Shadow alliances and violence-as-a-service: Europol warns cybercrime is "destabilising" society
"Hybrid threat actors engage in ongoing, seemingly minor actions that collectively erode stability, security, and trust in institutions."
Europol has issued an urgent warning about the growing threat of cybercrime and sounded the alarm about its "destabilising" effect on society.
In its EU Serious and Organised Crime Threat Assessment (EU-SOCTA) 2025 report, the Eurocops said that "the very DNA of crime is shifting" as transformative technologies like AI allow criminal networks to reshape their tactics, tools and structures.
Magnus Brunner, European Commissioner for Internal Affairs and Migration, said: "Our security landscape is evolving dramatically. The SOCTA report clearly shows how serious and organised crime - and the threat it poses to our security - is also changing. We need to make every effort to protect the European Union."
The report makes for fascinating reading. It found that crooks are teaming up with "hybrid state actors" including terrorist or state-linked organisations to form "shadow alliances" serving as a fifth column to undermine European nations from within.
Meanwhile, fast-paced technological development has "drastically amplified" the impact of cybercrime and increased the devastating damage criminal gangs and their shady co-conspirators can inflict.
"The blurring of lines between state and non-state actors has created a complex and evolving threat landscape," Europol wrote. "Hybrid threat actors exploit criminal networks for deniability and political or economic gain, while criminals benefit from protection, advanced tools and financial gain."
How is cybercrime destabilising society?
Europol set out three ways in which cybercrime is now impacting citizens and nations.
- Destabilising: Serious and organised crime threatens not just public safety but the stability of EU institutions and society. Criminal networks operate internally through money laundering, corruption, violence, and the exploitation of young offenders. Externally, these networks act as proxies for hybrid threat actors, reinforcing broader destabilisation efforts.
- Online: Digital infrastructure enables organised crime to scale rapidly and evade detection. Nearly all serious crime now has a digital footprint, whether as a tool, target, or facilitator. Cyber fraud, ransomware, drug trafficking, and money laundering thrive in online spaces, where stolen data has become a key criminal commodity.
- AI-accelerated: Artifical intelligence is transforming organised crime, making operations more efficient, scalable, and harder to detect. Criminals exploit AI’s adaptability to automate illegal activities and enhance deception techniques. Law enforcement faces growing challenges in countering tech-driven criminal tactics as these tools become more sophisticated.
To illustrate the problem, Europol went a little off-piste to warn of the "woodpecker modus operandi".
"Much like a woodpecker weakens a tree over time through repeated strikes, hybrid threat actors engage in ongoing, seemingly minor actions that collectively erode stability, security, and trust in institutions," Europol added.
Hoodlums-for-hire
Europol said that violence-as-a-service is an emerging criminal model in which low-ranking gang members, hired hitmen, or ad hoc recruits are hired through encrypted networks and online platforms to attack or kill targets.
Those who commission the violence can maintain distance from the perpetrators, who are paid to carry out contract killings, debt collection enforcement and extortion schemes. Criminal contractors often have little prior knowledge of their targets, which heightens the risk of collateral damage.
A recent case in Germany saw a criminal network orchestrating bomb attacks and kidnappings in a drug-related dispute, highlighting the increasing sophistication and accessibility of violence-for-hire services.
"A complex and rapidly evolving threat landscape"
Europol also set out seven particular threats:
- Cyberattacks: Ransomware remains dominant, but attacks increasingly target critical infrastructure, governments, businesses, and individuals, often serving state-aligned objectives.
- AI-driven fraud – Social engineering schemes leverage AI and vast amounts of stolen personal data to defraud victims on an unprecedented scale.
- Online child exploitation – Generative AI is being used to produce child sexual abuse material and facilitate online grooming.
- Migrant smuggling – Criminal networks finds victims online and exploit geopolitical crises, charging exorbitant fees with complete disregard for human dignity.
- Drug trafficking – The market is diversifying, with shifting routes, evolving tactics, and increasing violence, drawing more young people into criminal networks.
- Firearms trafficking – Online marketplaces and technological advancements are driving an expansion in weapons availability across Europe.
- Waste crime – A lucrative yet often overlooked sector where criminals exploit legitimate businesses, causing severe environmental harm.
Catherine De Bolle, Europol Executive Director, said: "The very DNA of organised crime is changing. Criminal networks have evolved into global, technology-driven criminal enterprises, exploiting digital platforms, illicit financial flows and geopolitical instability to expand their influence. They are more adaptable, and more dangerous than ever before.
"Breaking this new criminal code means dismantling the systems that allow these networks to thrive – targeting their finances, disrupting their supply chains and staying ahead of their use of technology. Staying ahead of this evolving threat means reinforcing our capabilities – expanding our intelligence, operational reach and partnerships to protect the EU’s security for the years to come."
The after-effects of Russia's war on Ukraine
Even if President Donald Trump is successful in his bid to bring the Ukrainian war to a close, the impacts of "Russia's war of aggression" will longer for a long time.
Europol said a "potential settlement" of the conflict could offer "shifting opportunities for criminal networks". These could include increased firearms trafficking, a bigger recruitment pool for criminal gangs, a rise in the number of cyberattacks, more opportunities for fraudsters to target Europeans and "a further blurring of lines between licit and illicit structures."
Andy Norton, European Cyber Risk Officer at Armis, told Machine: "Cyberwarfare is no longer perceived as rare, high profile, one-off attacks - it’s a continuous, hybrid assault designed to erode trust and destabilise nations over time.
"Europol’s latest report confirms this shift, with Russia and its proxies using AI and automation to scale cyber threats like never before. Critical infrastructure - healthcare, energy, and supply chains - isn’t just collateral damage, it’s a prime target.
"A ‘set it and forget it’ approach to cybersecurity that relies on legacy point products and siloed security solutions is no longer adequate. Organisations must prioritise immediately gaining a comprehensive, real-time understanding of their environment and their extended attack surface.
"With this insight, security teams are enabled to proactively mitigate their cyber risk exposure using AI to anticipate and counter evolving tactics before they impact their organisation. These threats are relentless, our defences must be too."
Have you got a story or insights to share? Get in touch and let us know.
