There is a clear pattern of externally contracted repression and authoritarian business relocation abroad, where politically and legally sensitive tasks are delegated to non-European security actors.
What the EU institutions did not yet know was that the same infrastructure and tactics were already being used inside Serbia. From October 2024 to the end of 2025, the Belgrade Center for Security Policy (BCBP) was subjected to a sustained cyber espionage operation. The attackers, using compromised VPN credentials, accessed internal communications, sensitive research files, and correspondence with European and American partners.
Forensic investigators recorded more than 28,000 unauthorized accesses in just two months. Two hacking groups were identified after the intrusion, “Midnight Blizzard” linked to the Russian Foreign Intelligence Service (SVR) and “Forest Blizzard” linked to the Military Intelligence Service (GRU). Their methods matched those described in the EU alert. This was not cybercrime. It was a coordinated hybrid operation targeting both EU institutions and Serbian civil society.
These interventions took place in parallel with Serbia's largest civic mobilization in decades. Following the fatal collapse of a reconstructed train station canopy in Novi Sad in November 2024, protests spread across the country demanding accountability. The movement reached its peak on March 15, 2025, during the largest public gathering in the modern history of Serbia. On that day, demonstrators were exhibited to a high-intensity acoustic device capable of causing panic, disorientation, and physical harm.
After the incident, more than 3000 citizen testimonies. Later that month, the European Court of Human Rights unleashed an urgent interim measure asking the Serbian authorities to clarify what equipment was used and to protect the physical integrity of the protesters. The government denied the deployment of such a device and refused independent verification.
As public pressure mounted, Serbia’s response revealed a deeper problem. Instead of launching a credible domestic investigation, the government announced in April 2025 that it had asked Russia’s Federal Security Service (FSB) to conduct an “investigation” into the alleged use of the “sonic cannon.” A foreign security service was invited to assess a possible human rights violation committed against Serbian citizens. Serbian officials later cited conclusion of the FSB to dismiss the charges, treating a Russian intelligence service as a neutral arbiter, while ignoring calls for transparency from domestic institutions, civil society, and European bodies.
Regional developments soon added another layer. In the summer of 2025, Moldovan authorities published video footage and evidence alleging that several locations in Western Serbia were used as training sites for Moldovan citizens ahead of parliamentary elections in Moldova. According to Moldovan police, participants were trained in radio communications and other tactics in facilities described as military-style camps, organized with Russian support.
While the full scope remains contested, Serbian President Aleksandar Vučić confirmed in September 2025 that three Russian citizens had been present at a camp near Loznica — the first official admission of Russian involvement in such activities on Serbian territory.
Against this backdrop, Russia's Foreign Intelligence Service crossed a critical line. In a public statement released In September 2025, the SVR accused the European Union of orchestrating the unrest in Serbia and explicitly named independent Serbian media outlets as key actors in the preparations for a “Serbian Euromaidan.” According to the statement, “the current unrest in Serbia, with the active participation of young people, is largely a product of the subversive activities of the European Union and its member states,” allegedly aimed at installing a leadership “obedient and loyal to Brussels.” The SVR went further, listing specific media organizations and civil society actors accused of receiving foreign funds to stage what it openly called a “Serbian Maidan.”
The significance of these statements lay not only in their content, but also in Belgrade's response. The Serbian authorities did not deny the interference of a foreign intelligence service in domestic political life. On the contrary, the president thanks publicly accused the SVR of its “information,” without evidence, parliamentary oversight, or institutional scrutiny. A foreign intelligence service accused the local media of subversion – and the Serbian state accepted that formulation.
This account was later repeated by Russian President Vladimir Putin. Speaking at the Valdai Discussion Club in Sochi in October 2025, Putin prestrained that Russian intelligence services had confirmed the efforts of Western countries to organize a “color revolution” in Serbia, expressly stating that it agreed with President Aleksandar Vučić and warning that those who mobilized the youth protests sought to inflict “new suffering” on the Serbian people.
The director of the SVR, Sergei Naryshkin, personalized this narrative in December 2025. He stated publicly claimed that his service had “assisted President Vučić during an acute political crisis,” portraying the mass protests as the opening phase of a Western-orchestrated destabilization effort. Beyond intelligence operations, Naryshkin has also overseen the expansion of Russia’s historical and ideological infrastructure in Serbia, including the opening of a branch of the Russian Historical Society—an institution explicitly tasked with shaping historical narratives and political identity in line with the Kremlin’s priorities.
Taken together, these episodes illustrate a clear pattern of externally contracted repression and authoritarian business relocation abroad. Politically sensitive and legally risky tasks – from assessing police violence to defining internal threats – are increasingly being delegated to non-European security actors. The formal architecture of EU accession remains in place, but the substance of governance, accountability and crisis management is being externalized.
Brussels has begun to register the consequences. In October 2025, the European Parliament APPROVED its latest resolution on Serbia, warning of democratic backsliding, pressure on independent media and civil society, and unresolved security concerns. Serbia’s failure to open Group 3 reinforced this assessment. During her visit to Belgrade in October 2025, European Commission President Ursula von der Leyen clearly expressed the dilemma: Serbia must choose between democracy and autocracy.
As the European Parliament’s Foreign Affairs Committee prepares to visit Serbia next week, timing matters for another reason. There is a counterintuitive assumption – supported by the pattern outlined above – that Russian security services may seek to infiltrate or instrumentalize segments of social movements that have previously challenged the regime, including student mobilization. This does not diminish the legitimacy of these movements, but it underscores a well-documented feature of hybrid operations: the attempt to capture, redirect, or break genuine civic energy in order to weaken pro-European coalitions from within.
In this context, the EU should go beyond passive observation and actively support the consolidation and sustainability of a viable and genuine European political alternative in Serbia. Evidence suggests that the current ruling regime lacks a genuine political and values-based commitment to Europe. Its engagement with the EU functions primarily as a tactical instrument for regime survival, while the real security, narrative and crisis management dependencies have shifted elsewhere.
By arbitrating between external powers just to stay in power, Serbia's leadership is driving the country toward strategic subjugation – locking it into dependence on a ruthless and anti-European external actor whose influence grows as democratic space shrinks.
Hybrid intervention does not require formal alliances. It thrives when ambiguity is tolerated and accountability is deferred. Serbia has already crossed that threshold. The question now is whether Europe will continue to treat this as a blind spot – or will it finally acknowledge that an EU candidate country is acting as a bridgehead for Moscow’s intelligence in the heart of the continent and do something about it.
The Geo Post
Portal Novosti spreads propaganda: Media agreement declared a "pact against Serbs" 
Local elections in Serbia: Vučić weakened, alternative still does not exist 
Analysis: The Battle for Hormuz and the “Prosperity Guardian” 
Serbian media manipulates about American KFOR soldiers: From interest in Orthodoxy to acceptance of religion 
From propaganda to influence: The global network of separatism backed by Russia 
Berlin and Tokyo in a new security axis