Europol Warns of “Shadow Alliance” Between States and Criminals

Digital and AI technologies are enabling “hybrid” threat actors from Russia and elsewhere to team up with cybercriminals and destabilize Europe, Europol has warned.

The region’s leading police institution made the claims in its EU Serious and Organised Crime Threat Assessment (EU-SOCTA) 2025 report published yesterday.

Hybrid threats are those designed to undermine states or institutions – often via digital channels – while remaining below the threshold of formal warfare. This could involve “sabotage of critical infrastructure through digital or physical means, information theft, disinformation campaigns, cyber-attacks,” the report noted.

Criminals typically cooperate with state-sponsored hybrid threat actors either for financial gain and/or for shelter in safe havens.

“It also allows these states to deny direct involvement by outsourcing certain crimes such as cyber-attacks, disinformation campaigns or even money laundering to criminal networks, making attribution difficult,” the report continued.

“The outsourcing to multiple networks or actors might also be cost effective for state actors as criminal networks already have infrastructure in place and often have a global reach.”

Read more on state and cybercrime alliances: As Nation-State and Cybercrime Threats Conflate, Should CISOs Be Worried?

Europol highlighted the following as the most acute hybrid cybercrime threats:

• Ransomware, which disrupts essential services and undermines public trust in institutions
• Data theft, which could provide information for espionage, economic advantage or coercion
• Disinformation via fake social media accounts, troll operations and manipulated news content, to influence political systems and undermine democracy

AI Plays a Critical Role

Europol warned that digital world had become the “primary theater” for organized criminals.

“The internet is no longer just a platform – it is the pillar of a criminal enterprise,” it said. “Criminal networks are increasingly abusing digital infrastructure to carry out their activities with increased efficiency and scope in multiple ways: as an enabler, as a countermeasure, and as a target.”

However, the report went further, claiming that AI would play a growing role in criminal tactics, techniques and procedures (TTPs), making attacks even more scalable and harder to detect.

“[AI] can be used for hyper-realistic social engineering attacks using deepfakes or voice alteration, or can be taught to impersonate the mannerisms, writing style and background knowledge of a person,” the report explained.

“AI can also be used to improve and automate criminal processes like finding new exploitable vulnerabilities, triaging stolen information or automating ransom negotiations or different forms of online fraud schemes, increasing the scale of attacks. Data theft will play an increasingly central role in different forms of cyber-attacks, given its importance in AI-driven attacks.”

In the future, fully autonomous AI could “pave the way for entirely AI-controlled criminal networks, marking a new era in organised crime,” Europol added.

AppSOC CMO, Willy Leichter, warned that AI is a “game-changer” for organized crime.

“Applying these tools to online fraud exponentially expands the reach, personalization and credibility of phishing attacks and other scams,” he said.

“For legitimate uses, AI needs to be monitored for quality and accuracy, but criminals don’t need perfection to break through security filters and fool even skeptical end-users. It’s imperative that we keep up, applying equally powerful AI tools for defensive purposes. This is not an arms race that we can afford to fall behind.”