On November 19, 2025, European Union institutions circulated a high-priority cybersecurity alert. It warned that a spear-phishing campaign impersonating the Belgrade Security Conference 2025 was targeting officials across the EU and North America. A fake registration domain redirected recipients to a spoofed Microsoft login page capable of installing attacker-controlled access to official accounts. EU officials were targeted for one reason: their engagement with Serbia’s democratic and civil society networks.
What EU institutions did not yet know was that the same infrastructure and tactics were already being used inside Serbia. From October 2024 through late 2025, the Belgrade Centre for Security Policy (BCBP) was subjected to a sustained cyber-espionage operation. Attackers, using compromised VPN credentials, accessed internal communications, sensitive research files, and correspondence with European and U.S. partners.
Forensic investigators recorded more than 28,000 unauthorized accesses in just two months. Two hacker groups were identified behind the intrusion, “Midnight Blizzard” linked to Russia’s Foreign Intelligence Service (SVR) and “Forest Blizzard” connected to the Military Intelligence Service (GRU). Their methods matched those described in the EU alert. This was not cybercrime. It was a coordinated hybrid operation targeting both EU institutions and Serbian civil society.
These intrusions unfolded alongside Serbia’s largest civic mobilization in decades. After the fatal collapse of a reconstructed train-station canopy in Novi Sad in November 2024, protests spread across the country demanding accountability. The movement peaked on March 15, 2025, during the largest public gathering in Serbia’s modern history. That day, demonstrators were exposed to a high-intensity acoustic device capable of causing panic, disorientation and physical harm.
More than 3000 testimonies of citizens were collected in the aftermath of the incident. Later that month, the European Court of Human Rights issued an urgent interim measure requiring Serbian authorities to clarify what device had been used and to protect protesters’ physical integrity. The government denied deploying such a device and refused independent verification.
As public pressure mounted, Serbia’s response revealed a deeper problem. Instead of launching a credible domestic investigation, the government announced in April 2025 that it had requested Russia’s Federal Security Service (FSB) to conduct an “investigation” into the alleged use of the “sound cannon”. A foreign security service was invited to assess a potential human-rights violation committed against Serbian citizens. Serbian officials later cited the FSB’s conclusions to dismiss the allegations, treating a Russian intelligence service as a neutral arbiter while disregarding calls for transparency from domestic institutions, civil society and European bodies.
Regional developments soon added another layer. In the summer of 2025, Moldovan authorities released video footage and testimony alleging that several locations in Western Serbia had been used as training sites for Moldovan citizens ahead of parliamentary elections in Moldova. According to Moldovan police, participants were trained in radio communications and other tactics at facilities described as military-style camps allegedly organized with Russian support.
While the full scope remains contested, Serbian President Aleksandar Vučić confirmed in September 2025 that three Russian nationals had been present at a camp near Loznica — the first official acknowledgment of Russian involvement in such activities on Serbian territory.
Against this backdrop, Russia’s Foreign Intelligence Service crossed a critical line. In a public statement issued in September 2025, the SVR accused the European Union of orchestrating unrest in Serbia and explicitly named independent Serbian media outlets as key actors in preparations for a “Serbian Euromaidan.” According to the statement, “the current unrest in Serbia, with the active participation of young people, is largely a product of the subversive activities of the European Union and its member states,” allegedly aimed at installing leadership “obedient and loyal to Brussels.” The SVR went further, listing specific media organizations and civil society actors accused of receiving foreign funding to complete what it openly called a “Serbian Maidan.”
The significance of these statements lay not only in their content, but in Belgrade’s response. Serbian authorities did not reject the intervention of a foreign intelligence service in domestic political life. On the contrary, the president publicly thanked the SVR for its “information,” without evidence, parliamentary oversight or institutional review. A foreign intelligence service accused local media of subversion — and the Serbian state accepted that framing.
This narrative was later echoed by Russian President Vladimir Putin. Speaking at the Valdai Discussion Club in Sochi in October 2025, Putin claimed that Russian intelligence services had confirmed attempts by Western countries to organize a “color revolution” in Serbia, explicitly stating that he agreed with President Aleksandar Vučić and warning that those mobilizing youth protests sought to inflict “new suffering” on the Serbian people.
SVR Director Sergei Naryshkin personalized this narrative in December 2025. He publicly stated that his service had “assisted President Vučić during an acute political crisis,” framing the mass protests as the opening phase of a Western-orchestrated destabilization effort. Beyond intelligence operations, Naryshkin has also overseen the expansion of Russia’s historical and ideological infrastructure in Serbia, including the opening of a branch of the Russian Historical Society — an institution explicitly tasked with shaping historical narratives and political identity in line with Kremlin priorities.
.Taken together, these episodes illustrate a clear pattern of outsourced repression and authoritarian offshoring. Politically sensitive and legally risky tasks — from assessing police violence to defining internal threats — are increasingly delegated to non-European security actors. The formal architecture of EU accession remains in place, but the substance of governance, accountability and crisis management is being externalized.
Brussels has begun to register the consequences. In October 2025, the European Parliament adopted its latest resolution on Serbia, warning of democratic backsliding, pressure on independent media and civil society, and unresolved security concerns. Serbia’s failure to open Cluster 3 reinforced that assessment. During her visit to Belgrade in October 2025, European Commission President Ursula von der Leyen put the dilemma plainly: Serbia must choose between democracy and autocracy.
As the European Parliament’s Foreign Affairs Committee prepares to visit Serbia next week, the timing matters for another reason. There is a rebuttable presumption — supported by the pattern described above — that Russian security services may seek to infiltrate or instrumentalize segments of social movements that have previously challenged the regime, including student mobilization. This does not diminish the legitimacy of those movements, but it underscores a well-documented feature of hybrid operations: the attempt to capture, redirect or fracture genuine civic energy in order to weaken pro-European coalitions from within.
In this context, the EU must move beyond passive observation and actively support the consolidation and sustainability of an existing, genuine European political alternative in Serbia. The evidence suggests that the current governing regime lacks a genuine political and values-based commitment to Europe. Its engagement with the EU functions primarily as a tactical instrument for regime survival, while real security, narrative and crisis-management dependencies are shifted elsewhere.
By arbitraging between external powers solely to remain in office, Serbia’s leadership is driving the country toward strategic subordination — locking it into dependence on a ruthless, anti-European external actor whose influence grows as democratic space contracts.
Hybrid interference does not require formal alliances. It flourishes when ambiguity is tolerated and accountability deferred. Serbia has already crossed that threshold. The question now is whether Europe will continue to treat this as a blind spot — or finally acknowledge that an EU candidate country is operating as Moscow’s intelligence bridgehead in the heart of the continent and do something about it.
Views expressed in the Opinion section belong to the authors and do not necessarily reflect the views of European Western Balkans.
