Europe’s New Hybrid Threat: When Russian Intelligence Turns to Criminal Networks

Investigators are examining whether the attack was commissioned by Russian intelligence and carried out through intermediaries linked to the Turkish criminal organisation known as the Daltons. The allegations remain under investigation, and the Stuttgart Higher Regional Court must decide on the two men's extradition to Poland.

The case points to a difficult question for European governments. If foreign intelligence services can recruit criminal organisations to attack strategic infrastructure, the distinction between counterintelligence and conventional crime-fighting becomes increasingly difficult to maintain.

From disposable recruits to professional intermediaries

For several years, European authorities have warned about sabotage operations involving low-level operatives recruited online to carry out relatively simple tasks, including arson and vandalism. Such arrangements offer an intelligence service a cheap, deniable way to cause disruption. Recruits may have little understanding of the wider operation, while the people directing them remain distant from the physical act.

The suspected involvement of the Daltons would represent a more sophisticated approach.

The Turkish criminal network operates in Turkey, Germany, and other European countries. It has been associated with extortion, drug trafficking, arms dealing and contract killings. If its members were involved in the Polish attack, they would bring an existing criminal infrastructure into a potential state-sponsored operation: contacts across jurisdictions, experience in clandestine activity and a capacity for intimidation that an improvised group of online recruits might lack.

That distinction matters. A person recruited for a single act of arson can be replaced relatively easily, but a criminal organisation offers relationships and operational capabilities that already exist. It may be able to identify personnel, arrange movements and maintain secrecy without building a new network for every assignment.

The strategic advantage for a state sponsor is plausible deniability. Investigators encountering a criminal intermediary must establish not only who carried out an attack but also whether the operation was commissioned, facilitated, or directed by a foreign intelligence service. The more layers between the sponsor and the perpetrators, the harder that chain of responsibility can be to prove.

Yet the same arrangement creates dependencies. Criminal groups have their own commercial interests, rivalries and internal power structures. Their participation does not, by itself, establish that a foreign government controls them. The central investigative challenge is to distinguish a genuine intelligence relationship from criminal activity that happens to serve a state's interests.

In Wola Krobowska, that distinction is at the heart of the case.

The Russian connection remains the critical link

Polish Special Services Coordinator Tomasz Semoniak has said Warsaw does not doubt that Russian intelligence orchestrated the sabotage. Investigative reporting by Der Spiegel, drawing on multinational reporting and independent security sources, has linked the Turkish suspects to the Daltons and raised the possibility that the group received a contract from Russian intelligence.

One element attracting the attention of security agencies is the reported treatment of the syndicate's alleged leader, Beratcan Gökdemir.

Gökdemir was arrested in Russia in 2024. According to the allegations outlined in the investigation, Moscow did not extradite him to Turkey despite Ankara's request, instead sheltering and protecting him in circumstances that have prompted questions about possible cooperation with Russian intelligence.

The episode, if the alleged relationship can be substantiated, offers a possible explanation for how a state might cultivate criminal intermediaries without formally incorporating them into its intelligence apparatus. Protection from prosecution or extradition could provide leverage over a network whose members otherwise operate beyond conventional state structures.

But the distinction between circumstantial evidence and proof is essential. Moscow's alleged protection of a criminal leader does not establish that the Daltons were ordered to attack the Polish facility. Nor does a suspected connection between the arrested men and the group independently prove Russian direction.

Investigators must establish the operational chain: who commissioned the attack, who arranged its execution, what instructions were passed to the perpetrators, and what evidence connects those decisions to a state intelligence service.

That process is likely to be more complicated than identifying the people who physically set a fire. It also explains why the case matters beyond the fate of three suspects. The investigation could help determine whether organised crime is becoming a more systematic instrument of foreign state activity in Europe.

Why a satellite ground station matters

The target was not an ordinary telecommunications installation.

The facility in Wola Krobowska, operated by Poland's state-owned Exatel, houses power distribution equipment and a generator serving a ground-based Starlink satellite network station. It acts as a regional data-routing hub supporting connectivity across Central and Eastern Europe, including civilian services and military coordination in Ukraine.

The fire on 23 September damaged the electrical distribution equipment and generator. It did not cause widespread internet blackouts, limiting its immediate visible impact.

That relative lack of disruption should not obscure the strategic significance of the target. Ukraine's military relies heavily on Starlink terminals for tactical communications and defence coordination. Ground infrastructure outside Ukrainian territory forms part of the wider communications environment on which that connectivity depends.

A facility does not need to be destroyed completely to become a useful target. Damage to supporting systems can create operational vulnerabilities, require repairs and force operators to consider how reliably essential services can be maintained during a wider crisis. Whether the Wola Krobowska attack was intended to produce any particular military effect remains a question for investigators, but the choice of infrastructure raises concerns that extend beyond Poland.

The facility also illustrates the difficulty of protecting networks that cross national boundaries. A physical installation on Polish territory can support communications with consequences for the defence of another country. Its protection is therefore not simply a matter of securing a domestic utility site; it is part of the resilience of a regional infrastructure network.

A similar Starlink ground facility near Kaunas, Lithuania, also routes vital data across Eastern Europe. The existence of multiple strategically relevant sites makes the security problem broader than the protection of a single installation.

For operators, the challenge is to account for threats that may begin with surveillance, proceed through physical sabotage and exploit weaknesses in equipment or site security. For governments, it is to determine when an attack on civilian infrastructure becomes an issue of regional defence.

The overlooked stage before the fire

The arrest of the third suspect could prove important because it points to a possible preparatory phase.

Poland's ABW announced on 16 October that it had detained a person whom Polish media identified as a Ukrainian citizen. The suspect allegedly conducted reconnaissance and filmed the facility's security systems before the arson attack.

The available information does not establish precisely what was filmed, how the material was used or whether it was passed to the two Turkish suspects or another intermediary. Those details should not be assumed.

Nevertheless, the allegation raises a central operational question: whether the attack involved a division of labour between people responsible for gathering information and those tasked with carrying it out. If confirmed, that arrangement would suggest a more structured operation than an isolated act of vandalism.

Reconnaissance can help identify access points, security arrangements and potential obstacles. Separating it from the physical attack can also reduce the amount of information any one participant possesses about the wider operation. Such compartmentalisation is familiar in clandestine activity, although its presence in this case has yet to be established in detail.

The investigation must now determine whether the alleged surveillance formed part of a coordinated plan and whether the participants had connections beyond their immediate roles.

For European security services, this is where the boundary between organised crime investigations and counterintelligence becomes especially porous. A person filming security equipment may not, in isolation, reveal whether a site is being assessed for criminal purposes, intelligence collection or sabotage. The context emerges from relationships, communications, movements and financial arrangements that may cross several countries.

A European problem requiring a different response

The case also tests the practical value of European judicial cooperation. The two Turkish nationals were detained in Germany after Polish prosecutors filed charges and sought assistance through European legal mechanisms. Their extradition remains subject to a judicial decision in Stuttgart.

The suspects' nationality, the location of their detention and the alleged target in Poland illustrate the multinational nature of the investigation. Evidence may need to establish a chain of activity spanning several jurisdictions, while authorities must distinguish the criminal acts they can prove from the intelligence relationships they suspect.

For security agencies, the institutional implications are substantial. Traditional counterintelligence investigations seek to identify foreign intelligence officers, clandestine networks and links to state institutions. Organised crime investigations, meanwhile, focus on criminal hierarchies, illicit markets and the relationships that sustain them. A suspected proxy operation requires both perspectives to be applied to the same network.

European governments have already warned of a wider pattern of suspected Russian hybrid activity involving transport infrastructure, logistics hubs and defence manufacturing. Reports of rail signal tampering in the Czech Republic and arson attempts at European defence-related facilities form part of the broader security context in which Polish officials have placed the Wola Krobowska attack.

The difficulty is that a criminal group may be visible to police for years without its activities appearing to have a geopolitical dimension. Conversely, a suspected intelligence operation may look like an ordinary criminal offence until investigators connect it to a wider chain of activity. Neither conventional law enforcement nor counterintelligence can reliably resolve every such case in isolation.

The potential convergence of these capabilities makes information-sharing, coordinated investigations and the protection of critical infrastructure increasingly interdependent. It also raises a question of proportionality: authorities must strengthen their ability to detect state-backed criminal proxies without treating every transnational gang or suspicious act as evidence of foreign intelligence involvement.

For Russia, the alleged model would offer a way to impose costs on European states while keeping the direct connection to the Kremlin difficult to establish. For criminal networks, a relationship with a state sponsor could offer protection or lucrative contracts, although it could also expose them to a level of international scrutiny they might otherwise avoid.

For Europe, the more consequential shift would be the erosion of the boundary between domestic criminality and external security threats. If professional criminal networks can be recruited to target infrastructure supporting Ukraine, the next challenge will not be limited to identifying the perpetrators after an attack.