Russian intelligence operatives target 'ally' Serbia

Global Watch | 2026-02-28

Serbia, Russia's most vocal European partner, is weathering a multipronged cyber onslaught.

While public attention has been drawn to recent denial-of-service attacks claimed by the Anonymous collective, a far more insidious campaign is being waged in the shadows by Russia's own state-sponsored intelligence operatives.

For portions of January and February, the websites and IT infrastructure of Serbia's Interior and Defense Ministries were under a massive cyberattack.

Anonymous, a decentralized hacker group, has claimed responsibility, citing Belgrade's pro-Kremlin alignment and its refusal to condemn Russia's invasion of Ukraine.

"Serbia is a Russian backdoor to Europe and needs to be fixed," an account linked to the group declared in January 2023.

Meanwhile, a quieter, more strategically significant attack has targeted the Belgrade Center for Security Policy (BCSP), a respected independent think tank.

According to a direct notification from the Microsoft Threat Intelligence Center, the BCSP's systems were compromised by Forest Blizzard, the public designation for the GRU's Military Unit 26165.

An elite cyber-espionage unit of Russian military intelligence, Forest Blizzard is also known as APT28 or Fancy Bear.

The GRU's methods were sophisticated and malicious, including spear-phishing campaigns and the creation of a fraudulent website.

This site impersonated the BCSP's flagship Belgrade Security Conference for the express purpose of harvesting credentials from participants.

Hidden betrayal

Russia's attack sought to infiltrate networks, monitor communications and gather intelligence on independent policy experts engaging with Western partners.

This exposes the fundamental nature of the Kremlin's relationships.

Moscow does not have allies; it has assets and spheres of influence. The Serbian government's loyalty was rewarded not with respect or security, but with the quiet infiltration of its civil society by Russian intelligence services.

The Kremlin cannot tolerate the existence of independent Western-oriented institutions even within the borders of its client states. Its objective is to ensure that no alternative centers of thought or policy can emerge to challenge its influence.

The simultaneous attacks from opposite ends of the geopolitical spectrum create a perfect storm of pressure on Belgrade.

However, the GRU's involvement is the more telling story -- it is a clear message that allegiance to Moscow is submission.

For Russia, any organization that fosters democratic norms and transatlantic dialogue -- even one in a friendly country -- is a target to be compromised and controlled.

The Serbian case serves as a critical lesson for any nation considering closer ties with the Kremlin.