In September 2025, it was revealed that European intelligence services uncovered a sophisticated espionage network orchestrated by the Belarusian State Security Committee (KGB), spanning multiple states. In a coordinated operation overseen by Eurojust1 and spanning the Czech Republic, Romania, Hungary and Moldova, the network was reportedly exposed and dismantled.
Unravelling the network
Arrested as part of the operation was Alexandru Bălan, former deputy head of Moldova’s Intelligence and Security Service (SIS), now facing charges of treason. He is accused of transferring highly sensitive classified information to the Belarusian KGB across a series of meetings in Budapest circa 2024 and 2025, in exchange for instructions and payments.2
Czech officials also expelled a Belarusian operative acting under diplomatic cover. He was given 72 hours to leave Prague, a move underlining the misuse of diplomatic channels for espionage purposes.3
These successful interventions and shuttering of the group’s activity highlights the importance of cross‑border intelligence co‑operation in identifying and neutralising trans-national crime networks.4
Strategic significance
Belarus, under the rule of President Alexander Lukashenko, has remained a consistent strategic ally to Russia. Since 2022, it has facilitated Russian military logistics and supported joint initiatives that have escalated tensions with Western powers opposed to Russia’s military campaign in Ukraine.5
The dismantling of this espionage ring is not an isolated event. It forms part of a broader pattern of hostile state activity across Europe. Reports of drone surveillance over critical infrastructure,6 increasing cyber intrusion campaigns,7 and rising domestic radicalisation have created a complex and evolving risk environment, demanding an equally adaptive response from European intelligence services.
A Pattern of activity
As noted in recent editions of Mishcon de Reya’s CRCI Investigations and Intelligence Updates, there has been a marked uptick in espionage activity across Europe. In the UK, a foiled Iranian operation in 2023 sought to monitor and intimidate dissident journalists.8 That same year, a Russian spy cell - composed primarily of Bulgarian nationals - was exposed in Harrow. The group had been gathering intelligence on critics of the Kremlin and attempting to embed themselves into British civil society.9
The exposure of the Belarusian network is consistent with these trends. Together, these cases suggest that hostile state actors are increasingly targeting not only governments and military entities, but also journalists, activists, infrastructure providers, and private-sector actors with access to politically sensitive data.
Espionage activity is adapting - and so too are the state and legal mechanisms responding to it. Europe’s intelligence architecture is evolving, and cross-border cooperation is delivering results. However, businesses, civil society organisations, and individuals must remain alert to the shifting nature of the threat landscape.
For clients operating internationally, especially in regions close to Russia and its allies, it is no longer sufficient to consider espionage risk as a matter for governments alone. Enhanced due diligence, internal threat modelling, and proactive reputation management now form an integral part of organisational resilience in the face of hybrid threats.