The Digital Forensics Center (DFC) has published a new analysis entitled "Infrastructure of Russian Influence in the Western Balkans", in which it stated, among other things, that since 2020, conditions have been created in Montenegro for a potential Moldovan scenario, and Montenegro could become the next target of a hybrid attack in the Western Balkans with serious implications for its security and European perspective.
We transmit the analysis in its entirety:
Russian hybrid operations in Eastern and Southeastern Europe are entering a more aggressive phase, targeting countries at different stages of European and Euro-Atlantic integration. Moldova is currently the main target of such pressures, as the combination of hybrid attacks slows down its European course and creates space for a permanent political blockade. At the same time, recent arrests in Serbia (which are linked to networks of Russian loyalists) point to a regional logistical environment in which intelligence, criminal and propaganda infrastructures are combined. From this environment, resources, people and narratives are distributed to sensitive points in the neighborhood.
Russian hybrid activities in Moldova ahead of the September 2025 elections are methodologically identical to those in Montenegro in 2016. The country's authorities uncovered a Russian plot to destabilize the state during the parliamentary elections on September 28, 2025. The Moldovan police, in cooperation with the Intelligence Service (SIS), conducted around 250 searches in more than 100 locations, including four prisons, in a massive operation on September 22, 2025 (a week before the elections). The operation resulted in the arrest of 74 people, most of whom had been trained in Serbia, on charges of preparing mass unrest and coordinating it from Russia through criminal structures. Weapons, ammunition, training equipment, batons and handcuffs, passports, cash and other evidence of travel and financial transactions were seized, while laptops, mobile phones and radio frequency detection systems were seized from the organizers in Serbia. The main goal of the Russian paraintelligence operation was to incite disorder and unrest in the event of a pro-European majority winning the elections.
The key hub for the destabilization of Moldova was Serbia. According to the investigation, Russian security services established a special training camp for Moldovan and Romanian citizens in the vicinity of Loznica (Serbia) under the guise of a religious pilgrimage. Instructors, Russians and Belarusians affiliated with the GRU, rotated through Serbia every 30 days, teaching tactics for street riots, breaking through police cordons, and the use of weapons. Local organizers Lazar Popović and Sava Stevanović, former advisors to Serbian Minister Nenad Popović, provided logistical support.
The tactics of violent protests and special means are identical to those described in the indictment of the Special State Prosecutor's Office of Montenegro in the case known as the 2016 coup. Both in the 2025 Moldova case, as well as in Montenegro in 2016, the activity of Russian GRU agents was recorded with the aim of destabilizing the state by causing unrest, financing criminal structures and organizing violent protests. In both cases, Serbia served as a central hub for GRU paraintelligence activities. Among the evidence of planned illegal activities in Montenegro are photographs, recordings, uniforms, direct confessions and seized money in the amount of 125 thousand euros, which was confirmed by the Serbian investigative authorities.
Without going into the judicial epilogue of the 2016 case, there are indisputable facts that point to an identical matrix of Russian services' actions in Moldova. The common denominator is not only the tactical actions of operatives on the ground, but also the integration phase in which both countries were. In 2016, Montenegro was on the verge of joining NATO, and the elections in Moldova in 2025 were crucial for the country's future integration into the EU. Propaganda media from the region and Montenegro downplay the significance of Russian operations in order to relativize the malignancy of its influence.
Additional confirmation of the continuity of GRU operatives' activities across Europe is the case of Eduard Shishmakov, one of the defendants in the coup case, who was targeted by sanctions by the Ukrainian authorities in 2024. The sanctions package included individuals and entities from the Russian Federation working against the independence and territorial integrity of Ukraine. It is indicative that the passport number under which Shishmakov was sanctioned matches the number of a fake passport in the name of Eduard Shirokov, with which he entered Serbia before the parliamentary elections in Montenegro in 2016.
Moldova – a scenario for Montenegro and/or Serbia
Montenegro is at a socio-political crossroads. Internal political dynamics conditioned by a polarized society and insufficiently strong institutions open up several possible perspectives. Foreign malign influences in synergy with the party-cratic system ensure that the EU integration process and the stabilization of political conditions remain a permanent aspiration of Montenegrin society. In such a complex context, it is possible to consider the pre-election and post-election scenario for the upcoming parliamentary elections in 2027.
Given the increased and sophisticated activities of Russia, and Serbia as a permanent vector of Russian hybrid action, Montenegro remains a target of foreign malign interference. Methodologically, since 2020, the conditions for a potential Moldovan scenario have been created in Montenegro. Considering the context of the Moldovan parliamentary elections, and the actors who tried to destabilize it, the parallels with Montenegro and the region are obvious. The identified patterns of action, the instrumentalization of pro-Russian political entities, the infiltration of the religious community into the political sphere, a strong propaganda campaign through pro-Russian media and social networks, and the targeted incitement of social and ethnic divisions are undeniably reflected in the Montenegrin context. As in Moldova, the strategic goal of such activities is to weaken the pro-European course of the state, compromise institutions and create an atmosphere of political instability that favors the foreign policy interests of the Russian Federation. If such processes are not identified in time, Montenegro could become the next target of a hybrid attack in the Western Balkans with serious implications for its security and European perspective.
In the case of the Moldovan parliamentary elections, the key role in spreading anti-EU propaganda was played by the priests of the Moldovan Orthodox Church, who were instrumentalized in the Kremlin’s hybrid efforts to influence the outcome of the elections. Pilgrimages were initially organized for a group of priests in Moldova. This network opened over 20 Telegram channels. Anti-EU narratives were disseminated daily through these channels, in which European integration was presented as part of a broader plan for gay Europe. The common narrative was the fight for traditional values under the guise of lectures on the common faith and love of Orthodoxy. In the Balkan context, the Serbian Orthodox Church has an identical mobilization power that makes it a key mediator of Russian influence. The SPC openly supported the pro-Russian protests from 2014 to 2016 in Podgorica. The narrative of preserving traditional values is a constant of this organization during and before important socio-political events. Before the local elections in Kotor and Podgorica (in September 2024), the Serbian Orthodox Church used its entire priestly network to emphasize the key role of preserving the faith, people, and sacred places in ceremonies and liturgies as an introduction to the election campaign. Key people in the Serbian Orthodox Church placed themselves in the function of pro-Serbian and pro-Russian political structures, trying to directly influence the election result.
Energy and hybrid operations
The United States imposed sanctions on the Oil Industry of Serbia (NIS) due to its majority Russian ownership (Gazprom Neft with 50% and Gazprom with 6,15% of the share) with the aim of limiting Russian influence and financing the war in Ukraine. After several delays, the sanctions came into force on October 9, 2025. Apart from their economic significance (80% of the Serbian oil market), the sanctions are also significant from the perspective of promoting Russia's malign influence on the Western Balkans region. The financing of Russian and pro-Russian media in Serbia, and energy dependence on Russia, have contributed to the Kremlin's hybrid operations being implemented from Serbia without any obstacles. However, if Belgrade gets rid of Russian ownership by selling or buying out Gazprom Neft and Gazprom's shares in the energy sector, the Kremlin will use other channels to strengthen its influence and preserve its current positions. Official Moscow has repeatedly provided strong support to the Serbian authorities in the context of civil and student protests after the collapse of the canopy in Novi Sad. The sending of FSB agents to Serbia, who confirmed that no sound cannon was used at the March 15 protest, and the statements of the foreign intelligence service SVR that a color revolution is brewing in Serbia, make the Kremlin's official support evident. The Belgrade regime is using the color revolution narrative to minimize the protests against corruption and portray them as an EU project to overthrow the government in Serbia.
However, the support of pro-Russian structures for student protests in Serbia is evident and indicates that Moscow is playing a double game in the current political circumstances. Despite the official Kremlin narrative of a Western-backed color revolution, pro-Russian structures with the same iconography have been present at student protests in Serbia since January 2025. The alleged war veterans have positioned themselves as supporters of students and citizens in the fight for civil rights. The most prominent individuals from these structures are Nenad Stanić and Siniša Jevtić, who previously publicly supported Russia's aggression against Ukraine.
War veterans are present at all gatherings and are responsible for the introduction of Russian war iconography at protests. The flag of the Orthodox Army, or rather the Battle of Kulikovo and one of the symbols of Russian aggression against Ukraine, is present at civil protests in Serbia. Also, the information and digital space play a significant role in protest events in Serbia. YouTube channels use the topic of student and civil protests to spread pro-Russian and anti-Western rhetoric and strengthen destructive elements in societies in the Western Balkans. The channels X33, Glas Javnosti, HelmCast, Balkan Info, Podcast kod Brane are used as a platform for promoting an alternative vision of Serbia in which the EU and the West are presented as key threats to national identity, sovereignty and traditional values. On the other hand, Russia and alternative alliances are presented as natural and desirable supports for the future of Serbia.
The infrastructure for destabilizing the region already exists. The increased presence of pro-Russian structures, the Serbian Orthodox Church, the media and social networks indicates that the Kremlin is preparing to act in accordance with the geopolitical moment and the outcome of the NIS sanctions. The number of Russian diplomats in Serbia increased from 54 before the aggression to 68 by mid-2025. Most of the newly arrived diplomats were expelled from EU countries after the Russian aggression on Ukraine. Also, in the period from 2022 to 2025, around 200 Russian citizens were granted Serbian citizenship, among whom are close allies of Russian President Vladimir Putin. Considering the final stage of Montenegro's EU integration, and the regular parliamentary elections in 2027, as well as social polarization in Serbia and possible snap elections, assumptions are being made for a potential scenario from the Moldovan parliamentary elections. The appointment of Aleksandar Lukashik as the Russian ambassador to Montenegro is also indicative. He served as the charge d'affaires at the Russian Embassy in Kiev from 2016 to 2022, before the aggression against Ukraine. The target of Russian asymmetric and hybrid activities are all events that represent a turning point for the future of European states. The scenario from Moldova with 24-hour disinformation and polarizing narratives via social media was also replicated in the elections in the Czech Republic. Researchers in the Czech Republic found that 16 media outlets spreading pro-Russian disinformation produced more content than all traditional media combined. In France, a network of 85 media sites spreading pro-Russian disinformation and propaganda was discovered five months before local elections. The network was designed to visually resemble French traditional media sites.
The installation of a pro-Russian network in Serbia is also spilling over to Montenegro. On October 26, 2025, the Russian Historical Society was founded in Serbia, founded by the director of the SVR, Sergey Naryshkin. The director of the Belgrade branch of the society is the former director of the BIA, Aleksandar Vulin. The timeframe for the founding of the society coincides with the NIS sanctions and the upcoming election cycle in Serbia. Symptomatic messages were delivered at the founding ceremony, calling for the realization of the idea of the Serbian world, and glorifying the malignant doctrine of the Kremlin. The founding meeting of the Russian Historical Society was also attended by Metropolitan Metodije Ostojić of Budimlje-Niksic. In May 2025, the Synod of the Serbian Orthodox Church awarded Ostojić the title of metropolitan, after which he intensified activities that polarize Montenegrin society and distance it from EU achievements. Ostojić is one of the main advocates of the rehabilitation of the fascist Chetnik movement from World War II. In August 2025, he led a group that erected a monument to the Chetnik duke Pavle Đurišić near Berane.
In this context, the cultural and religious events promoted by the Serbian Orthodox Church, especially those related to the return of the Votive Chapel on Lovćen, function as a soft introduction to the potential destabilization of society. The events marking the 100th anniversary of the restoration of the Njegoš Chapel create information conditions for events that would paralyze EU integration and further antagonize Montenegrin society. Representatives of the Serbian Orthodox Church continuously announce such events. In parallel, representatives of pro-Serbian right-wing structures in Montenegro receive letters of appreciation from the Serbian Army.
Volunteer camps in Russia
The Montenegrin police operation in Lugansk, in which suspects of participation in foreign armed formations were arrested. These are individuals who are part of pro-Russian and pro-Serbian right-wing groups in Montenegro. The phenomenon of volunteers from the Western Balkan countries leaving for the Ukrainian battlefield, where they join Russian forces, represents a multi-layered security risk for the region. A key element of this risk relates to the existence of a recruitment center called the Center of Russian Patriots in Khanty-Mansiysk in central Russia. It serves as a hub for the logistical and ideological mobilization of volunteers from the Western Balkans. Vladimir Avramović, a former member of the Serbian special unit Cobra, who is fighting as part of the 137th assault brigade stationed in Donbass, was recruited there. In a statement he gave to Russian media after his first return from the front, he said that Serbs who were recruited at the Center of Russian Patriots in Khanty-Mansiysk are fighting in that brigade.
Also, Serbian citizen Bojan Odžić became a veteran of the SVO after returning from the front wounded. After receiving the medal for bravery, Odžić stated that in March 2025, 19 volunteers applied to the same Center due to its efficiency and quick deployment to the front. Information appears in the Russian media that Montenegrin citizens were also recruited in the aforementioned center. Available footage shows Serbian citizens in uniforms with the military emblem of the Orthodox Army flag. This symbol is present among pro-Russian elements at civil protests held in Serbia. Also, the Defenders of the Fatherland Foundation from Russia has been entrusted with the task of providing assistance to the families of participants in the so-called special military operation who are listed as missing. According to the presidential decree, the Defenders of the Fatherland Foundation can provide psychological and psychotherapeutic support to the families of the missing, as well as assist them in obtaining social benefits and free legal aid. In practice, the Foundation's centers (distributed throughout Russia) serve not only to provide social and psychological support to relatives of missing soldiers, but also function as recruitment points.
Such recruitment dynamics are risky from the perspective of radicalization of the region. The return of volunteers with combat experience, strongly adopted ideological narratives and ties to Russia increases the potential for destabilization. This implies the strengthening of extremist networks, the polarization of public space and the instrumentalization of geopolitical loyalties in domestic political processes. In such an environment, recruitment structures function as a channel through which regional tensions can further intensify.
Challenges for institutions and future directions of action
Russian hybrid activities in Europe have been visibly intensified by the spread of propaganda and political pressures, and it is realistic to expect that they will further strengthen in Serbia. The potential loss of Russian ownership in the Oil Industry of Serbia is a key trigger for such dynamics, since Moscow views this sector not only as an economic, but above all as a geopolitical instrument of influence. In conditions where this mechanism could be seriously weakened or lost, the Russian side will strive to send a clear message to the West through increased malign activities, media and information activities, and political and social support for pro-Russian actors that key decisions cannot be made in Serbia without its consent. This will likely make Serbia even more exposed to pressures and attempts at destabilization in the coming period, while Russian structures will seek to confirm that they still have the capacity to shape strategic trends in the country and the region by preserving or compensating for their influence in the energy sector.
In this context, it is certain that hybrid activities will spill over to Montenegro, especially considering that the country is in the final phase of the European integration process, and that regular parliamentary elections are expected in 2027. Former Russian Ambassador to Montenegro Vladislav Maslenikov stated in 2023 that the expansion of the European Union to the Western Balkans means drawing these countries into confrontation with Russia.
The incident in the Podgorica neighborhood of Zabjelo in November 2025, which triggered anti-migrant protests and “citizen patrols,” is an example of how disinformation and narrative manipulation can shape perceptions of reality, deepening divisions and generating distrust among citizens. It is also proof of how easy it is to mobilize extreme sections of Montenegrin society in a short period of time.
Following the pattern seen in Moldova, actors who already possess a developed infrastructure of influence in the region through the media, a network of political and parapolitical organizations, as well as strong religious structures could try to further polarize Montenegrin society by instrumentalizing the Serbian Orthodox Church and engaging parastate elements from Serbia. The goal of such activities would be to weaken Montenegro's European course and increase tensions between different identity and political blocs, and send a message that any step towards the West inevitably leads to internal instability. The sudden erection of a monument to fascist collaborator Pavle Đurišić, directed by the Serbian Orthodox Church, and the passivity of the security sector represent a tactical and strategic rehearsal for similar scenarios in the future.
In such a security environment, Montenegrin institutions must set a systematic fight against foreign interference, disinformation and malign influence as one of their strategic priorities. This was also pointed out in the latest European Commission Report, which emphasized the need to strengthen institutional resilience and improve capacities for detecting and countering hybrid threats. Nationalist rhetoric, Russian disinformation campaigns and religious influence are already deeply rooted in parts of Montenegrin society, creating fertile ground for potential radicalization and recruitment of volunteers for Russian hybrid operations and Russian military or paramilitary structures.
Bonus video:
