Hybrid Warfare in the Western Balkans: Espionage Escalation Between Pristina and Belgrade

Fehim Sali is a teacher from the border region of Dragash. The man, who holds dual citizenship of Kosovo and Serbia, was detained by Kosovo authorities at the Merdare border crossing as he attempted to return to the country from Serbian territory. This detention was the direct result of a months-long intelligence and reconnaissance operation carried out jointly by the Special Prosecution Office of the Republic of Kosovo and the Kosovo Intelligence Agency.

This case not only highlights deep threats to the national security of Europe's youngest state, but also reveals the sophisticated, flexible, and multi-layered methods of infiltration employed by the Serbian security apparatus across key sectors of social and state life.

Mechanism of Cooperation with the Serbian BIA Agency

According to official case materials gathered by Kosovo investigators, Fehim Sali acted over an extended period as a recruited agent for the Serbian Security Information Agency, widely known in intelligence circles by its acronym, BIA. His direct supervisor and handler was reportedly a high-ranking Serbian intelligence officer, Želimir Matović, who used the operational alias "Żeljko." The tasks assigned to Sali covered an exceptionally broad spectrum of surveillance and information-gathering activities. The suspect not only collected confidential data on the current political situation in Kosovo and the balance of power in parliament and government, but also actively participated in identifying and profiling agents and employees of the Kosovo Intelligence Agency. To facilitate their identification and subsequent compromise by Belgrade, Sali covertly photographed Kosovo intelligence officers in public places. Furthermore, the prosecution accuses him of gathering detailed information on environments linked to the Wahhabi movement and pinpointing specific individuals within these circles who could serve as potential targets for recruitment by Serbian intelligence.

Evidence, Search, and Confession

During a search of the suspect's home, Kosovo law enforcement officers seized four mobile phones—which, according to prosecution findings, were used for encrypted communication with his Serbian handler—as well as cash amounting to approximately forty thousand euros. Investigators are convinced that the discovered funds constituted direct compensation for conducting ongoing, multi-faceted espionage on behalf of a foreign intelligence service. Prosecutor Bekim Kodraliu informed the public that during initial questioning, the suspect himself confessed to maintaining regular contact with BIA officers and provided a detailed account of his recruitment mechanism and methods of transmitting information. Sali also acted as an intermediary in transferring documents linked to Serbian state institutions and maintained relationships with individuals exercising political and social influence in both countries, with a particular focus on representatives of national minorities, directing their activities in ways advantageous to Belgrade's operational goals.

Broader Context and a Series of Previous Sentences

The case of Fehim Sali is not an isolated incident, but rather fits into a broader pattern of systematic intelligence activity by Belgrade in Kosovo that has unfolded with full force over the past dozen months. Just two months before the arrest of the teacher from Dragash, in June 2026, the Basic Court in Pristina sentenced Hysri Selimi—an ethnic Albanian citizen of Kosovo and former fighter for the terrorist organization Islamic State—to six years in prison. Selimi was found guilty of long-term cooperation with BIA, which began following his return from the armed conflict in Syria and the completion of a prison sentence in Kosovo. Prosecution findings revealed that Selimi supplied Serbian intelligence with detailed reports on religious radicalization processes in the country, exact data regarding citizens fighting in the Middle East, as well as information on former commanders and soldiers of the Kosovo Liberation Army (KLA), receiving regular monthly payouts of up to seven hundred euros in return.

Infiltration of Police Structures and International Organizations

An even more alarming case of infiltration into key state institutions occurred in May 2026, when a court in Pristina sentenced Kosovo Police Lieutenant Bojan Jevtić to six years in prison and a fine for espionage and illegal weapons possession. Jevtić, serving as head of the operational sector at the key Dheu i Bardhë border crossing, exploited his official position and access to confidential databases to provide BIA agents with police operational plans related to state security. As investigators established, the police officer installed remote desktop software (TeamViewer) on his work computer, giving Serbian intelligence a direct, continuous view of the operational situation at the border and access to classified plans of Kosovo's security services. This comes alongside other high-profile cases from recent months, such as the indictment filed against Jelena Đukanović, an employee of the OSCE Mission in Kosovo, and ongoing trials of Bedri Shabani and Muharrem Qerimi, who are accused of passing information to Serbian intelligence regarding the Račak massacre and defense structures.

Diversity of Agent Profiles and BIA's Pragmatism

Security experts and geopolitical analysts point to the remarkable flexibility and pragmatism of the Serbian special services in selecting assets within Kosovo. An analysis of uncovered cases demonstrates that BIA effectively recruits across a wide spectrum—from former radical jihadists and law enforcement officers to civilian teachers and staff of international organizations. Common denominators in most of these operations include strong financial motivation among recruited agents and the skillful exploitation of the region's complex ethnic, religious, and social mosaic.