The Western Balkans remain one of the most sensitive and vulnerable areas of the European security landscape, where a number of unresolved interstate and interethnic conflicts and contradictions, high social polarization, and the institutional weakness of the region’s countries create fertile ground for the destructive influence of external forces.
It is in this context that the latest analytical report from the Croatian Security and Intelligence Agency (Sigurnosno-obavještajna agencija – SOA) should be considered. This document helps the public (especially the Croatian public) to react more effectively to security challenges. Moreover, in the 1990s, Croatia was a direct participant in the armed conflicts that followed the dissolution of socialist Yugoslavia and won a very difficult war for its independence and territorial integrity. Therefore, Croatia traditionally monitors the security situation in the Western Balkans very closely, especially processes and events related to Serbia.
Every year, SOA publishes a “Javno izvješće” (Public Report), a detailed report in which the service analyzes security threats on the European continent, in the Western Balkans, and in Croatia itself. This year’s report systematizes a range of relevant challenges in the region that weaken European security, from cyberattacks and disinformation campaigns to espionage and subversive activities.
Hybrid Influence in the Region — Russian and Serbian
The Croatian intelligence service clearly identifies the main sources of hybrid influence and destabilizing measures in the Western Balkans: Moscow and Belgrade. The report essentially emphasizes that Russia and Serbia act in synergy, reinforcing each other’s influence, which is clearly demonstrated by the examples provided.
The Arrest of a Russian Saboteur in Bosnia
In July 2024, three parcels in three European countries—Germany, the United Kingdom, and Poland—caught fire. The first fire occurred at Leipzig airport in Germany. The parcel ignited on the runway before it could be loaded onto a plane. In the UK, the fire happened after a cargo plane landed in the suburbs of Birmingham. Polish media reported a fire in a courier service truck near Warsaw. Thomas Haldenwang, then-head of Germany’s Federal Office for the Protection of the Constitution, stated that if the parcels had caught fire mid-flight, it “would have led to a crash” (of the plane—Ed.).
European officials immediately expressed their suspicions that Russia was behind these acts. “As the Minister of Foreign Affairs, I have information that the Russian Federation is behind the attempts at sabotage in both Poland and our allied countries,” Polish Foreign Minister Radosław Sikorski told reporters at the time.
In August of the same year, Polish special services began tracking the Russian saboteurs. One of them, Aleksandr Bezrukavy, hid from European intelligence services for over three months. According to an investigation by the British newspaper The Guardian, Bezrukavy planned to return to Russia, having a ticket for a flight from Serbia. His plans were thwarted by Bosnian intelligence and law enforcement officers, who arrested him in the town of Bosanska Krupa near the Croatian border in November 2024. Three months after his arrest, Aleksandr Bezrukavy was extradited to Poland, where he was charged with coordinating acts of sabotage in Poland and other European countries.
The location of the arrest (Bosnia and Herzegovina) and the destination (Serbia) of the saboteur are not accidental. They once again confirm that external players, primarily Russia, count on the Western Balkans being a “blind spot” for Europe and NATO, where their agents can hide without hindrance. Considering other examples highlighted in the SOA report, there is no doubt that Bezrukavy would have easily found refuge in Serbia.
Relocation of Russian Diplomats
It was in Serbia that Russian diplomats found a safe haven after their mass expulsion from a number of European Union member states and some other countries in the region (including Montenegro). The Croatian intelligence report states: “Russia has strengthened its intelligence presence in Serbia, specifically with representatives of the intelligence system who were previously expelled from EU countries, where they had previously secretly carried out intelligence activities under diplomatic cover.”
This refers to the mass expulsion of Russian diplomatic staff after Russia’s full-scale invasion of Ukraine on February 24, 2022. According to various sources, 34 European countries, including countries in the Western Balkans (Montenegro, Croatia, and North Macedonia), expelled about 700 Russian diplomats. However, some of them immediately received new positions at Russian embassies in Serbia and Bosnia and Herzegovina.
The arrival of the diplomatic “exiles” in Bosnia and Herzegovina was not without criticism, but BiH Foreign Minister Elmedin Konaković said at the time: “Unfortunately, we have limited opportunities to react quickly, efficiently, and appropriately, and we are in a phase of certain research into what can be done at all, not only in this case but in all subsequent cases.” Thus, Sarajevo acknowledged the need for decisive steps in response to the Russian threat, but to date, nothing is known about any steps taken by BiH in this direction. The key reason for this situation in BiH is its complex post-war structure based on the Dayton Accords. More precisely, the Republika Srpska, led by its openly pro-Russian leadership (as one of the entities of BiH), consistently blocks any effective anti-Russian measures by the country.
For its part, Belgrade unhesitatingly accepted the expelled Russian diplomats in accordance with Serbia’s declared policy of “multivectoriality” and neutrality (while formally outlining the goal of gaining membership in the EU but not in NATO), and more recently, a de facto rapprochement with Russia despite increasingly noticeable criticism from the EU.
This rapprochement is due to Russia’s support for the regime of Aleksandar Vučić, whose power has been noticeably shaken recently by months of anti-government protests that began in response to the tragedy in Novi Sad in November 2024 (when 16 people died due to the collapse of a canopy at the railway station; angry citizens believe the tragedy was caused by the corruption of the current state system in Serbia).
Moscow helps Belgrade not only with rhetoric. This was stated by former Serbian Deputy Prime Minister Aleksandar Vulin (by the way, one of the country’s most pro-Kremlin politicians) in an interview with the Russian propaganda media outlet RIA: “I am very grateful to the special services of Russia, which always support us in our fight against color revolutions, first and foremost with information.”
The increase in the Russian diplomatic contingent in Serbia, which also includes former security officials and intelligence officers, is a great advantage for official Belgrade, as they can be involved in suppressing anti-government protests and providing expert assistance to the current Serbian authorities in this area. At the same time, this deepens Serbia’s dependence on Russia and undoubtedly creates security threats to neighboring EU member states, including Croatia.
Disinformation, the Serbian Orthodox Church, and the “Serbian World”
The SOA report also pays attention to the information operations that Russia and Serbia are conducting in the countries of the Western Balkans. As for Russia, it primarily relays its narratives through the Serbian-language editions of its propaganda media outlets RT (RT Balkans) and Sputnik. As the Croatian intelligence report emphasizes, these media outlets “serve to spread pro-Russian and anti-Western narratives in the Western Balkans.” Serbia, in turn, spreads its influence primarily through the ideology of the “Serbian World” (Srpski svet), which SOA experts define as “a copy of the Russian concept of hybrid actions and levers of influence on neighboring states”—the so-called “Russian World” (Русский мир).
In this context, the Serbian Orthodox Church (SOC) plays a leading role. “In addition to its religious role, the SOC has significant national and regional political influence. In the political segment, the leadership of the SOC supports and promotes the concept of the ‘Serbian World,’ particularly highlighting Bosnia and Herzegovina, Montenegro, and Kosovo as part of this (Serbian—Ed.) space.”
It is worth noting that the Serbian Orthodox Church does not recognize Kosovo’s independence, proclaimed in 2008, and the SOC in Montenegro (the largest denomination in the country) consistently denies the existence of Montenegrins as a separate nation and is skeptical of Montenegro’s independence in general (restored through a referendum in 2006).
As an example of the SOC’s activities, the Croatian Agency highlighted the First All-Serbian National Assembly, titled “One People, One Assembly – Serbia and Serbian” (Republika Srpska is one of the two entities in BiH—Ed.). The event was organized at the highest religious and political levels on June 8, 2024, in Belgrade. It was attended by a large number of Serbian politicians, artists, public figures, and church officials from Serbia and neighboring countries (including the current head of the Montenegrin parliament and leader of the “New Serbian Democracy” party, Andrija Mandić). During this event, the participants adopted a declaration that defines the common positions and goals of the “peoples of Serbia and (Republika) Srpska.” This includes opposing the “assimilation” of Serbs in the states of the region, categorically refusing to recognize the independence of Kosovo, and resisting the UN General Assembly resolution on the genocide in the Bosnian city of Srebrenica. The All-Serbian Assembly also called for “closer cooperation between church and state bodies on key issues.”
Thus, the Serbian Orthodox Church is currently a religious institution with significant political capital and a goal that almost completely corresponds to the foreign policy goals of the current Serbian authorities led by Aleksandar Vučić, primarily “the unification of Serbs in neighboring states, especially in Bosnia and Herzegovina, Montenegro, and Kosovo, under the single political umbrella of official Belgrade,” the SOA notes in its analytical report.
Cyberattacks on Croatian Infrastructure
Attacks in cyberspace are one of several threats described in the report that Croatia has directly faced on its own territory. The SOA report states that in recent years, there has been a clear trend of increasing numbers and frequency of cyberattacks on Croatia’s state IT infrastructure. Since 2022, the number of such cyberattacks has almost doubled, and the main targets are Croatian state bodies and critical infrastructure facilities.
“Two-thirds of the largest cyberattacks on targets in Croatia were carried out by groups sponsored by the Russian state,” the report says.
SOA separately cites the example of an attack on the Central University Clinical Hospital in Zagreb (KBC Zagreb). The attack was carried out by the LockBit group, against whose founder, Dmitry Khoroshev, the United States imposed sanctions in May 2024. LockBit is based in Russia. The attackers managed to steal a significant amount of personal data and disable medical equipment. As a result of this incident, the hospital management even redirected some patients to other medical facilities in Zagreb.
The Croatian intelligence service stated that the stolen data was successfully found and returned, and the full operation of the institution was restored within 24 hours.
Other (Supra)regional Threats
The SOA report also focuses on challenges that Croatia faces, first, as a member of the European Union, and second, as a neighbor of the Western Balkans (Croatia usually avoids identifying itself with this region, officially positioning itself as a Central European and Mediterranean country—Ed.).
Among these threats are religious and political radicalization, illegal migration to the EU, and economic challenges, primarily related to organized crime.
Radicalization
SOA acknowledges that “there are no terrorist organizations operating on the territory of the Republic of Croatia,” and the risk from such groups “is assessed as low.” At the same time, SOA considers the Western Balkans a source of risk in this context, as a “small number of followers of jihadism” live on the territory of the Western Balkan states.
The report also cites two examples of terrorist acts: an attack on a police officer guarding the Israeli embassy in Belgrade in June 2024, and an attack on police officers in the city of Bosanska Krupa in BiH in October of the same year. It is known that the first attacker was a follower of the Islamic State, but there is no similar information about the attacker in BiH. It should also be noted that the latter was a minor at the time of the attack.
Along with the thesis about the presence of separate groups of radical Islam followers in the region (primarily in BiH), the Croatian Agency also recognizes secular (political) extremism as a threat to its security. “Part of the far political right promotes neo-Nazi ideology, along with manifestations of hostility towards migrants and foreign workers in Croatia… there is a possibility of isolated incidents involving self-proclaimed radicalized individuals who may or may not be connected to extremist groups,” the SOA reports.
Illegal Migration to the EU and Smuggling
Under the influence of the unstable international situation, illegal migration to the countries of the European Union, particularly Croatia, is intensifying. Croatia is also an attractive country for smuggling activities, as it is located in the Schengen area.
Given this, SOA notes that “armed groups of smugglers operate in certain sections of migration routes in the Western Balkans,” and “the accumulation of a significant number of migrants near the Croatian border, as well as transit through its territory, pose security threats in the form of increased smuggling networks, mutual clashes between migrant groups, the radicalization of dissatisfied migrants, attempts at violent mass border breaches, the spread of fake and alarming messages, and the growth of extremist groups in society.”
Institutional Weakness as a Security Threat and Croatia’s Interests in the Region
The Croatian intelligence service SOA uses specific examples in the report to demonstrate that the main vulnerability of the region’s countries is, among other things mentioned above, institutional and/or political instability and weakness, which in turn is caused by interstate, interethnic, interreligious, and inter-institutional contradictions.
“This is a space that, in a political and security sense, has for many years been characterized by unresolved inter-national and interstate issues, the resolution of which is progressing with difficulty and slowly, despite efforts by the EU and the United States. At the same time, the process of European integration is very slow or has stagnated,” SOA analysts write about the region.
The agency describes Croatia’s involvement in this context as multidimensional, as the country traditionally has noticeable “national, economic, security, trade, transport, and other interests” in the Western Balkans. Not least is Zagreb’s desire to secure the interests of the Croatian minority in neighboring countries of the region, especially in BiH, where Croats are one of the three constituent peoples but, unlike the Serbs, do not have their own entity (they are in a joint Federation of Bosnia and Herzegovina with Muslim Bosniaks).
As an EU member state, Croatia has significant leverage over the candidate countries (all countries in the region, except for Kosovo, have the status of EU candidate states—Ed.). Being a neighbor of these states, Croatia is genuinely interested in their successful integration into the EU (especially Montenegro, which is currently the regional leader in this process). And it is on the example of Montenegro that SOA expresses Zagreb’s principled opposition to anti-European tendencies in the political life of the region’s countries:
“Radical pro-Serbian parties are part of the current government coalition. The Montenegrin government is trying to demonstrate its European orientation and commitment to common European policies and values, but the influence of pro-Serbian political forces with nationalist and anti-Western views can negatively affect the country’s European integration process, as well as Montenegro’s relations with EU member states.”
Therefore, Zagreb’s strategic interest is the further consistent promotion of the European integration of the Western Balkan states, as well as countering harmful external influence that negatively affects this process. As highlighted in the latest SOA report, “any significant instability in the Western Balkans region has its consequences for the national security and interests of Croatia.”
Conclusions
The goal of the SOA report is to familiarize the public with the security challenges that Croatia, the Western Balkans, and the EU are currently facing.
The hybrid influence of Russia and Serbia in the Western Balkans persists, and the countries are strengthening their intelligence and diplomatic cooperation. The main channels of information influence are Russian and Serbian media, as well as the Serbian Orthodox Church as a very influential religious and political structure.
Hacker groups supported by Russia regularly carry out a significant number of cyberattacks, particularly on state IT infrastructure (including critical infrastructure), which creates risks for the national security of Croatia and other EU member states.
The Western Balkans is an important transit route for illegal migrants to the European Union, which contributes to the strengthening of smuggling networks and radicalization risks that directly affect Croatia’s national security and the country’s socio-political stability.
Political instability and institutional weakness in the countries of the Western Balkans create a favorable environment for destructive external influence and slow down the European integration process (Montenegro is cited as a striking example of this).
