, facilitating the smuggling of goods, medicines, cigarettes, alcohol, and drugs. While organized criminal groups carry out some trafficking, much of it involves private individuals transporting appliances, medicines, food items, and alcoholic beverages from Serbia. The weak rule of law and the availability of free electricity have also reportedly made the region a lucrative hub for cryptocurrency mining.72
Politics in the north has long been dominated by a single political party, Srpska Lista, which maintains close ties to the Serbian Progressive Party led by President Aleksandar Vučić. Milan Radoičić, the party’s former deputy leader, was involved in the Banjska terrorist attack. Despite this, he continues to be sheltered in Serbia, which has refused to extradite him to Kosovo. Vučić has repeatedly defended Radoičić, even in the face of serious accusations, asserting that Radoičić and “our people from the north” are being persecuted and insisting that being on wanted lists or subject to sanctions does not constitute proof of guilt.73
Prior to the Banjska attack, Radoičić was already widely known for his involvement in organized crime in the north of Kosovo. In 2019, Radoičić and Zvonko Veselinović were indicted for allegedly leading an organized criminal group responsible for the assassination of rival Kosovo Serb politician Oliver Ivanović in January 2018.74 After the assassination of Ivanovic, Srpska Lista effectively became the sole political voice for Kosovo Serbs, significantly reducing political pluralism within the community. This consolidation has allowed Vučić to leverage the party to advance his political agenda and prioritize interests aligned with his strategic and personal goals.
Organized crime groups, reportedly linked to political elites in Serbia and led by figures such as Radoičić, have played a significant role in undermining the integration of the Serbian community into Kosovo’s institutions. Examples include the mass resignations of Serb members from the Kosovo Security Force (KSF) in 2018 following intimidation campaigns; documented connections between criminal groups and police structures in North Mitrovica; calls by Radoičić and his associates to boycott local elections in northern municipalities; and incidents such as the burning of cars with Kosovo license plates owned by Serb citizens.75
In June 2023, the Kosovo government designated two groups the Civil Protection (Civilna Zaštita) and the North Brigade (Severna Brigada) as terrorist organizations, citing their extremist agendas aimed at destabilizing Kosovo’s constitutional order. The decision followed unrest in the northen municipalities in which more than 30 members of the NATO-led KFOR mission were injured. Although these groups remain disruptive, Kosovo has begun establishing institutional mechanisms to counter such security threats.76
The government stated that these organizations had engaged in activities “with terrorist elements,” including armed attacks on the Kosovo Police, EULEX, and KFOR; recruitment and training of members in military-style bases (allegedly in Serbia); intimidation of citizens and political actors; and attempts to obstruct or prevent the implementation of state decisions in the north.77
Using paramilitaries and proxies for the terrorist attacks in Kosovo
In the north village of Banjska, a heavily armed and highly equipped terrorist group launched a military attack on September 24, 2023, which took place in the early morning hours, with the entry of the Serbian terrorist group into Kosovo from Serbia through illegal mountain roads in an organized manner.78 In the north village of Banjskë, Kosovo, a heavily armed and highly equipped terrorist group launched a military attack on September 24, resulting in the death of one police officer and the wounding of another.79 Following the attack on the Kosovo Police, approximately 30 heavily armed and masked members of the Serbian terrorist group fled to the Banjska Monastery, using the religious compound as a temporary hideout while continuing to fire on Kosovo Police from a distance. Three of the insurgents were killed in a shootout with the Kosovo Police, while three others were apprehended by law enforcement.80
This well-organized attack was a clear act of aggression against Kosovo’s territorial integrity and national security, significantly heightening the risk of inter-ethnic conflict. Kosovo authorities have presented compelling evidence that Serbia supported this attack, implicating Milan Radoičić, then Vice President of Srpska Lista and a figure on the US blacklist, as a key orchestrator of the operation.
It is necessary to highlight specific events to capture the broader picture of what was happening in the north of Kosovo several months before the Banjska incident. On April 23, 2023, local elections were held in four municipalities in northern Kosovo. The dominant Serb-majority party in the north, Srpska Lista, boycotted the elections, and turnout was very low.81 Soon after that year, on May 26, 2024, Serbs attempted to block newly elected officials, including those in the Zvecan municipality, where the village of Banjska is located, from taking control of municipal buildings. This prompted the Kosovo police to use tear gas to disperse the mobs. Serb protesters, including groups of masked men, attacked journalists and NATO peacekeepers, leaving more than 30 of them injured. The protesters vandalized and marked vehicles of NATO and the KP with the “Z” symbol used by Russian forces invading Ukraine since 2022. The same day, the President of Serbia put the Serbian Armed Forces on full combat alert and ordered its units to move closer to the border with Kosovo.82
The Kosovo Police seized a large arsenal of weapons, including armored vehicles, firearms, explosives, drones, rocket launchers, antipersonnel mines, uniforms, and other logistical equipment.83 They also discovered supplies intended to sustain the attackers for an extended period. Drone footage presented as evidence shows Radoičić’s involvement in organizing the attack, as well as the group’s preparation, training, and exercises conducted at military bases in Paulićke Doline and Kopaonik. Furthermore, forty-five suspects, including Milan Radoičić, have been indicted by Kosovo’s Special Prosecution in connection with the Banjska terrorist attack.84 On September 11, 2024, the Special Prosecution filed an indictment against these 45 individuals.85 According to the Special Prosecution, Radojčić is suspected of financing terrorism and money laundering, while in Banjska, he and his armed terrorist group intended to secede the north of Kosovo and annex it to Serbia. Despite the evidence, Serbian officials, including President Aleksandar Vučić, denied involvement and shifted the blame to Kosovo’s Prime Minister, Albin Kurti, framing the attack as a local uprising against alleged oppressive policies.
The Banjska attack represents the most significant threat to Kosovo’s national security since its independence. Following the attack, Serbia deployed troops near Kosovo’s border, heightening fears of a potential military confrontation. Both Kosovo and the United States called for the de-escalation of tensions and the withdrawal of Serbian forces, underlining the fragility of the security environment in the Western Balkans, which the EU has been trying to stabilize through dialogue.
Meanwhile, the United States Embassy in Kosovo, in its response, strongly condemned this attack, supporting the Kosovo Police, which has full legitimacy to enforce the rule of law in Kosovo. The American Embassy had called for the perpetrators of this attack to be brought to justice. Following the US Embassy in Kosovo, other international embassies and missions had also reacted against the terrorist attack.86
The attack on the Critical Infrastructure – Case of Kosovo. Iber Lepence
After the terrorist attack in the village of Banjskë, another attack targeted Kosovo’s critical infrastructure, affecting both Albanian and Serbian citizens living in the north of Kosovo and in various other regions of Kosovo. This attack severely threatened essential public services, particularly water and energy supplies.87 Following the explosion of the canal in Ibër-Lepenc, the water flow from the damaged canal began spilling uncontrollably. Consequently, the Regional Water Supply Company “Mitrovica” announced an immediate halt to the drinking water supply due to the canal damage. The attack on Ibër-Lepenc directly impacted vital resources. The system supplies water to several cities through Lake Ujman and plays a crucial role in cooling Kosovo’s power plants. The perpetrators aimed to trigger a major water crisis and create energy instability in the country.
Kosovo’s institutions responded swiftly to repair the damage, thereby preventing a potential crisis in water and electricity supply. The damage caused by the explosion in the Ibër-Lepenc water supply network was restored, although not completely, in a short time by the relevant Kosovo institutions to ensure a regular supply of electricity for the country, in order to cool the power plants, as well as to avoid possible problems with the central heating system for the citizens of Pristina.88
The terrorist attack in Iber Lepence occurred a day after Russia launched missile and drone strikes targeting critical infrastructure across Ukraine, including its energy generation and distribution systems, particularly in its westernmost regions.89 This timing raises concerns about possible coordination or influence, prompting questions about whether the attack was organized in connection with Russia as part of its hybrid attacks in the region.
The Kosovo Security Council has linked the terrorist attack in Ibër-Lepenc to similar Russian attacks in Ukraine on Ukrainian energy capacities on the eve of winter. They have pointed out that: “Elements of the terrorist organizations ‘Civil Protection’ and ‘Northern Brigade,’ along with the chief criminal Milan Radoičić, under the direction of the President and Government of Serbia, plan and train in Serbia for such professional attacks. A possible connection was also highlighted with the attacks carried out this week by the aggressor Russia in Ukraine against energy infrastructure, which left over one million Ukrainian households without electricity just on the eve of winter.’’90 The international community strongly condemned the act of terrorism, including the heads of NATO91 and the EU, while Serbian officials in Belgrade denied any involvement.92
According to the Special Prosecution of the Republic of Kosovo, there is a well-founded suspicion that on November 29, 2024, around 18:50, in the village of Varage, Municipality of Zubin Potok, specifically in the section of the IbërLepenc channel used to supply drinking water to citizens of the Republic of Kosovo and to provide water for the country’s power plants, the suspect Jovan Viqentijević, acting together with his brother, the suspect Dragisha Viqentijević, intentionally damaged public water supply infrastructure. Their actions, carried out with the intent to seriously disturb residents and undermine the constitutional order and public security of the Republic of Kosovo, constituted a terrorist act through the use of explosives directly targeting the channel and its concrete infrastructure.93 The Prishtina Court has extended the pre-trial detention for another two months for the two defendants, Dragisha Viqentijević and Jovan Viqentijević, who are suspected of carrying out the terrorist attack on the Ibër-Lepenc water channel in the Zubin Potok area.94
The attack on the Critical Infrastructure – Case of Ukraine
In late 2013 and January 2014, during the Dignity Revolution, cyberattacks targeted Ukrainian institutions. Over 22 government agencies and private enterprises were infected with the “Uroboros” computer worm, which was designed to steal information, including personal data and access passwords.95
During the annexation period in 2014, Russia’s cyber operations were coordinated with military and political actions. The occupying forces systematically worked to control information flow by blocking independent media outlets and journalists from operating, preventing Ukrainian and international journalists from entering Crimea, seizing equipment, and physically intimidating journalists who tried to document events.
In late February 2014, Russian intelligence and SOF were concerned about mobile and land networks being blocked to hinder Ukrainian revolutionary officials from managing the situation in Crimea. The Russian forces specifically prepared the selfdefense groups for this scenario. In preparation for potential communication disruptions, groups such as the Sevastopol self-defense units purchased radio equipment and maintained contact through automobile enthusiast radio channels.
In the early stages of Crimea’s occupation, which started in February 2014, there were several key events related to Russian actions to establish communications and information control.
- Initial physical control of important critical infrastructure objects and the territories where they are situated:
On February 23, the Russian forces took control of Sevastopol City.
On February 25, Russian Cossack formations moved to the peninsula through the Kerch Strait, with Russian military personnel disguised among them.
- Initial telecommunications disruption (early March 2014):
Russian forces cut internet connections between Crimea and mainland Ukraine.
«Unidentified» individuals seized local Ukrtelecom96 offices and cut the phone and Internet cables.
Equipment was illegally installed at Ukrtelecom in Crimea to block the phones of Ukrainian parliament members, regardless of their political affiliation.
Russian forces sabotaged Ukrainian naval communication stations around Sevastopol City.
- Control of Information Space (March 1-3, 2014):
Beginning March 1, multiple documented cases of interference with journalists’ work were reported.
On March 3, “self-defense” forces seized the Crimean Radio and Television Transmission Center, which led to the replacement of Ukrainian TV channels with Russian state media within a week. Only Russian media were allowed to operate freely.
In April 2014, Ukrainian mobile subscribers were targeted by suspicious SS797 packets from Russian telecom networks for three days. The attack intercepted calls by forwarding them to a landline in St. Petersburg, Russia, without the users’ knowledge. The SS7 packets originated from addresses assigned to MTS Russia and Rostov Cellular Communications, although MTS Russia denied involvement. Multiple Ukrainian operators, including Astelit and Kyivstar, were affected, suggesting that a broader targeting campaign was underway. The incident sparked an “SS7 arms race,” with Ukraine proposing legislation to conduct similar surveillance on foreign mobile operators. Although SS7 attacks require significant technical expertise and network access and are widely acknowledged, they still represent a real threat.
Many experts believe that the SS7 vulnerability was used in February 2014, when there was a notable incident likely involving Victoria Nuland, then a senior U.S. State Department official. A confidential phone conversation, presumably between Ms. Nuland and then US Ambassador to Ukraine Geoffrey Pyatt, was intercepted and leaked on YouTube. The conversation appeared to have taken place over an unsecured phone line. While U.S. officials suspected that the interception occurred in Ukraine, Russia was believed to be behind the hacking. After being recorded, the phone conversation was immediately posted on YouTube, swiftly spread widely by Russia’s state-owned media, and finally commented on by Russian MPs.
This incident was significant because it exposed sensitive diplomatic communications and highlighted vulnerabilities in telecommunications security. In the intercepted conversation, Victoria Nuland supposedly spoke disparagingly about the European Union. This disrespectful commentary about a key ally caused diplomatic tension at a sensitive time during the Ukraine crisis. It aimed to undermine the West’s collective efforts to restore Ukrainian democracy. Moreover, the voice supposedly belonged to Nuland, who made some comments that could have been seen as preferable for one of the thenopposition leaders leading the protests against the government, intending to dismantle the unity of the opposition forces.
60 Illia Ilin, and Olena Nohmatova, Exploring Russia’s Postponed War Against Ukraine: A Corpus-Based Analysis of Strategic Studies Institutes Publications from 1991 to 2014, Central European Journal of International and Security Studies, 17/4, 2023).
61 Russia’s Wagner Private Military Company (PMC). The Congressional Research Service. Updated August 1, 2023.
62 Formally, the Crimean region and the city of Sevastopol are two single administrative units located on the Crimean Peninsula. In this report, Crimea means both together in most cases, unless they are mentioned separately
63 RUSSIANS in Serbia / [authors Arsenyev Alexey Borisovich … et al.; editor-in-chief A. A. Maksakov]. – Belgrade: Vesna info: Coordination Council of Russian Compatriots in Serbia, 2009 (Belgrade: Atel>e Bogdanović). – p.97-116
64 Matthew A. Lauder, ‘Wolves of the Russian Spring’: An Examination of the Night Wolves as a Proxy for the Russian Government – Canadian Military Journal • Vol. 18, No. 3, Summer 2018 https://www.journal.forces.gc.ca/vol18/no3/PDF/CMJ183Ep5.pdf
65 Ibid
66 U.S. Department of the Treasury, Treasury Targets Additional Ukrainian Separatists and Russian Individuals and Entities, December 2014, https://home.treasury.gov/news/press-releases/jl9729
67 See: https://nightwolves.ru/nw/about/offices.php?PAGEN_1=7
68 As of 2018, Matthew A. Lauder, ‘Wolves of the Russian Spring’: An Examination of the Night Wolves as a Proxy for the Russian Government – Canadian Military Journal • Vol. 18, No. 3, Summer 2018 https://www.journal.forces.gc.ca/vol18/no3/PDF/CMJ183Ep5.pdf
69 National Police of Ukraine, March 2025, https://npu.gov.ua/news/natspolitsiia-povidomyla-pidozry-voramv-zakoni-ta-kryminalnyku-za-poshyrennia-zlochynnohovplyvu-na-orhanizovanii-skhodtsi-v-kyivskomu-sizo
70 Global Initiative, Against Transnational Organize Crime, “Links between politics, ethnicity and organize crime in northern Kosovo, 2021, https://riskbulletins.globalinitiative.net/see-obs-011/01-politics-ethnicity-organized-crime-innorthern-kosovo.html
71 Walter Kemp, Mark Shaw and Arthur Boutellis, The elephant in the room: How can peace operations deal with organized crime?, International Peace Institute, 3 June 2013, 46–55, https://www.ipinst.org/wp-content/uploads/2013/06/elephant_in_the_room.pdf.
72 Adelina Ahmeti and Kreshnik Gashi, In North Kosovo, mining for Bitcoin on ‘free’ electricity, BalkanInsight, 12 May 2021, https://balkaninsight.com/2021/05/12/in-northkosovo-mining-for-bitcoin-on-free-electricity/.
73 Radio Free Europe, 2023, https://www.slobodnaevropa.org/a/vucic-radoicic-izjave/32612617.html
74 Radio Free Europe, 23 August 2019, https://www.slobodnaevropa.org/a/pristina-sud-radoicicivanovic/30125833.html
75 Prishtina Insights, 2023, https://prishtinainsight.com/arrest-of-serb-for-attacking-policemen-and-burning-cars-innorth-of-kosovo-sparks-reactions/
76 Who are the extreme right in the Balkan, Balkan Insight, https://balkaninsight.com/extreme-right-organisations/kosovo.php
77 Koha.net, 2023, https://www.koha.net/en/arberi/mbrojtja-civile-dhe-brigada-e-veriut-shpallen-organizataterroriste
78 Special Prosecution of the Republic of Kosovo. PPS. nr.75/2023, 11 September 2024, Indictment for
the attack in Banjska.
79 Special Prosecution of the Republic of Kosovo. PPS. nr.75/2023, September 11, 2024, Indictment for the attack in Banjska
80 Koha.net, 2023, https://www.koha.net/arberi/videoja-e-sulmuesve-serbe-gjate-levizjeve-ne-manastirine-banjskes.
81 Radio Free Europe, 2023, https://www.rferl.org/a/kosovo-serbs-special-elections-oycott/32375661.html
82 Chernysh, Vadym. “Intelligence As an Instrument of National Power: Lessons Learned from the Tensions between Serbia and Kosovo.” Journal of Strategic Security 18, no. 3 (2025): 25-41.
83 Adelina Hasani, “Unveiling the Parallel: Serbia’s Failed Attempt to Imitate Russia’s Strategy with
Neighbors,”Prishtina Insight, 2023,
84 Special Prosecution of the Republic of Kosovo. PPS. nr.75/2023, 11 September 2024, Indictment for
the attack in Banjska.
85 Special Prosecution of the Republic of Kosovo. PPS. nr.75/2023, September 11, 2024, Indictment for the attack in Banjska
86 Koha Net. Radojčić admits organizing terrorist attack in Banjska. September 29, 2023.
87 Koha.net, https://www.koha.net/kronike/shperthim-nekanalin-e-iber-lepencit-ne-zubin-potok, September 1, 2025.
88 Telegrafi, https://telegrafi.com/rizvanolli-eshtesiguruar-furnizimi-rregullt-energji-elektrike-iberlepenci-ne-afat-rekord-ka-vendosur-gjashte-tuba-teperkohshem/ November 1, 2025.
89 Amnesty International, https://www.amnestyusa.org/press-releases/russia-ukraine-latest-massive-missilestrike-on-critical-infrastructure-is-a-war-crime/ November 1, 2025.
90 Office of the Prime Minister of Kosovo. The Security Council of the Republic of Kosovo holds an extraordinary meeting. November 20, 2025.
91 A2, CNN, https://a2news.com/english/rajoni-bota/kosova/politike/shefi-i-nato-s-reagon-per-in-ne-iberlepenc-perg-i1135558 September 1, 2025.
92 Radio Free Europe, https://www.rferl.org/a/explosion-damages-iber-lepenc-canal-kosovo-serbiaattack-/33221440.html, October 20, 2025.
93 Betimi per drejtesi, https://betimiperdrejtesi.com/ekskluzive-dosja-e-prokurorise-vellezerit-viqentijeviqdyshohen-se-kryen-vepren-terroriste-duke-perdorureksploziv-ne-kanalin-e-iber-lepencit/ September 20, 2025.
94 Kallxo, 2025, https://kallxo.com/ligji/gjykata/dyte-dyshuarve-per-sulmin-terrorist-ne-iber-lepenc-uvazhdohet-paraburgimi-edhe-per-dy-muaj/
95 Ministry of Defense of Ukraine, Cyberattacks by the Russian Federation. Chronology, May 2018 https://web.archive.org/web/20200115203102/https://www.mil.gov.ua/ukbs/kiberataki-rosijskoi-federaczii-hronologiya.html
96 Ukrtelecom is a Ukrainian telecommunications company that provides telephone services, Internet access, and television.
97 SS7 (Signaling System No. 7) is a set of protocols developed in the 1970s that regulates data exchange between different telephone network operators. It was created to track and connect calls across different networks and is now used for mobile billing, SMS messaging, and call routing between operators
THE FULL RESEARCH IS AVAILABLE AT
Photo: Members of the Night Wolves attending a burial service for Soviet soldiers in Crimea, 30 October 2014.
Photo source: Canadian Military Journal • Vol. 18, No. 3, Summer 2018