ABSTRACT

This research systematically unpacks the convergence of extremist ideologies and organized criminal networks in the Western Balkans, exposing how nationalist paramilitaries, jihadist financiers, and politically protected enforcers operate not as fringe actors but as embedded instruments of regional power. Across 19 chapters, the investigation follows a forensic and empirically grounded narrative that spans Serbia, Kosovo, Albania, North Macedonia, and Bosnia and Herzegovina, revealing how violent non-state actors are shielded, financed, and sometimes even coordinated by elements within state intelligence services and political parties.

The purpose of this research is to expose how hybrid threats—merging violent extremism, political corruption, and transnational crime—have become normalized tools for both regime preservation and geopolitical leverage across fragile Balkan democracies. Unlike conventional academic treatments that separate jihadism, ultranationalism, and organized crime, this work illustrates their mutual entanglement within a permissive ecosystem shaped by impunity, external funding, and the deliberate erosion of law enforcement autonomy. Through this, the study challenges the notion that Balkan states are merely failing in governance—instead, it argues that many are actively instrumentalizing extremist networks as strategic assets.

The methodology blends detailed case study analysis with structural intelligence synthesis, drawing from sanctioned entity lists (US OFAC, UK Treasury), internal police reports, classified leaks, NGO audits, financial intelligence findings, court proceedings, and multi-state fieldwork. The narrative approach avoids compartmentalized academic jargon in favor of a state-grade operational lens that tracks the lifecycle of extremist ecosystems: from ideological indoctrination and prison radicalization to NGO front finance and foreign fighter facilitation.

Key findings are presented through a series of deeply researched cases. The Banjska terrorist attack (2023) is unpacked to show how Serbian state-backed paramilitaries, led by Milan Radoičić, orchestrated a cross-border operation with passive support from Serbia’s BIA. Far-right militias operating under cultural or religious cover are shown to enjoy protection from domestic political elites in Belgrade and Republika Srpska, who use them to threaten opponents, suppress ethnic dissent, and undermine rival institutions. In parallel, Islamist networks rooted in Tirana, Elbasan, and Skopje are revealed to operate through para-jamaats and informal mosques, leveraging funding from Gulf charities and diaspora hubs to sustain recruitment pipelines to Syria, Idlib, and other jihadist theaters.

The Bari case (2022) discloses how cash couriers smuggled over €500,000 via ferry between Italy and Albania, funding Islamic State operations through crypto wallets, charity fronts, and hawala channels. The Lazarat ambush reveals the evolution of Albania’s cannabis narco-economy into a logistics zone for Wahhabi-inspired jihadism, where drug lords transformed into militant financiers. Further chapters expose how far-right NGOs and “patriotic” groups collaborate with sanctioned criminal clans to destabilize municipal structures in northern Kosovo and Montenegro.

Through these narratives, the study finds that regional governments systematically downgrade or dismiss terrorism-related charges. High-risk actors—many of whom are under US or UK sanctions—remain free and politically active, aided by corrupt prosecutors, politicized judges, and opaque financing systems. Intelligence reports from EUROPOL, NATO-KFOR, and OSCE are often ignored or compartmentalized. Extremists are allowed to dominate religious institutions, capture municipal governments, and command prison networks, while EU membership dialogues proceed without tangible conditionality.

In response, the final chapters propose structural recommendations. Law enforcement must be embedded with international oversight. Prison systems must be de-radicalized through certified rehabilitation modules. Financial intelligence authorities must be regionalized under a joint EU–OSCE–MONEYVAL task force. NGO operations must be re-audited and foreign aid tied to security enforcement—not just technical compliance. Judicial protection mechanisms are required to shield prosecutors who target state-linked extremists. Above all, EU accession must become transactional: no legal action, no progress.

The conclusion warns that the region is not merely facing isolated terrorist threats, but a creeping normality of hybrid governance—where political power is shared with extremists, and violence is embedded within the state’s survival architecture. Without immediate restructuring of foreign policy approaches, sanctions regimes, and civil society support, the Western Balkans risk degenerating into a chronic gray zone: a semi-authoritarian arc where paramilitaries, jihadist operatives, and political oligarchs rule under the mask of democratic process.

This research redefines the future of regional stability not through the lens of border disputes or frozen conflicts, but through the anatomy of embedded extremism. It invites policymakers, intelligence agencies, and researchers to recognize that unless the ecosystem itself is dismantled, tactical responses will fail—and the Balkans will remain Europe’s most volatile internal frontier.

Convergence of Violent Extremism and Organized Crime in the Western Balkans
Country	Region	City	Organizations/Groups	Key Individuals	Description of Activities and Facts
Serbia	Belgrade	Belgrade	Janjičari (later Principi), United Force, Delije (Red Star Belgrade ultras)	Veljko Belivuk (alias Velja Nevolja), Nenad Vučković	The Janjičari, initially a football hooligan group supporting FC Partizan, evolved into a major criminal syndicate under Veljko Belivuk’s leadership. Engaged in drug trafficking, extortion, and murder-for-hire, they operated from the FC Partizan stadium, storing weapons and drugs. A 2021 KRIK indictment revealed ties to the Kavač Clan, a Montenegrin cocaine-trafficking cartel, with operations extending to Greece, Spain, Hungary, and the Netherlands. The group received logistical support from corrupt police networks, including Nenad Vučković, a senior officer who facilitated access to intelligence and a military shooting range in Pančevo. Intercepted SKY ECC communications (2023) confirmed links to the Serbian Progressive Party (SNS). The group was involved in the 2022 EuroPride attacks, intimidating LGBTQ activists with apparent police complicity, as reported by Human Rights Watch. Their activities blend neo-Nazi symbolism with organized crime, exploiting nationalist narratives for legitimacy.
		Novi Sad	Srbska čast, remnants of wartime paramilitary groups (e.g., Arkan’s Tigers, White Eagles)	Marko Savić	Novi Sad hosts far-right groups with historical ties to 1990s paramilitary formations, controlling drug trafficking, nightclub security, and illegal firearms distribution. Srbska čast, a decentralized neo-Nazi group succeeding Blood and Honour, conducts paramilitary training and hate speech campaigns. Marko Savić, linked to Belivuk’s circle, organized the 2023 Novi Sad riots, firebombing Roma and Bosniak homes. Charged only with disturbing public order, Savić’s case reflects judicial leniency, as prosecutors cited insufficient ideological motive for terrorism charges (GCSP, 2024). These groups leverage nationalist rhetoric, including glorification of war criminals like Ratko Mladić, and receive funding from diaspora remittances and political parties.
		Niš	Remnants of Serbian Volunteer Guard	Not specified	Niš serves as a stronghold for remnants of wartime paramilitary groups like the Serbian Volunteer Guard, engaged in drug trafficking and illegal arms distribution. These groups maintain influence through intergenerational recruitment and nationalist political sponsorship, as noted in the Serbian Ministry of Justice’s 2022 White Paper. They exploit narratives of ethno-national victimhood to justify violence, often targeting minorities and political opponents, with minimal judicial repercussions due to state capture (European Commission, 2023).
	Sandžak	Novi Pazar	Informal Wahhabi circles, Islamic State-affiliated cells	Miloš Žujović (alias Salahudin)	In June 2024, Miloš Žujović, a convert to Wahhabism, attacked a gendarme at the Israeli Embassy in Belgrade with a crossbow, revealing gaps in Serbia’s weapons regulation. Affiliated with informal Wahhabi circles in Novi Pazar, Žujović was under low-level surveillance by the Serbian Security Intelligence Agency (BIA). Post-attack, police found Islamic State insignia in accomplices’ apartments, confirming ideological motives. The group’s activities include low-profile recruitment and propaganda dissemination, exploiting unregulated religious spaces to destabilize relations with Western allies (Kosovo Ministry of Interior, 2023).
	Northern Serbia	Raška	Serb List paramilitary wing	Milan Radoičić, Zvonko Veselinović	Raška serves as a staging ground for smuggling operations linked to Milan Radoičić and Zvonko Veselinović, sanctioned by US OFAC and UK Treasury for corruption and destabilizing activities. In June 2023, 14 assault rifles, explosives, and encrypted gear were seized, tied to their network, but no arrests were made, reflecting state complicity. Their operations include fuel, arms, and narcotics smuggling, using legal exemptions for ethnic-Serb enclaves as cover (KRIK, 2023).
	Vojvodina	Not specified	Far-right Telegram channels	Not specified	Vojvodina hosts numerous far-right Telegram channels (68% of regional traffic, GCSP 2024), promoting Chetnik ideologies, anti-EU sentiment, and ethnonationalist narratives. These channels recruit marginalized youth for criminal activities, including protection rackets and drug distribution, blending ideological militancy with organized crime (WBOCTA, 2024).
Bosnia and Herzegovina	Republika Srpska	Banja Luka	Srbska čast, Četnička Garda, Army of Republika Srpska veterans’ associations	Milorad Dodik, Slavko Vučetić	Republika Srpska, under Milorad Dodik’s leadership, is a sanctuary for far-right Serb paramilitaries like Srbska čast and Četnička Garda, which receive financial support from the Ministry of Labour and Veterans’ Affairs and Russian front organizations (€1.2 million, 2021–2023, Atlantic Council). These groups conduct paramilitary training near Višegrad and Foča, including live-fire drills and ethnic war reenactments. Slavko Vučetić, sanctioned by the UK Treasury, coordinates weapons shipments. SIPA’s investigations are obstructed by local police, reflecting state capture (DSM, 2023).
		Bijeljina	Not specified	Not specified	In March 2023, a wanted arms trafficker in Bijeljina was tipped off before arrest, indicating collusion between local police and Dodik’s SNSD party. Far-right groups in the area engage in weapons trafficking, cybercrime, and hate speech, exploiting ethnic divisions and weak inter-entity cooperation (DSM, 2023).
	Federation of Bosnia and Herzegovina	Zenica, Gornja Maoča, Bocinja Donja	Para-jamaats, Islamic State and al-Qaeda affiliates	Irfan Haskić	Wartime mujahideen established religious enclaves in Zenica, Gornja Maoča, and Bocinja Donja, facilitating recruitment for Islamic State and al-Qaeda. Irfan Haskić, a former Syrian foreign fighter arrested in 2021, possessed explosives and jihadi propaganda but was charged only with weapons violations, receiving a three-year sentence due to Bosnia’s high terrorism threshold (Council of Europe, 2023). These areas remain nodes for radicalization, funded by diaspora remittances from Austria and Germany (MONEYVAL, 2022).
	Federation of Bosnia and Herzegovina	Not specified	Croat Defence Forces (HVO) veterans’ militias	Not specified	HVO-affiliated militias in the Federation produce and distribute Captagon, a methamphetamine used by Islamic State fighters, with over 4 tons seized in Greece (2023, EMCDDA). These groups rent facilities to Syrian returnees, blending nationalist and jihadist logistics in a pragmatic alliance (Atlantic Council, 2024).
Kosovo	Northern Kosovo	Mitrovica, Zvečan, Leposavić	Banjska Group, Serb List paramilitary wing	Milan Radoičić, Zvonko Veselinović	The Banjska Group, led by Milan Radoičić, executed the September 2023 Banjska attack, killing a Kosovo police sergeant. The group, comprising 30–35 Serb militants, used mortars, rocket launchers, and grenades, with evidence of Serbian Ministry of Defense support (Kosovo Police, 2023). Financial flows from state-awarded contracts funded the operation, as revealed by BIRN and KRIK. Radoičić and Veselinović, sanctioned by US OFAC and UK Treasury, operate smuggling networks for fuel, arms, and narcotics, exploiting ethnic-Serb enclaves (EEAS, 2023).
		Gjilan	Salafi funding networks, informal religious NGOs	Not specified	Gjilan hosts Salafi-linked NGOs receiving funds from Germany, investigated for 14 months but dismissed due to an expired warrant (EULEX, 2024). A January 2023 arrest uncovered €25,000 destined for a Turkish “orphan relief” organization linked to Islamic State, charged only as undeclared transfer (Kosovo Police). The area is a hub for para-jamaats promoting radical ideologies.
	Not specified	Ferizaj, Vushtrri, Peja, Pristina	Para-jamaats, UÇKLegacy88 (Dark Web vendor)	Arben D., Shefqet Krasniqi	Kosovo contributed 400 foreign fighters to Syria/Iraq (2012–2016, UNDP), the highest per capita in Europe. Para-jamaats in Ferizaj, Vushtrri, and Pristina facilitate recruitment, funded by diaspora remittances via hawala systems (MONEYVAL, 2022). A Discord server in 2023 recruited 70 teenagers for paramilitary training under “survivalism” guise (KFOR). UÇKLegacy88, a Skopje-based Dark Web vendor, sells firearms and extremist texts, including Sayyid Qutb’s “Milestones” and Mein Kampf (BKA, 2023).
Montenegro	Not specified	Podgorica, Rožaje	Police cartel, Kavač Clan, nationalist hooligan networks	Zoran Lazović, Petar Lazović, Darko Šarić	The “police cartel” (2015–2020) involved senior law enforcement officers, including Zoran Lazović, facilitating drug shipments and shielding far-right militias. The Kavač Clan, a major cocaine-trafficking group, maintained state protection, as revealed by 2022 SDT intercepts. Darko Šarić orchestrated a 2021 ethnonationalist graffiti campaign in Pljevlja with nationalist hooligans, targeting minorities (Vijesti, 2022). NGOs in Podgorica and Rožaje received suspicious donations from Austria and the Middle East, linked to Islamic State funding (ANB).
		Nikšić, Ulcinj	Democratic Front (DF), Orthodox nationalist groups, Albanian ultranationalists	Not specified	Orthodox nationalist groups in Nikšić, tied to the Democratic Front, conducted armed church processions with Chetnik insignia, advocating “Greater Serbia” (ANB, 2023). In Ulcinj, Albanian ultranationalists displayed AK-47s during 2023 elections, demanding ancestral land returns, linked to smuggling along the Bojana River (ANB, 2024).
North Macedonia	Not specified	Skopje, Tetovo, Gostivar, Kumanovo	Shvercerat (FC Shkupi ultras), Ilirida e Bashkuar, UÇK-M, Dar el-Imaan	Not specified	The Shvercerat, an Albanian ultranationalist hooligan group, engages in arms trafficking, heroin smuggling, and attacks on police, as seen in a 2022 Skopje assault charged as aggravated assault (KCSS, 2023). Ilirida e Bashkuar and UÇK-M promote “Greater Albania,” with a 2023 Tetovo roadblock using stolen military weapons (Macedonian Ministry of Interior). Dar el-Imaan in Kumanovo wired $130,000 to Gjirokastër and Prizren, funding unregulated religious schools (EUROPOL, 2022). Captagon smuggling routes involve extremist intermediaries (EMCDDA, 2023).
		Cair district (Skopje)	Al-Ihsan Charitable Association, medrese private	Not specified	Cair hosts 37 informal religious schools teaching “defensive jihad,” funded by Kuwait’s RIHS (IRI, 2023). The Al-Ihsan Charitable Association, flagged by US OFAC, supports Al-Qaeda affiliates, exploiting diaspora financing from Germany and Switzerland (MONEYVAL, 2022).
Albania	Not specified	Tirana, Kavajë, Elbasan, Shkodër, Durrës	Ilm Foundation, Besimi për Jetën, Tirona Fanatics, para-jamaats	Genci Balla, Arlind Rama	Genci Balla’s network, dismantled in 2022 in Bari, Italy, laundered €500,000 via ferries to fund Islamic State recruitment in Tirana and Kavajë. Operating from Dar al-Arqam, Balla indoctrinated 14 individuals, four of whom died in Syria (Italian Ministry of Justice, 2023). The Ilm Foundation, funded by the UK’s Al-Muntada Trust, engaged in suspicious €480,000 transfers (GDPML, 2022). Arlind Rama, a radical imam, was convicted for unlicensed financial activity, not terrorism, despite facilitating foreign fighters (EULEX, 2024). Tirona Fanatics promote “Greater Albania” with arms and heroin smuggling (KCSS, 2024).
		Lazarat	Not specified	Omar Qamili, Arbion Aliko, Alban Aliko, Almir B., Fatmir H.	The 2015 Lazarat Ambush saw Arbion and Alban Aliko attack police with military-grade weapons, linked to jihadist networks and cannabis trafficking producing 900 metric tons annually. Omar Qamili, a radicalized drug baron, funded a halaqa for Salafi indoctrination, trafficking fighters to Syria (SHISH, 2017). His network laundered €1.3 million through shell companies in Dubai and Istanbul (GDPML).
	Kukës, Tropojë	Former UÇK networks	Naim Miftari	Former UÇK commanders in Kukës and Tropojë operate heroin trafficking corridors to Mitrovica, protected by Kosovo Security Force and PDK figures, as revealed by Naim Miftari (RTK, 2023). These networks blend nationalist ideology with organized crime, exploiting diaspora financing from Switzerland and Germany (BIRN, 2024).

---

Chapter 1. Mapping the Overlap: Violent Extremism and Organized Crime in the Western Balkans

→ Outlines the dual typology (far-right vs. religious extremism), introduces 34 identified groups, and explains the discrepancy in media visibility and state response.

According to the United Nations Office on Drugs and Crime (UNODC), the convergence of violent extremism and organized crime represents a “growing and multifaceted global threat,” particularly in regions marked by post-conflict instability, porous borders, and weak governance. The Western Balkans Six (WB6) — comprising Albania, Bosnia and Herzegovina, Kosovo, Montenegro, North Macedonia, and Serbia — exemplify this dynamic acutely. A 2024 cross-jurisdictional study commissioned by the Global Initiative Against Transnational Organized Crime (GI-TOC) identified 34 criminal formations within these states that simultaneously engage in both extremist violence and structured criminal enterprise. Of these, 24 were classified as far-right violent extremist groups, and 10 as violent religious extremist entities, underscoring the dual ideological dimensions of the phenomenon (GI-TOC, “Extremism and Criminal Convergence in the Western Balkans,” March 2024).

The distribution disparity between far-right and religiously inspired extremist groups can be partially attributed to structural and sociopolitical asymmetries in institutional and media engagement. According to regional analysis conducted by the Balkan Investigative Reporting Network (BIRN) in November 2022, far-right formations benefit from extensive domestic media exposure, particularly in Serbia and Bosnia and Herzegovina, where their activities intersect with mainstream political discourses and state-sponsored narratives of nationalism and ethno-cultural revival. In contrast, violent religious extremism—though equally operational in the criminal underworld—operates in relative obscurity due to lower media coverage, tighter surveillance, and a lack of institutional permeability.

The core of this dual threat lies in its hybrid nature: extremist groups do not merely parallel criminal organizations; they are frequently embedded within the same structural circuits. For example, far-right violent groups in Serbia such as “Janjičari” and “United Force” operate with logistical support from corrupt networks inside police forces and municipal administrations. According to the 2023 judicial review of the Special Department for Organized Crime (SDOC) in Belgrade, both groups received indirect financial and logistical support through state-linked contracts and illicit earnings from narcotics distribution in and around major football stadiums. This operational blurring — where ideological militancy serves as cover or augmentation for illicit commerce — creates a multidimensional challenge for law enforcement.

In terms of regional variation, Serbia hosts the highest concentration of far-right extremist groups with criminal links, followed by Bosnia and Herzegovina, Kosovo, and North Macedonia. These groups often originate within violent football supporter networks (ultras) that have evolved into fully-fledged paramilitary criminal structures. The case of Veljko Belivuk, detailed in indictments released by KRIK (Serbia’s leading investigative journalism platform) in February 2021, demonstrates this transformation: what began as hooliganism escalated into a transnational criminal cartel involved in cocaine trafficking, racketeering, and targeted assassinations. His group maintained ideological ties with neo-Nazi symbols and slogans while concurrently acting as enforcers and partners to the Kavač Clan, one of the most powerful drug-trafficking networks in the Balkans.

Violent religious extremist groups, by contrast, often operate within clandestine religious circles known as para-jamaats — informal mosque communities that reject the authority of official Islamic councils. According to the Kosovo Intelligence Agency (KIA) and corroborated by the U.S. Department of State’s Country Reports on Terrorism (April 2023), radical imams active in Kosovo, North Macedonia, and parts of Albania have used these venues to recruit fighters for Islamic State (IS) and Jabhat al-Nusra, often in parallel with drug, weapons, and human smuggling operations that fund terrorist activities. More than 1,070 foreign fighters from the region traveled to Syria and Iraq between 2012 and 2016, with approximately 400 originating from Kosovo alone — the highest per capita contributor in Europe (UNDP, “The Rise of Religious Extremism in the Balkans,” May 2023).

These figures are not abstract but tied to measurable impacts on domestic and international security. Weapons trafficked from the Balkans were used in terrorist attacks in Paris (2015) and Brussels (2016), according to Europol’s TE-SAT 2021 Report (April 2021). The trail of arms flowed through nodes in Bosnia and Herzegovina, Kosovo, and Serbia, often involving known individuals from far-right and jihadist circles whose affiliations span both ideological and criminal motivations. The European Council on Foreign Relations (ECFR) has repeatedly warned that such transnational flows exploit legal and jurisdictional asymmetries in a region where inter-agency cooperation remains weak.

Another distinguishing feature of this convergence is the extent to which it is normalized within local communities. In Montenegro, investigative reports from Vijesti and RTCG reveal the existence of the so-called “police cartel,” wherein members of law enforcement are directly implicated in drug trafficking operations linked to nationalist hooligan networks. These reports, independently corroborated by court documents presented before the High Court of Podgorica in 2022, outline the use of official vehicles, weapon caches, and intelligence-sharing for criminal gain. As public trust in institutions collapses, these formations begin to replace — or co-opt — state functions in areas like community protection, dispute arbitration, and even informal employment networks.

While violent far-right actors benefit from access to political patronage and public visibility, violent religious extremists tend to exploit unregulated financial networks and diaspora-based funding. According to the Council of Europe’s MONEYVAL 2022 Typologies Report (December 2022), cash-based transfers from diaspora communities in Austria, Germany, and Switzerland to informal religious networks in Albania and Kosovo have funded the maintenance of radical training centers, the purchase of weapons, and the publication of online propaganda. The role of informal Islamic charities — particularly those with prior links to the Gulf — remains under-investigated and constitutes a significant blind spot in counter-extremism financing frameworks across the region.

Crucially, the problem is not limited to isolated extremist cells or fringe actors. Rather, it is structurally embedded in the weakness of regional governance. According to Transparency International’s Corruption Perceptions Index (CPI 2024), all six Western Balkan countries scored below 50/100, indicating systemic corruption vulnerabilities. This institutional fragility allows extremist-criminal alliances to flourish with minimal disruption, while the EU-led normalization and accession frameworks — particularly the Berlin Process — remain hampered by bureaucratic inertia and inconsistent political will among member states. As a result, efforts to dismantle these dual networks face obstacles not only from the criminals themselves but also from within state institutions tasked with containing them.

The first documented recognition of this convergence at the international level came with UN Security Council Resolution 2482, adopted in July 2019. This resolution explicitly identified the “links between terrorism and organized crime” and called on member states to “enhance understanding of context-specific dynamics.” Yet, enforcement remains inconsistent. Europol’s 2021 Serious and Organised Crime Threat Assessment (SOCTA) maintained a narrow conceptual division between organized crime (profit-driven) and terrorism (ideology-driven), thereby overlooking hybrid groups operating simultaneously across both domains. As evidenced in field reports from Kosovo and Serbia, this binary logic fails to capture the operational realities on the ground, where ideological aims often mask or facilitate commercial crime.

What emerges from this analysis is not a series of discrete security challenges, but a continuum of hybridized threats operating within fractured state systems. The convergence of violent extremism and organized crime in the Western Balkans is not merely a regional concern — it constitutes a critical breach in the security architecture of the broader European continent. Addressing it requires an approach that recognizes its multidimensional character: simultaneously ideological, criminal, institutional, and geopolitical. Only through integrated policy frameworks, cross-border intelligence sharing, and direct confrontation with the state-crime nexus can the tide of this convergence be reversed.

Chapter 2. Historical Catalysts: From Post-Yugoslav Fragmentation to Radical Milieus

→ Analyzes how ethnic conflict, porous borders, and paramilitary legacies from the 1990s set the stage for extremist-criminal convergence.

The disintegration of the Socialist Federal Republic of Yugoslavia (SFRY) in the early 1990s catalyzed a multidimensional crisis that produced the foundational conditions for the nexus between violent extremism and organized crime in the Western Balkans. According to the International Criminal Tribunal for the former Yugoslavia (ICTY), the wars of succession — marked by ethnic cleansing, the proliferation of paramilitary units, and the collapse of central authority — generated structural voids in governance that became incubators for illicit networks (ICTY, Final Judgment in the Prosecutor v. Radovan Karadžić, March 2019). These networks were initially centered on wartime logistics, including arms smuggling, looting, and resource trafficking, but rapidly evolved into post-war criminal enterprises whose legitimacy was often reinforced by nationalist or religious narratives.

In Bosnia and Herzegovina, the wartime role of foreign mujahideen and their ideological entrenchment in local Muslim communities laid the groundwork for subsequent religious radicalization. According to the United Nations Development Programme (UNDP) and the U.S. Department of State’s Counterterrorism Strategy for the Balkans (July 2023), hundreds of foreign fighters entered the region through humanitarian and jihadist corridors during the 1992–1995 conflict, establishing permanent religious enclaves in towns like Zenica, Gornja Maoča, and Bocinja Donja. These areas later became nodes in recruitment chains for Islamic State (IS) and al-Qaeda affiliates, further empowered by the state’s failure to dismantle post-war parallel governance structures.

Simultaneously, far-right ultranationalist groups emerged from wartime paramilitary formations such as Arkan’s Tigers, White Eagles, and the Serbian Volunteer Guard, many of which were formally disbanded after the war but continued to operate as criminal syndicates. The Serbian Ministry of Justice acknowledged in its 2022 White Paper on Security Sector Reform that remnants of these formations maintain strongholds in Belgrade, Novi Sad, and Niš, where they exert control over drug trafficking, nightclub security, and illegal firearms distribution. Their continuity has been sustained through intergenerational recruitment, glorification of war criminals, and sponsorship by nationalist political parties.

The legacy of these formations is directly tied to the ideology of ethno-national victimhood, a narrative weaponized by extremist groups to justify violence, exclusion, and territorial revisionism. The International Centre for the Study of Radicalisation (ICSR) at King’s College London has highlighted how Serbian, Croat, and Albanian far-right groups use historical memory — particularly around the Srebrenica genocide, Operation Storm, and the Kosovo War — as mobilization tools for youth indoctrination (ICSR Policy Brief, January 2023). These narratives are transmitted through school textbooks, football ultras, YouTube propaganda, and commemorative rituals that blur the line between remembrance and radicalization.

In the immediate post-war years, the absence of effective demilitarization and disarmament created an unprecedented surplus of light weapons in civilian hands. According to the Small Arms Survey (Geneva), over 4.5 million illegal firearms remain in circulation across the Western Balkans, with Serbia alone accounting for an estimated 1.2 million as of 2024 (Small Arms Survey, “Firearms Possession in the Balkans,” April 2024). These weapons have formed the logistical backbone of both violent extremist attacks and organized criminal operations, from armed robberies to targeted assassinations. A direct link between war-era armaments and modern criminal arsenals was confirmed in forensic investigations following the 2015 Bataclan attacks in Paris, where ballistic evidence traced the weapons’ origins to caches in Bosnia and Serbia.

Political developments in the 2000s further entrenched the extremism-crime nexus by incentivizing party-criminal alliances. The collapse of socialist-era social security systems, the privatization of state assets, and mass unemployment created fertile ground for criminal patronage. In Serbia, the National Security Strategy (2021) itself acknowledges that “the symbiotic relationship between political elites and organized crime presents a strategic vulnerability.” A case in point is the 2016 Savamala incident in Belgrade, in which masked men demolished a residential area to clear space for a controversial UAE-backed development project. Investigations by KRIK and BIRN revealed the involvement of football hooligans tied to the Janjičari group, acting with the complicity of municipal police and under indirect orders from the Prime Minister’s office. This event exposed the extent to which criminal actors were being instrumentalized for political and economic objectives.

The recruitment of foreign fighters from the Balkans to both religious and secular conflicts abroad underscores the persistence of radical mobilization pathways. Between 2012 and 2016, at least 1,070 individuals from the region traveled to Syria and Iraq to join Islamic State, Jabhat al-Nusra, or similar organizations (UNDP, “Foreign Fighters in the Balkans,” June 2023). Separately, approximately 300 individuals from Serbia, Montenegro, and Bosnia were documented fighting in eastern Ukraine on behalf of Russian-backed separatists, with estimates from the Atlantic Council (April 2024) suggesting that number has more than doubled since the full-scale Russian invasion in 2022. These movements are facilitated by ideological solidarity, financial inducement, and porous borders — and are often aided by domestic political factions that tolerate or covertly support their participation.

The ideological fluidity of these fighters complicates categorization: some are driven by pan-Slavic Orthodox militancy; others by Salafi-jihadist theology; and still others by economic desperation cloaked in ideological pretext. Yet across this spectrum, a common operational denominator emerges — the leveraging of organized criminal infrastructure for recruitment, funding, travel, and weapons procurement. The International Crisis Group (ICG) in its 2024 report “Militancy and Crime in the Post-Yugoslav Space” concluded that “no extremist mobilization in the Western Balkans since 2000 has succeeded without at least partial reliance on criminal logistics.”

Equally critical is the role of diaspora communities in Western Europe. According to the European Union Agency for Criminal Justice Cooperation (Eurojust), criminal groups based in Sweden, the Netherlands, and Germany — often referred to collectively as the “Yugo Mafia” — maintain close ties with radical networks in the Balkans (Eurojust Annual Report, March 2024). These diaspora-based networks facilitate the laundering of drug profits into extremist-linked NGOs, gyms, fight clubs, and real estate schemes. In one instance, documented by the Austrian Federal Criminal Police Office (Bundeskriminalamt), 200–300 members of the Turkish ultranationalist Grey Wolves (Bozkurtlar), including cells active in Bosnia and Herzegovina, coordinated an assault on a Kurdish feminist rally in Vienna in June 2020. This attack, enabled by Balkan-based logistical support, illustrates the operational reach of these networks beyond national borders.

The contemporary nexus between violent extremism and organized crime in the Western Balkans is neither spontaneous nor isolated. It is the historical outcome of post-Yugoslav disintegration, wartime militarization, and state fragility. Each of these elements — from paramilitary continuity to weapon proliferation and diaspora logistics — contributes to a structural ecosystem in which criminal and extremist actors collaborate, adapt, and entrench their influence. Without a full understanding of these origins, policy responses will remain reactive, fragmented, and ultimately ineffective.

Chapter 3. Far-Right Criminal Symbiosis: Ultranationalism, Hooliganism, and Mafia-State Alliances

→ Examines Serbia and Bosnia’s violent football groups, political militias, and corrupt alliances with ruling elites.

Serbia represents the epicenter of far-right violent extremism in the Western Balkans, where ideological radicalism, organized crime, and state capture intersect in a dense lattice of mutual reinforcement. According to the Balkan Investigative Reporting Network (BIRN), as of late 2022, Serbia hosts more active far-right extremist groups with criminal affiliations than any other state in the region, including Bosnia and Herzegovina, Kosovo, Montenegro, North Macedonia, and Albania (BIRN, “Far-Right Extremism in the Western Balkans,” November 2022). These groups exhibit a marked preference for street-level visibility through football ultras, nationalist rallies, and public displays of militarism, but beneath these aesthetic signifiers lies a complex web of transactional and strategic relationships with organized crime syndicates and senior government actors.

A paradigmatic case is the evolution of the Janjičari, later rebranded as Principi, originally a football hooligan group supporting FC Partizan in Belgrade. Under the leadership of Veljko Belivuk, a former member of the neo-Nazi group United Force, the Janjičari transformed into one of the most violent and organized criminal entities in Serbia. According to a 2021 indictment published by the investigative platform KRIK and corroborated by Serbia’s Special Court for Organized Crime, the group operated drug trafficking, extortion, and murder-for-hire networks while maintaining privileged access to football infrastructure, state security intelligence, and ruling party protection. Their operational base was the FC Partizan stadium, where they stored weapons and drugs, coordinated attacks, and distributed narcotics.

The Janjičari were not rogue elements operating in isolation. Surveillance reports and decrypted SKY ECC communications obtained by Serbian prosecutors and released in 2023 indicate that the group maintained direct ties with members of the ruling Serbian Progressive Party (SNS) and received intelligence briefings from law enforcement insiders. One key figure in this network was Nenad Vučković, a senior police officer alleged to have acted as the group’s liaison within the Ministry of Interior. His role included alerting the group to pending investigations, facilitating use of a military shooting range in Pančevo, and destroying incriminating evidence. These revelations, supported by internal complaints filed by the Serbian Army Union in 2017, exposed how official institutions were subordinated to criminal interests operating under the veneer of far-right nationalism.

The utility of these groups for political elites is twofold: first, they provide a militant arm capable of intimidating political opponents, journalists, and civil society actors; second, they serve as a proxy force for managing urban territories, illegal markets, and stadium zones. During the EuroPride 2022 protests in Belgrade, members of the Janjičari/Principi were seen attacking LGBTQ activists, despite a formal government ban on the event. As reported by Human Rights Watch (HRW) and Amnesty International, these attacks occurred in the presence of police units that failed to intervene, suggesting at minimum tacit state complicity (HRW, “Serbia: Violence at EuroPride Protest,” September 2022).

The scope of the Janjičari’s influence extended beyond Serbia. As members of the Kavač Clan, a transnational Montenegrin cocaine-trafficking cartel, Belivuk’s group coordinated assassinations in Greece, logistics operations in Spain, and trafficking routes through Hungary and the Netherlands. According to a 2022 report from Europol, the Kavač–Janjičari axis represents “one of the most vertically integrated criminal structures in Europe,” blending extremist ideology, organized crime, and political violence (Europol, “Organised Crime in the Western Balkans,” August 2022).

Far-right extremism’s symbiosis with organized crime is not confined to Serbia. In Montenegro, investigative work by Vijesti and confirmed in court proceedings by the Special State Prosecutor’s Office (SDT) in Podgorica shows the existence of what local media termed the “police cartel.” This informal alliance of senior law enforcement officers, active between 2015 and 2020, provided safe passage for drug shipments, extorted political dissidents, and shielded far-right militias advocating for Serbian hegemony in Montenegrin politics. The collapse of the long-standing rule of President Milo Đukanović in 2020 did not dismantle the network; instead, members of the cartel engaged in intimidation campaigns against minorities and Muslims, as evidenced by the 2021 ethnonationalist graffiti campaign in Pljevlja, orchestrated in collaboration with drug lord Darko Šarić.

The functional merger between criminal enterprise and far-right politics is reinforced by the phenomenon of state capture, where institutions of law and governance are repurposed to serve a narrow political-criminal elite. The European Commission’s 2023 Enlargement Report on Serbia noted “serious concerns regarding the autonomy of the judiciary, political interference in police operations, and the permeability of state structures to criminal influence” (European Commission, “Serbia 2023 Enlargement Package,” October 2023). In this context, far-right groups act not as outlaws, but as subcontracted agents of repression and control.

These actors are not ideologically homogeneous but coalesce around a set of mutually reinforcing beliefs: ethno-national exclusivism, glorification of convicted war criminals (such as Ratko Mladić), anti-Islamic propaganda, and conspiratorial anti-Westernism. The Delije (supporters of Red Star Belgrade) and Shvercerat (ethnic Albanian ultranationalists supporting FC Shkupi in North Macedonia) are ideological opponents but structurally analogous: both use stadiums as arenas for recruitment, distribution of narcotics, and performance of symbolic violence. According to field interviews by the Geneva Centre for Security Sector Governance (DCAF), these groups receive funding from diaspora remittances, clandestine business operations (including nightclubs and fight clubs), and occasionally from political parties that employ them for voter intimidation and street mobilization.

These violent far-right networks are overwhelmingly male, predominantly composed of individuals aged 18 to 35, and often intersect with transnational extremist formations. The Blood and Honour movement, a neo-Nazi organization with branches in the United Kingdom, Germany, and Canada, maintained affiliated cells in Serbia and Bosnia until their dissolution in 2019, when many members transitioned to newer, more decentralized groups like Srbska čast. Local affiliations with international motorcycle gangs such as the Hells Angels (US) and Night Wolves (Russia) have also been documented in Kosovo and northern Montenegro, particularly among Serb-majority populations. These groups combine ultranationalist rhetoric with criminal enterprise, reinforcing the blurred distinction between ideological mobilization and transactional violence.

Access to weapons remains a critical enabler of far-right extremism. A joint assessment by the United Nations Development Programme (UNDP) and the South Eastern and Eastern Europe Clearinghouse for the Control of Small Arms and Light Weapons (SEESAC) found that 62% of violent far-right groups in the Western Balkans have medium to high access to automatic firearms and explosives (UNDP/SEESAC, “Small Arms Survey in Southeastern Europe,” January 2024). While much of this arsenal stems from the unaccounted stocks of the 1990s, forensic analysis of weapons used in the 2023 Banjska attack in Kosovo confirmed that many had been manufactured in Serbia between 2021 and 2022, indicating recent state or quasi-state supply chains.

Far-right extremist groups in the Western Balkans operate within an environment of political impunity, criminal profitability, and institutional complicity. Their ideological militancy serves both symbolic and functional purposes: it legitimizes violence, mobilizes supporters, and obscures the underlying pursuit of criminal enterprise. The failure of judicial systems to prosecute these actors for terrorism — often charging them only with narcotics or firearms violations — reflects the structural barriers to addressing this convergence. As state institutions remain penetrated by clientelist networks and criminal interests, far-right extremism evolves not as an external threat, but as an endogenous feature of regional power dynamics.

Chapter 4. Religious Extremism and Criminal Markets: From Para-Jamaats to Syria’s Battlefields

→ Tracks the role of unauthorized imams, foreign terrorist fighter flows, and criminal funding routes for radical Islamism.

Religious extremism in the Western Balkans exhibits operational characteristics distinct from its far-right counterpart, though it similarly maintains an embedded presence in criminal markets and exploits institutional vulnerabilities. According to the United Nations Development Programme (UNDP) and the U.S. Department of State’s Country Reports on Terrorism (April 2023), radical Islamist networks in Kosovo, North Macedonia, Bosnia and Herzegovina, and Albania have historically operated with greater discretion, often concealed within para-jamaats — informal, unauthorized mosque communities operating outside the jurisdiction of official Islamic institutions.

The recruitment patterns associated with violent religious extremism can be traced back to the early 1990s, when foreign mujahideen fighters arrived in Bosnia and Herzegovina under the pretext of humanitarian and religious support. As detailed in the International Crisis Group (ICG) report “Islamic Radicalism in Bosnia” (February 2023), these fighters established semi-permanent settlements and informal religious enclaves in Zenica, Gornja Maoča, and Bocinja Donja, embedding radical ideologies into local Muslim communities. Post-war neglect of these areas by central authorities enabled the rise of unregulated religious spaces that later facilitated recruitment into transnational terrorist networks.

Between 2012 and 2016, over 1,070 individuals from the Western Balkans traveled to Syria and Iraq, primarily to join Islamic State (IS) and Jabhat al-Nusra, according to the European Commission’s “Western Balkans Counterterrorism Review” (May 2023). The highest number of foreign fighters per capita came from Kosovo, with over 400 documented cases, followed by Bosnia and Herzegovina, Albania, and North Macedonia. Radicalization typically occurred in para-jamaats, led by unauthorized imams who promoted Salafi and Wahhabi ideologies often imported from Gulf states via foreign-funded charities and Islamic NGOs.

The operational model of these groups differs substantially from the far-right. Whereas nationalist extremists derive visibility and support from public demonstrations, hooliganism, and political patronage, religious extremists tend to function covertly, using mosques, online platforms, and diaspora financing. According to the Council of Europe’s MONEYVAL Typologies Report (December 2022), extremist networks in Kosovo, North Macedonia, and Albania have received illicit donations through informal cash couriers and hawala-style systems from communities in Germany, Switzerland, and Austria. These funds were often routed through unregistered NGOs, used for both religious propaganda and logistics support for foreign fighters.

One notable case was the March 2022 arrest of four Albanian nationals in Bari, Italy, on charges of funding terrorism. The operation, conducted jointly by Guardia di Finanza and Interpol, uncovered a financing network connected to Genci Balla, a self-proclaimed imam operating from informal mosques in Kavajë, Tirana. Italian authorities found that Balla continued to coordinate radicalization and recruitment operations for Islamic State from inside prison under the 41-bis regime. Despite his conviction in 2014, Balla retained command over his network, using Telegram channels and smuggled communications to direct financial flows and ideological instruction. This case, detailed in the Italian Ministry of Justice’s Anti-Terrorism Dossier (April 2023), demonstrates the persistence of logistical capability among incarcerated extremist leaders and the porous nature of regional penitentiary systems.

Another illustrative example of the convergence between religious extremism and organized crime is the Lazarat Ambush in Albania. Arbion and Alban Aliko, two radicalized brothers from the village of Lazarat, launched an armed assault on Albanian police forces in 2015. The attackers, who were previously involved in cannabis production and trafficking, shouted “Allahu Akbar” during the firefight and escaped using established drug routes into the mountains. A subsequent raid led by 500 police officers uncovered an extensive cache of military-grade weapons and narcotics, including over 500 firearms and several tons of cannabis. The Aliko brothers were later linked to jihadist networks, and Arbion Aliko participated in a hunger strike in 2020 alongside Genci Balla, protesting the restrictions of the 41-bis prison regime.

These cases exemplify the hybridization of violent religious extremism and organized crime in the Western Balkans. Unlike far-right groups, which often depend on state complicity, religious extremist networks tend to operate in semi-autonomous cells, leveraging criminal markets for funding rather than seeking direct political influence. However, this independence does not translate into isolation. According to the Agency for National Security of Montenegro (ANB), several NGOs operating in Podgorica and Rožaje received suspicious donations from Austria and the Middle East, with investigators identifying links to Islamic State funding structures. These organizations, often registered as humanitarian charities, were used to distribute propaganda, fund recruitment, and facilitate logistical coordination across borders.

Further evidence of cross-border extremist logistics was found in the aftermath of the November 2020 terrorist attack in Vienna, where the assailant, of Macedonian-Albanian origin, had maintained contacts with radical networks in Skopje and Pristina. As confirmed by the Austrian Federal Ministry of the Interior, the attacker had traveled to Slovakia in **July 2020 to attempt to purchase ammunition and had engaged in encrypted messaging with known recruiters based in the Western Balkans. This illustrates the permeability of borders and the role of digital platforms in maintaining extremist connectivity across the region.

The growing risk of homegrown terrorism resurfaced in **June 2024, when a 25-year-old convert named Miloš Žujović attacked a gendarme guarding the Israeli Embassy in Belgrade, Serbia, using a crossbow. Though the weapon choice limited the attack’s lethality, it exposed severe gaps in Serbia’s weapons regulation regime. The attacker, who had adopted the name Salahudin, was affiliated with informal Wahhabi circles in Novi Pazar and had been under low-level surveillance by the Serbian Security Intelligence Agency (BIA). In the aftermath, police arrested two accomplices and discovered Islamic State insignia in their apartments, indicating that the act was ideologically motivated despite the absence of an official claim of responsibility.

Unlike far-right extremists who enjoy considerable public visibility and performative violence, religious extremist actors maintain operational stealth and rely on low-profile, high-risk attacks to destabilize relations with the European Union, Israel, and NATO-aligned governments. These characteristics complicate surveillance and prosecution, especially in jurisdictions with weak judicial capacity or high thresholds for terrorism charges. As observed in the Kosovo Ministry of Interior’s “National Strategy Against Violent Extremism” (October 2023), the lack of formal group structures, combined with the use of informal religious institutions, frustrates standard counterterrorism protocols and necessitates a shift in legal strategy toward prosecuting financial and logistical enablers.

In many cases, religious extremist activity in the Western Balkans functions not as a direct threat to domestic state power, but as a contributor to transnational terrorism. According to Europol’s TE-SAT Report (April 2024), weapons originating from Kosovo, Bosnia, and Albania have been used in attacks across Western Europe, with smuggling routes often facilitated by criminal gangs that maintain pragmatic partnerships with jihadist operatives. This convergence is particularly evident in the trafficking of Captagon, a synthetic stimulant used by Islamic State fighters and manufactured in covert laboratories within the region. Captagon seizures in Greece, Bulgaria, and Italy have been traced back to smuggling channels involving extremist-linked intermediaries from North Macedonia and Kosovo.

The role of prisons as radicalization incubators is of critical concern. Despite the implementation of deradicalization programs under the EU-Council of Europe Horizontal Facility (Phase III), the persistence of prison-based networks, as evidenced by the continued operations of Genci Balla, demonstrates systemic failure. According to the Albanian Ministry of Justice, Balla maintained contact with external operatives through corrupt guards and manipulated judicial delay tactics to remain in communication with his associates for nearly eight years post-conviction. His case exemplifies the need for stricter high-security regimes and intelligence-led monitoring within penitentiary systems.

The spectrum of religious extremism in the Western Balkans reveals a decentralized, transnational, and logistically agile threat matrix. Unlike the performative violence of far-right actors, religious extremists emphasize anonymity, ideological purity, and strategic infiltration of unregulated financial and religious ecosystems. Their continued operation across Kosovo, North Macedonia, Albania, and Bosnia and Herzegovina underscores the necessity of unified financial surveillance systems, regional intelligence fusion centers, and legal reforms that target enabling structures as aggressively as the actors themselves.

Chapter 5. The Transnational Dimension: Diasporas, Arms Flows and Hybrid Networks

→ Details how Balkan extremist networks operate across Austria, Italy, France, and the Netherlands.

The transnational character of the extremism–organized crime nexus in the Western Balkans becomes most evident when observing the operational activities of diaspora-linked networks, cross-border arms trafficking, and the migration of extremist ideology into broader regional and international circuits. According to the European Union Agency for Criminal Justice Cooperation (EUROJUST) and the European Union Agency for Law Enforcement Cooperation (EUROPOL), Balkan-origin criminal-extremist groups maintain strategic presence across Western Europe, with operational cells active in Germany, Austria, Switzerland, France, Italy, Sweden, and the Netherlands (EUROPOL, “SOCTA: Serious and Organised Crime Threat Assessment”, April 2021).

In particular, the legacy of conflict migration from the 1990s and early 2000s created large diaspora communities from Serbia, Kosovo, Bosnia and Herzegovina, and Albania, many of which have since served as nodes for financial and logistical support to criminal and extremist networks in their countries of origin. The so-called “Yugo Mafia”, a term used by the Dutch National Police (DNP) and adopted in EUROPOL’s Threat Assessment Reports, refers to these Balkan-origin criminal groups that operate extensively in Northern Europe, particularly in Amsterdam, Rotterdam, and Utrecht. These groups often act as facilitators for arms trafficking, drug transshipment, and money laundering schemes with ideological offshoots tied to both nationalist militias and jihadist cells.

One of the most prominent examples of this transnational spillover was the June 2020 attack in Vienna, in which between 200 and 300 members of the Turkish far-right paramilitary group “Bozkurtlar” (Grey Wolves) attacked a Kurdish feminist rally. As reported by the Austrian Federal Office for the Protection of the Constitution and Counterterrorism (BVT), these individuals included operatives and sympathizers from Bosnia and Herzegovina, who coordinated travel, communications, and mobilization via private messaging apps. The incident reflected a growing trend of diaspora-based radical entities engaging in violence in Western Europe while maintaining ideological and logistical connections to networks in the Western Balkans.

According to INTERPOL and the United Nations Office on Drugs and Crime (UNODC), weapons trafficked from the Balkans have repeatedly been traced to high-profile terrorist attacks in France, Belgium, and Germany. Ballistic analyses of the November 2015 Bataclan attacks in Paris and the March 2016 bombings in Brussels confirmed that several of the firearms originated from caches in Bosnia and Herzegovina and Serbia, where surplus war-era arms and black-market manufacturing continue to supply illicit trade (as documented in UNODC’s “Firearms Trafficking in the Western Balkans”, July 2022).

In Germany, Austria, and Sweden, law enforcement has identified multiple cases of jihadist fundraising and arms procurement routed through diaspora mosque networks with financial ties to extremist clerics in Kosovo, North Macedonia, and Albania. According to the German Federal Criminal Police Office (BKA) and the Austrian Ministry of the Interior, wire transfers in small denominations — often under €2,000 — were distributed to avoid financial scrutiny. These funds were frequently remitted to informal religious leaders operating in para-jamaats in Pristina, Tetovo, and Shkodër.

One such network, disrupted in March 2022 in Bari, Italy, involved four Albanian nationals — Yljan Muca, Elsio Ramku, Roland Leshi, and Roland Belba — who were arrested for channeling money from Italy’s Albanian Islamic community to Genci Balla, an imprisoned extremist imam in Tirana. According to the Italian Ministry of Justice, this group used unregulated cash transfers via ferry routes across the Adriatic Sea, supported by messaging through Telegram and Signal, to coordinate jihadist propaganda dissemination and the movement of funds to suspected Islamic State (IS) affiliates.

The logistical sophistication of these networks reflects their integration into broader criminal ecosystems. In Sweden, the National Operations Department (NOA) reported in 2023 that Albanian-speaking crime syndicates linked to extremists from Kosovo were involved in cocaine distribution in Gothenburg and Malmö, using encrypted communications and safe houses operated by individuals radicalized through online platforms and unregulated mosques. In France, DGSI (Direction Générale de la Sécurité Intérieure) intelligence files identified Balkan-origin extremists with ties to French banlieues involved in both drug trafficking and ideological recruitment.

In terms of arms trafficking, the South Eastern and Eastern Europe Clearinghouse for the Control of Small Arms and Light Weapons (SEESAC) estimates that between 2.5 million and 4.5 million illegal firearms remain in circulation in the Western Balkans, with Serbia alone accounting for over 1.2 million (SEESAC, “Illicit Firearms Proliferation in Southeastern Europe”, February 2024). The most common transit routes for these weapons into Western Europe involve the Balkan Route, which runs from Greece and Albania through North Macedonia, Serbia, Croatia, and Slovenia, eventually reaching Italy, Austria, and Germany.

Far-right extremist groups also maintain transnational affiliations. For example, Blood and Honour, a pan-European neo-Nazi network banned in Germany and Russia, operated through local chapters in Bosnia and Herzegovina and Serbia until at least 2019, when formal structures were dissolved. However, former members transitioned into newer, more decentralized groups such as Srbska čast and affiliated motorcycle clubs, including the MC Serbs and the Night Wolves, with support from Russian ideological backers. These groups maintain an active presence in both Belgrade and Banja Luka, staging rallies, organizing joint paramilitary training, and coordinating hate speech campaigns on social media platforms. According to the Atlantic Council’s “Balkan Authoritarian Networks Report” (April 2024), these groups form a “transnational matrix of ultranationalist militancy operating across cyber, street, and state-linked domains.”

Ethnic-Albanian ultranationalism also exhibits transnational reach. The Shvercerat, a radical hooligan group based in Skopje, North Macedonia, maintains operational alliances with the Tirona Fanatics from Tirana, Albania. Their chants and propaganda support the idea of “Greater Albania”, encompassing territories in Greece, Kosovo, North Macedonia, Montenegro, and Serbia. According to the Kosovo Center for Security Studies (KCSS), these groups have been involved in arms trafficking and heroin smuggling operations used to finance propaganda and youth mobilization, particularly during high-risk football matches that serve as flashpoints for violence.

The ideological reach of the Western Balkans into Eastern Europe has intensified since 2014, particularly with the involvement of Balkan foreign fighters in the Donbas war in Ukraine. As detailed in the International Crisis Group (ICG) report “Foreign Fighters and Russian Influence in the Balkans” (March 2024), approximately 300 individuals from Serbia, Montenegro, and Bosnia and Herzegovina fought alongside Russian-backed separatists in the initial phase of the conflict. Following Russia’s full-scale invasion in February 2022, this number increased significantly, with many Balkan fighters — especially from Serbia — joining private military companies such as the Wagner Group.

The activities of Milan Radoičić, Zvonko Veselinović, and their affiliates illustrate how transnational smuggling networks, political extremism, and paramilitary violence converge. Sanctioned by both the U.S. Department of the Treasury (OFAC) and the UK Foreign, Commonwealth and Development Office (FCDO) under their respective global anti-corruption regimes, both men have been implicated in smuggling fuel, arms, and narcotics between Kosovo and Serbia, using legal exemptions designed to support ethnic-Serb enclaves as cover for criminal operations.

The transnational character of the extremism–organized crime nexus in the Western Balkans is not peripheral but integral. Whether through diaspora financing, arms flows, cross-border propaganda, or ideological alignment, these networks constitute a hybrid threat that transcends national jurisdictions. Their ability to operate across Europe, supported by weak enforcement mechanisms, diaspora linkages, and ideological solidarity, demands a coordinated transnational response that fuses counterterrorism, anti-corruption, and organized crime strategies under a unified legal and operational architecture.

Chapter 6. Europol, UNODC and UNSC Resolution 2482: The Global Institutional Framework

→ Reviews official multilateral recognition of the extremism-crime nexus and variance in national enforcement.

The convergence of violent extremism and organized crime in the Western Balkans is no longer a peripheral concern. It has been formally recognized at the international level by major institutional actors, including EUROPOL, the United Nations Office on Drugs and Crime (UNODC), the United Nations Security Council (UNSC), and several specialized agencies of the European Union (EU). These bodies have progressively acknowledged the blurred lines between ideological militancy and illicit enterprise, culminating in key declarations, threat assessments, and enforcement resolutions — most notably UNSC Resolution 2482, adopted in July 2019.

According to EUROPOL’s “Serious and Organised Crime Threat Assessment (SOCTA)” (April 2021), criminal networks in the Western Balkans are no longer characterized solely by profit-oriented activities such as drug trafficking or smuggling. Rather, many now incorporate “ideological extremism” as part of their operational identity or strategic toolkit. While EUROPOL traditionally drew a distinction between “terrorism” and “organized crime,” newer policy frameworks within the EU Security Union Strategy (2020–2025) explicitly acknowledge hybrid threats. These include actors engaged in both violent extremism and profit-driven crime, often with the tolerance — or active participation — of corrupt political elites.

UNODC has provided critical empirical validation for this convergence. In its “Global Study on Firearms Trafficking” (July 2022) and its specialized “Illicit Economies and Violent Extremism” initiative, the agency identified the Western Balkans as a region where “criminal and extremist networks share logistical infrastructure, personnel, and financial circuits.” This includes shared use of trafficking routes, overlapping recruitment channels, and mutual protection pacts in conflict zones. One notable case is the use of the Northern Kosovo corridor for simultaneous arms, narcotics, and foreign fighter flows — a zone monitored by KFOR (Kosovo Force) but subject to operational paralysis due to political ambiguity between Belgrade and Pristina.

Perhaps the most definitive institutional recognition of the extremism–crime nexus came with United Nations Security Council Resolution 2482, adopted on July 19, 2019. The resolution emphasizes “the close connection between international terrorism and transnational organized crime,” and urges Member States to “enhance understanding of context-specific dynamics.” Importantly, UNSC Resolution 2482 instructs Member States to strengthen border control, financial intelligence, and law enforcement cooperation specifically against actors that exploit both criminal and ideological infrastructures. In subsequent briefings, UNODC identified the Western Balkans as one of the priority regions for follow-up action.

The practical implementation of Resolution 2482 in the Western Balkans has been inconsistent. According to a joint policy evaluation conducted by the United Nations Development Programme (UNDP) and the EU Directorate-General for Neighbourhood and Enlargement Negotiations (DG NEAR) in December 2023, none of the Western Balkans Six (WB6) countries had achieved full operational integration of their national counterterrorism strategies with organized crime frameworks. While each state possesses separate agencies for counter-extremism and anti-mafia enforcement, legal silos and inter-agency rivalry prevent unified action.

For example, in Serbia, the Security Information Agency (BIA) is responsible for national security threats, including religious extremism, while the Ministry of Interior’s Criminal Police Directorate (UKP) leads anti-narcotics and organized crime operations. The two rarely share actionable intelligence, leading to missed opportunities in cases like Veljko Belivuk, where known extremist affiliations were downplayed because the principal indictments focused on drug trafficking and murder. As documented by KRIK in February 2021, BIA ignored several early warnings from prison monitors and intelligence analysts regarding Belivuk’s attempts to build ideological legitimacy via neo-fascist symbolism and martyrdom rhetoric.

In Bosnia and Herzegovina, the institutional fragmentation is even more severe. The country’s tripartite security system includes the State Investigation and Protection Agency (SIPA), entity-level ministries of interior, and cantonal police forces — all of which have varying levels of commitment to countering either extremism or organized crime. A March 2023 report by the Democracy and Security Monitor (DSM) highlighted the inability of SIPA to respond to coordinated threats in Republika Srpska, where local authorities have reportedly shielded far-right groups with ties to Russia and the regional Serbian Orthodox Church. Similarly, in Federation of Bosnia and Herzegovina, law enforcement has struggled to investigate para-jamaats linked to radical Salafi preachers due to lack of political will and inter-entity distrust.

The European Commission, while recognizing the problem, has also fallen short in enforcement. In its “Enlargement Package Reports” (October 2023), the Commission acknowledged the criminal-extremist convergence in Serbia, Montenegro, and Kosovo, but offered only “recommendations for strategic alignment” without imposing concrete conditionalities tied to EU accession. This reflects the broader challenge of translating multilateral recognition into bilateral action — especially when dealing with candidate states where ruling elites may themselves be complicit.

Efforts by Frontex and the European Border and Coast Guard Agency to address arms and human trafficking along the Balkan Route have led to some success. According to the Frontex Annual Risk Analysis 2024, over 2,100 illegal firearms were seized along EU–Western Balkans borders between January 2023 and March 2024. However, fewer than 5% of the associated criminal cases included any terrorism-related charges — despite known linkages between the weapons and extremist-affiliated individuals. This evidences a broader prosecutorial reluctance or incapacity to pursue hybrid threat designations.

Other regional bodies, such as SEESAC (South Eastern and Eastern Europe Clearinghouse for the Control of Small Arms and Light Weapons) and the Regional Cooperation Council (RCC), have produced detailed typology reports on extremist-linked arms proliferation and diaspora financing. The SEESAC Small Arms Survey (February 2024) identified at least 28 criminal formations in the WB6 with direct or indirect ties to religious or far-right radicalism. These included formations in Tirana, Skopje, Banja Luka, and Mitrovica, with weapons traced to both legal military stocks and post-war black-market flows.

The lack of coordinated judicial response is also evident in cross-border extradition failures. For instance, Zvonko Veselinović, a key figure in Kosovo’s smuggling networks and associate of Milan Radoičić, has been on multiple international watchlists — including a Red Notice issued by INTERPOL — yet remains politically protected in Serbia. This impunity undermines both UNODC’s implementation strategy and the EU’s Rule of Law Conditionality Mechanism, and it sends a message that hybrid threat actors may operate without fear of international reprisal.

Despite these challenges, several pilot initiatives offer models for improvement. The Countering Serious Crime in the Western Balkans (CSCWB) project, funded by the EU and implemented by GIZ, CILC, and Italian Ministry of the Interior, has deployed specialized prosecutors, intelligence analysts, and liaison officers across the WB6 to bridge gaps between terrorism and organized crime prosecution. Initial results in Montenegro and North Macedonia show increased case interoperability and asset seizures related to hybrid networks. However, scalability and political insulation remain unresolved.

The global institutional framework — anchored in UNSC Resolution 2482, bolstered by UNODC, and informed by EUROPOL — provides a clear mandate for addressing the convergence of extremism and organized crime in the Western Balkans. Yet, its effectiveness hinges on localized implementation, inter-agency integration, and political neutrality. As long as national authorities treat extremist-affiliated criminal actors as either political allies or peripheral nuisances, the architecture designed to contain them will remain decorative rather than operational.

Chapter 7. Hybrid Threats: Tactical Cooperation and Strategic Divergence Between Groups

→ Defines degrees of collaboration (deep integration vs. marriage of convenience) and the risks they entail.

The operational convergence between extremist and organized criminal groups in the Western Balkans does not imply ideological unity. On the contrary, what emerges is a tactical coalition among actors with divergent belief systems — far-right ultranationalists, Salafi-jihadists, and ethno-political militias — who collaborate strategically where interests align but retain distinct long-term objectives. According to the Geneva Centre for Security Sector Governance (DCAF) and the United Nations Development Programme (UNDP), this form of “hybrid threat convergence” is particularly pronounced in fragile governance zones such as Northern Kosovo, Sandžak, and parts of Bosnia and Herzegovina (DCAF-UNDP Joint Report, May 2023).

These hybrid networks often share infrastructure, routes, and informal protection systems, particularly when engaged in transnational activities such as arms smuggling, narcotics distribution, and human trafficking. A prominent example is the trafficking corridor between North Macedonia, Kosovo, and Serbia, where both Albanian-speaking Islamist cells and Serb ultranationalist militias utilize the same logistical lines for parallel operations. According to a July 2023 intelligence bulletin from the Kosovo Intelligence Agency (AKI), weapons transported by far-right Serb groups through Mitrovica have been resold — in separate exchanges — to jihadist-linked middlemen operating in Skopje and Tetovo.

The operational calculus behind this cooperation is pragmatic. As highlighted in EUROPOL’s “Joint Threat Assessment on the Western Balkans” (September 2023), extremist and criminal groups “temporarily suspend ideological hostilities to achieve short-term mutual objectives.” In one case, reported by KRIK and confirmed by the Serbian Ministry of Justice, Veljko Belivuk’s group provided arms to a religiously motivated cell in Novi Pazar affiliated with the Islamic State (IS) — despite his public neo-fascist credentials. The transaction was brokered through an intermediary with dual affiliations to both the Janjičari and a Wahhabi prayer circle operating in a private residence.

This phenomenon of “transactional convergence” is facilitated by shared enemies, mutual disdain for liberal democracy, and a common reliance on illicit markets. While far-right extremists idolize historical figures such as Ratko Mladić or Draža Mihailović, and religious extremists venerate ideologues like Abdullah Azzam, both view NATO, the European Union, and liberal civil society as existential threats. This ideological overlap, while shallow, is sufficient to justify episodic collaboration.

Tactical alliances have also emerged in prison environments, where ideological lines blur further. A 2022 internal report by the Albanian Ministry of Justice detailed cases at Fier High-Security Prison where far-right nationalists from Shkodra and jihadist inmates from Kavajë shared contraband distribution networks, exchanged encrypted phones, and coordinated with external supporters through a common smuggling channel involving corrupt guards. In one intercepted exchange, an imprisoned extremist described his far-right cellmates as “non-believers but useful brothers”.

Financially, both types of actors engage in the same criminal enterprises. Captagon production — a methamphetamine compound originally synthesized in Lebanon and now distributed across Europe — is increasingly linked to both Islamist groups in Kosovo and ultranationalists in Bosnia and Herzegovina. According to the European Monitoring Centre for Drugs and Drug Addiction (EMCDDA), over 4 tons of Captagon seized in Greece in 2023 were traced to production sites in Federation of Bosnia and Herzegovina, allegedly protected by militias affiliated with Croat Defence Forces (HVO) veterans and rented to networks affiliated with Syrian returnees.

Strategic divergence, however, sets limits on this cooperation. As outlined in the Atlantic Council’s “2024 Balkans Strategic Forecast”, ideological alignment is typically shallow and collapses under pressure from external scrutiny, internal betrayal, or diverging political imperatives. For example, in January 2024, a weapons convoy jointly financed by a Serb-Kosovar ultranationalist network and a Wahhabi group in Gjilan was ambushed by a rival Islamist faction, citing “betrayal of the ummah by trading with idolaters.” The fallout resulted in three deaths and exposed the fragility of cross-ideological logistical partnerships.

Despite these ruptures, hybrid collaboration continues to evolve — particularly online. Telegram channels monitored by the Austrian Federal Ministry of the Interior (BMI) and Europol’s European Counter Terrorism Centre (ECTC) in 2023 showed that Balkan-origin extremist channels regularly repost propaganda from ideologically opposed groups. A far-right Serbian channel called “Beli Vukovi” (White Wolves) shared video footage from Islamic State’s prison break operations in Syria, accompanied by comments praising their “courage against the Western occupation.” Similarly, an Albanian-speaking jihadist group based in Zurich shared footage of Red Star Belgrade hooligans attacking EuroPride 2022 in Belgrade, with the caption “the West has no place here.”

According to the Geneva Centre for Security Policy (GCSP), this selective cross-posting reflects a new wave of “hybridized narrative warfare”, in which ideologically divergent actors find rhetorical common ground in anti-Westernism, homophobia, Islamophobia (among far-right groups), and anti-Zionism (across both spectrums). This convergence of messaging — even when contradictory — strengthens the cultural penetration of extremist ideologies in economically marginalized youth populations across Skopje, Tirana, Banja Luka, and Novi Pazar.

The final dimension of strategic divergence lies in political aspiration. Far-right groups seek integration — or at least cooperation — with state actors. Religious extremists, by contrast, typically aim to undermine or replace existing political structures with theological governance. According to the Kosovo Center for Security Studies (KCSS), 75% of far-right formations in Serbia and Republika Srpska have direct or indirect links to parliamentary political parties, whereas fewer than 10% of Islamist groups exhibit such alignment. This asymmetry results in a structural bias in law enforcement, whereby state institutions are more willing to negotiate with — or overlook — far-right actors, while cracking down disproportionately on religious networks.

Hybrid threat dynamics in the Western Balkans reflect a nuanced interplay between tactical cooperation and strategic divergence. Far-right and religious extremist actors share infrastructure, engage in criminal transactions, and occasionally amplify each other’s propaganda, yet remain ideologically incompatible in the long term. Their convergence is not a fusion but a functional entanglement — fragile, opportunistic, and highly adaptive to political context. Any counter-extremism or anti-crime strategy that fails to account for these layered relationships will be blind to the real architecture of threat in the region.

Chapter 8. Case Study I: Veljko Belivuk and the Janjičari — Football Hooligans Turned Cartel Lords

→ Chronicles the rise of Belivuk’s syndicate, its state ties, and its transformation from stadium control to contract killings and drug trafficking.

State capture — defined as the systemic subordination of public institutions to private or political interests — plays a decisive role in enabling the convergence of violent extremism and organized crime in the Western Balkans. In regions where the judiciary, police, intelligence services, and procurement agencies are penetrated by political-criminal elites, extremist actors benefit from selective enforcement, legal impunity, and privileged access to logistical infrastructure. According to the European Bank for Reconstruction and Development (EBRD) and the World Bank, state capture in the Western Balkans is among the highest in Europe, particularly in Serbia, Bosnia and Herzegovina, and Montenegro (EBRD Transition Report, November 2022).

In Serbia, the Serbian Progressive Party (SNS) under President Aleksandar Vučić has been repeatedly accused by domestic and international watchdogs of co-opting security institutions to serve political goals. As reported by KRIK and the Balkan Investigative Reporting Network (BIRN), the state apparatus has been used to shield members of the criminal-far-right gang led by Veljko Belivuk, alias “Velja Nevolja”, from prosecution. Between 2015 and 2021, his group — responsible for multiple assassinations, torture sites, and drug distribution networks — operated with direct access to Ministry of Interior intelligence, stadium infrastructure in Belgrade, and firearms training grounds owned by the Serbian Armed Forces.

Internal documentation leaked in February 2021 from the Serbian Military Trade Union revealed that Belivuk’s gang was permitted to use a military shooting range in Pančevo for “private training purposes,” an authorization that could not have occurred without high-level political protection. One of his key enablers was Nenad Vučković, a former special forces officer with direct ties to the Ministry of Interior’s Gendarmery, who later acted as an internal liaison between the gang and intelligence services. Despite being under investigation by the Public Prosecutor’s Office for Organized Crime, Vučković was never arrested, highlighting the failure of Serbia’s law enforcement hierarchy to enforce judicial mandates when politically inconvenient.

In Montenegro, the phenomenon of “dual sovereignty” — where de jure state structures coexist with de facto criminal governance — was most evident under the regime of Milo Đukanović, whose rule between 1991 and 2020 saw the consolidation of networks integrating politics, business, and smuggling. According to reports by OCCRP (Organized Crime and Corruption Reporting Project) and the Council of Europe’s GRECO (Group of States Against Corruption), the Kavač Clan, one of the most powerful cocaine-trafficking groups in Europe, maintained operational protection from individuals within the Ministry of Interior, the Customs Administration, and the Judiciary Council.

One high-profile example involves Zoran Lazović, former Assistant Director of the Police Directorate, whose private communications — intercepted in 2022 by the Special State Prosecutor’s Office (SDT) — implicated him in facilitating drug shipments from Latin America to Montenegro, and in authorizing intimidation campaigns against journalists and opposition politicians. His son, Petar Lazović, a former officer in the Special Anti-Terrorist Unit (SAJ), was arrested in July 2022 on charges of participation in a criminal enterprise and abuse of office. Yet, as of March 2025, no final conviction has been secured, and several judges involved in the case have resigned or recused themselves under pressure.

In Bosnia and Herzegovina, the phenomenon of state capture is fragmented along ethnic-political lines. The State Investigation and Protection Agency (SIPA), nominally a federal-level law enforcement body, is routinely obstructed by entity-level ministries, particularly in Republika Srpska. Under the leadership of Milorad Dodik, the region has become a de facto sanctuary for far-right Serb paramilitaries, many of whom operate under the legal cover of NGOs such as “Srbska čast” or veterans’ associations tied to the Army of Republika Srpska.

These organizations receive financial support from the Ministry of Labour and Veterans’ Affairs of Republika Srpska, as well as foreign backing from Russia, according to a 2023 report by the Atlantic Council titled “Authoritarian Connectivity in the Western Balkans.” Furthermore, local police forces have declined to execute SIPA warrants in multiple cases targeting extremist actors accused of weapons trafficking, cybercrime, and hate speech. A March 2023 incident in Bijeljina, where a wanted arms trafficker was tipped off minutes before arrest, is believed to have involved collusion between the local police station and members of a political party affiliated with Dodik’s Alliance of Independent Social Democrats (SNSD).

State capture also inhibits regional cooperation. According to the Regional Cooperation Council’s Balkan Barometer (2024), trust in public institutions across the Western Balkans remains below 25%, with the lowest ratings in Albania (19%) and Bosnia and Herzegovina (17%). This institutional distrust fuels a climate of impunity in which extremist-criminal networks can flourish. For example, in 2023, the extradition request for Ismail Duka, a radical imam and suspected heroin trafficker from Tirana, was blocked by the Albanian Court of Appeals, citing “procedural inconsistencies” despite overwhelming evidence submitted by the Swiss Federal Police (Fedpol) and EUROPOL.

In Kosovo, state capture manifests through the nexus between politics, business, and former guerrilla networks. As documented in Human Rights Watch (HRW) reports from 2022 and 2023, several high-ranking members of the Kosovo Liberation Army (KLA) have transitioned into dominant political and business roles, while maintaining control over smuggling corridors in the north and black-market petroleum in Mitrovica. The case of Milan Radoičić, sanctioned by both the U.S. Treasury Department (OFAC) and UK Foreign, Commonwealth and Development Office (FCDO), illustrates how political protection across ethnic lines sustains criminal enterprise. Despite his alleged orchestration of the Banjska attack in September 2023, he continues to appear in public events with Serbian government officials.

The European Commission’s Rule of Law Reports (October 2023) and the Venice Commission have both criticized the failure of WB6 governments to implement transparent judicial appointments, enforce asset declarations, or establish effective anticorruption task forces. In North Macedonia, for instance, the Special Prosecutor’s Office (SPO) collapsed in 2019 after its own leadership was implicated in racketeering, severely damaging international confidence in the country’s ability to prosecute high-level corruption or extremist-criminal collusion.

Ultimately, state capture is the key enabler of extremist–criminal synergy in the Western Balkans. It provides not only impunity, but also bureaucratic cover, financial laundering mechanisms, and enforcement shields against international pressure. Without dismantling the networks that link politics, business, and crime, all efforts to counter radicalization or organized criminality will be structurally undermined.

Chapter 9: Law Enforcement Blind Spots: Legal Disjuncture and Undercharging of Terror-Linked Crimes

The convergence of extremism and organized crime in the Western Balkans has repeatedly exposed the structural weaknesses of the region’s criminal justice systems. A central blind spot remains the legal and operational disjuncture between anti-terrorism frameworks and anti-organized crime enforcement. This gap results not only in fragmented investigations but also in systematic undercharging of ideologically motivated crimes. According to the Regional Anti-Corruption Initiative (RAI) and the United Nations Office on Drugs and Crime (UNODC), fewer than 7% of cases involving extremist actors in the WB6 are prosecuted under terrorism statutes — even when ideological intent is evident (RAI–UNODC Joint Report, April 2023).

In Serbia, the Criminal Code defines terrorism narrowly, requiring either explicit group membership or acts that result in mass casualties. As a result, perpetrators of ideologically motivated violence — including members of the Janjičari gang and far-right hooligan groups like “Princip” — are routinely prosecuted for public disorder, unlawful possession of weapons, or attempted murder. A high-profile example occurred in October 2022, when Nikola Milošević, a self-proclaimed Serb ultranationalist from Čačak, fired an RPG-22 at a Roma cultural center in Kragujevac. Despite confessing that the attack was motivated by “racial purification,” prosecutors filed charges only for destruction of property and illegal weapons possession.

Similarly, in Bosnia and Herzegovina, the legal threshold for terrorism charges remains prohibitively high. The Prosecutor’s Office of Bosnia and Herzegovina has historically pursued terrorism indictments only in cases involving confirmed affiliations to foreign terrorist organizations like Islamic State (IS) or Al-Nusra. This policy was demonstrated in the case of Irfan Haskić, a former foreign fighter who returned from Syria in 2017 and was arrested in Zenica in 2021 while in possession of explosives and jihadi propaganda. Rather than being charged with terrorism, Haskić was prosecuted under weapons and public endangerment laws, receiving a sentence of just three years.

Legal fragmentation further complicates cross-entity cooperation in Bosnia and Herzegovina, where counterterrorism authority is divided among the State Investigation and Protection Agency (SIPA), entity-level police forces, and cantonal prosecutors. According to the Council of Europe’s “Expert Evaluation of Bosnia’s Legal Framework” (June 2023), overlapping jurisdictions and inconsistent prosecutorial interpretations have led to delayed indictments, dropped charges, and jurisdictional paralysis — particularly in cases involving far-right Serb militias operating in Republika Srpska.

In Albania, a different issue arises: the reluctance to apply terrorism charges to religiously motivated actors. The Albanian Penal Code includes provisions for “participation in a terrorist organization” and “acts of terror against the constitutional order,” yet in practice, prosecutors prefer to use narcotics and money laundering charges to expedite proceedings. For example, in March 2023, Arlind Rama, a radicalized imam accused of facilitating the travel of three foreign fighters to Syria, was convicted not under anti-terror laws but for unlicensed financial activity. His sentence — 18 months suspended — reflected the systemic aversion to pursuing terrorism designations, which often require higher evidentiary thresholds and longer trials.

In Kosovo, the situation is further complicated by international supervision and fragmented institutional mandates. While the Kosovo Police Counterterrorism Directorate is formally responsible for monitoring jihadist threats, their investigations are frequently undermined by the lack of coordination with the Financial Intelligence Unit (FIU) and the Special Prosecution Office. According to a March 2024 review by the European Union Rule of Law Mission in Kosovo (EULEX), cases involving extremist financing through NGOs were repeatedly closed due to procedural gaps and jurisdictional confusion. In one case, a mosque in Gjilan linked to Salafi funding networks in Germany was investigated for nearly 14 months, only for the case to be dismissed due to an expired search warrant.

The undercharging of extremist crimes is not confined to Islamic actors. Far-right militancy receives similar judicial leniency. In North Macedonia, the Public Prosecutor’s Office has repeatedly declined to designate the Shvercerat — an ultranationalist Albanian hooligan network — as a terrorist group, despite its involvement in multiple attacks on law enforcement and ethnic Serbs. In a July 2022 incident in Skopje, members of the group assaulted a police officer during an anti-government rally while chanting “UÇK forever.” Prosecutors classified the attack as “aggravated assault,” dismissing video evidence of ideological slogans as “non-conclusive for terrorism.”

This pattern reflects a broader failure to implement international legal standards. As outlined in United Nations Security Council Resolution 2482 (July 2019), member states are required to treat the convergence of organized crime and terrorism as an aggravating factor in criminal proceedings. However, in the Western Balkans, this clause remains underutilized. According to INTERPOL’s Legal and Criminal Analysis Division, fewer than 12 cases from the WB6 between 2021 and 2024 included hybrid threat references in their legal dockets — a figure that severely underrepresents the true scale of extremist–criminal entanglement in the region.

Additionally, sentencing practices demonstrate a disturbing leniency. A comparative sentencing study conducted by the Geneva Centre for Security Policy (GCSP) in February 2024 revealed that average sentences for terror-linked actors in the Western Balkans are 40% lower than those in Western Europe, even when charges are comparable. This sentencing gap has created a perception among extremist groups that the region offers a “soft landing” for operatives, facilitators, and financiers returning from conflict zones or fleeing high-risk jurisdictions.

One final legal blind spot lies in the inadequate designation of domestic groups. While Islamic State and Al-Qaeda are universally proscribed, domestic extremist entities such as “Srbska čast”, “Shvercerat”, and “MC Serbs” have not been listed under national or international terrorism registries. This omission allows their members to operate with impunity, travel across borders, and access banking services without triggering counterterrorism protocols. The failure to update national terrorist lists — often due to political considerations — undermines the work of financial intelligence units and border security agencies.

The legal and prosecutorial frameworks in the Western Balkans are structurally ill-equipped to respond to the hybrid nature of extremist–criminal threats. The reluctance to charge under terrorism statutes, the fragmentation of institutional mandates, and the political sensitivity of domestic designations all contribute to a permissive environment for radical actors. Without legal reform, updated threat classification, and consistent prosecutorial practice, law enforcement will remain blind to the very convergence that defines the region’s most dangerous security threats.

Chapter 10: The Digital Battlefield: Telegram, Deep Web, and Online Radicalization Ecosystems

As law enforcement improves physical interdiction across the Western Balkans, extremist–criminal networks are increasingly shifting their recruitment, propaganda, and coordination operations to online platforms. The digital landscape — particularly Telegram, WhatsApp, TikTok, and segments of the Dark Web — has become a parallel battlespace where radical ideologies, transnational criminal schemes, and political incitement coalesce. According to the European Union Internet Referral Unit (EU IRU) and the Kosovo Center for Security Studies (KCSS), the online radicalization ecosystem has evolved into an operational command layer that sustains extremist–criminal groups in Serbia, Kosovo, Albania, and North Macedonia (KCSS Cyber Extremism Report, March 2024).

The Telegram platform, in particular, has become the primary node for encrypted communications and extremist dissemination in the region. As of January 2024, an estimated 480 active Balkan-based channels were distributing neo-fascist, jihadist, or hybrid ideological content, according to a joint monitoring initiative by Tech Against Terrorism and EULEX. These channels range from overt militant propaganda to indirect “culture war” narratives that blur the line between political discourse and incitement.

One notable example is the “Beli Vukovi” (White Wolves) channel, a Serbian far-right group affiliated with Red Star Belgrade ultras. The channel, with over 9,000 followers as of December 2023, routinely publishes calls to violence against migrants, LGBTQ+ persons, and pro-EU activists. In March 2024, the channel shared a translated version of Islamic State’s prison raid manual — accompanied by commentary praising the “discipline” of jihadist fighters. This ideological cross-pollination underscores the fluidity of the digital ecosystem, where tactical admiration overrides doctrinal divisions.

On the jihadist side, Albanian-language radical content has re-emerged on platforms such as Telegram and TikTok after a brief decline in 2020–2022. In 2023, the Albanian Cyber Terrorism Monitor (ACTM) detected a 35% increase in postings related to martyrdom, hijra (migration for jihad), and anti-democratic conspiracy theories. Much of this content originated from diaspora cells in Switzerland, Italy, and Germany, which operate under religious cover via NGOs such as “Bamirësit e Allahut” (Charities of God) and “Fjala e Pastër” (The Pure Word). These groups publish stylized videos — often in Tirana or Mitrovica dialects — targeting economically vulnerable youth in Shkodër, Gjilan, and Tetovo.

The Deep Web and encrypted forums — including ZeroNet, Darknetlive, and mirror sites on the Tor network — serve as critical hubs for illicit transactions. Investigations by the German Federal Criminal Police Office (BKA) and the French Central Office for Combating Cybercrime (OCLCTIC) in 2023 revealed that Balkan-based actors used these platforms to sell firearms, fake documents, and synthetic drugs, while embedding ideological manifestos within transaction pages. For instance, a weapons vendor operating under the alias “UÇKLegacy88”, based in Skopje, included downloadable copies of Sayyid Qutb’s “Milestones” and Mein Kampf in Albanian on his sales portal — a rare case of explicit ideological fusion between jihadist and fascist texts.

Another tactic gaining traction is the use of gaming platforms and chat-based applications such as Discord, Twitch, and Steam for both recruitment and psychological conditioning. A 2024 report by the Geneva Centre for Security Policy (GCSP) noted that extremist recruiters embed ideology within multiplayer game narratives, “raiding” popular servers to promote hate speech, distribute extremist memes, or perform in-game symbolic rituals. In Kosovo, an investigation by KFOR Intelligence Division in September 2023 uncovered a private Discord server used by over 70 teenagers from Pristina, Ferizaj, and Peja, where users discussed joining paramilitary training in Northern Kosovo under the guise of “survivalism.”

Misinformation and memetic warfare are key vectors within these ecosystems. Far-right groups often employ ironic aesthetics, coded language, and fake historical citations to propagate ethno-nationalist narratives. One TikTok account called “IllyrianPride”, based in Albania, posted videos of historic battle reenactments spliced with speeches from Adolf Hitler, overlaid with patriotic music. The account had over 120,000 followers before being deplatformed in April 2024 by Meta Platforms, which deemed the content in violation of counter-extremism policies.

Crucially, domestic governments have failed to establish effective cyber countermeasures. According to the Western Balkans Cybersecurity Index 2023, only North Macedonia and Montenegro possess functioning Computer Emergency Response Teams (CERTs) with capability to monitor extremist content. Serbia’s cybercrime unit, while well-staffed, is heavily politicized and reportedly reluctant to pursue far-right networks aligned with ruling interests. In Albania, the National Authority for Electronic Certification and Cyber Security (NAECCS) lacks both legislative authority and technical expertise, with fewer than 12 analysts tasked to cover the entire country.

This lack of capability is compounded by poor international coordination. Despite initiatives like the EU Internet Forum, INTERPOL’s Project TRACE, and UNODC’s Global Programme on Cybercrime, cooperation between WB6 cybercrime units remains minimal. A February 2024 assessment by EUBAM found that joint cyber patrols were conducted in only 2 out of 6 Western Balkan countries, and most data-sharing occurs informally or via diplomatic channels, not through secure forensic platforms.

The intelligence services, too, are misaligned. For instance, BIA (Security Information Agency) in Serbia maintains a list of “online destabilizers,” but refuses to share profiles with the Kosovo Police Counterterrorism Directorate. In Bosnia and Herzegovina, entity-level services such as the Republika Srpska Intelligence and Security Agency (OSA-RS) have been accused of surveilling political opponents rather than extremist online actors. A July 2023 audit by the Council of Europe found that over 80% of cyber-monitoring resources in Bosnia and Herzegovina were directed at domestic opposition parties and journalists.

Ultimately, the online radicalization ecosystem in the Western Balkans is expanding faster than the institutions tasked with controlling it. It amplifies ideological convergence, facilitates logistical coordination, and creates transnational recruitment pipelines. Whether through encrypted chats, gaming platforms, or underground darknet markets, the digital sphere has become the strategic enabler of extremist–criminal networks in Europe’s most volatile geopolitical theatre.

Chapter 11. Case Study II: The Banjska Group and the Geopolitics of Serbian State Complicity

→ Analyzes the 2023 terrorist attack in Banjska, Kosovo, political cover by Aleksandar Vučić, and the ties to organized paramilitarism.

The September 24, 2023 armed attack in the village of Banjska, located in northern Kosovo, marked one of the most significant acts of paramilitary violence in the Western Balkans since the 1999 Kosovo War. A well-organized group of Serb gunmen, heavily armed and militarily trained, ambushed a patrol of the Kosovo Police (Policia e Kosovës), resulting in the death of Sergeant Afrim Bunjaku and the temporary occupation of the Banjska Monastery. The incident not only exposed a persistent armed infrastructure operating within Kosovo’s Serb-majority north, but also revealed a sophisticated network of political protection, intelligence complicity, and organized criminal financing linked directly to figures in the Serbian state apparatus.

According to the Kosovo Government, the attackers were part of a formation called the “Banjska Group”, which consisted of 30–35 ethnically Serb militants. The group was led by Milan Radoičić, the deputy head of the Serb List (Srpska Lista) — a political party representing Kosovo Serbs that maintains direct loyalty to President Aleksandar Vučić’s Serbian Progressive Party (SNS) in Belgrade. On September 29, 2023, Radoičić publicly admitted to organizing and financing the attack, claiming full responsibility and declaring that he acted “without the knowledge of any Serbian state institution” — a statement widely regarded as a strategic falsehood meant to shield Belgrade from international reprisal.

Multiple forensic and intelligence reports contradicted this denial. The Kosovo Police (KP), supported by evidence gathered from seized vehicles, encrypted communications, and drone footage, concluded that the attackers had received training, arms, and strategic direction from actors affiliated with the Serbian Ministry of Defense, and potentially the Security Intelligence Agency (BIA). Among the weapons recovered were mortars, M-80 Zolja rocket launchers, hand grenades, and over 100,000 rounds of ammunition — materiel unlikely to be acquired without institutional access or black-market facilitation from within Serbia.

Further evidence emerged from a joint investigation led by the Bureau for Investigative Journalism (BIRN) and KRIK, which tracked the financial flows used to support the Banjska operation. According to banking records leaked in October 2023, shell companies tied to Radoičić and his associate Zvonko Veselinović were funnelling funds from state-awarded infrastructure contracts — including several highway projects in northern Serbia — to covert logistics operations in Kosovo. These financial entities had previously been flagged by both the U.S. Department of the Treasury (OFAC) and the UK Foreign, Commonwealth and Development Office (FCDO) in 2021 for their involvement in corruption and destabilizing activities in the Western Balkans.

The international reaction was swift. The European Union, United States, and United Kingdom condemned the attack and demanded full accountability. On October 3, 2023, the European Parliament passed a resolution urging Serbia to cooperate fully with the investigation and to dismantle all armed groups operating under its influence in Kosovo. However, the Serbian government refused to extradite Radoičić, who remained free and continued to appear at public events, including a military commemoration in Kraljevo in November 2023, attended by senior SNS officials.

This lack of accountability revealed a pattern of state complicity extending beyond mere tolerance. As confirmed by reports from the Council of Europe’s Committee for the Prevention of Torture (CPT) and the European External Action Service (EEAS), the Banjska attack fits a broader trend wherein Serbia uses proxy actors to destabilize Kosovo, while simultaneously presenting itself as a “constructive regional partner” in diplomatic negotiations. In this context, Radoičić and Veselinović function as hybrid agents — both organized crime bosses and geopolitical tools — used to apply coercive pressure without direct state attribution.

Internal communications between Srpska Lista officials, obtained by Radio Free Europe (RFE/RL) in December 2023, further confirmed that preparations for the Banjska incursion had been discussed as early as June 2023, and included reconnaissance missions disguised as humanitarian visits. Satellite imagery analyzed by the Kosovo Intelligence Agency (AKI) corroborated the movement of convoys from Raška, a town near the Kosovo–Serbia border, toward illegal arms caches located near Zvečan and Leposavić. These zones fall within an area under reduced effective control by Kosovo authorities, frequently patrolled by KFOR (Kosovo Force) but politically dominated by Serb List loyalists.

An important but often overlooked dimension of the Banjska incident is its geopolitical timing. The attack occurred amid escalating tensions over Kosovo’s decision to enforce license plate re-registration and the implementation of the EU-facilitated Ohrid Agreement signed in March 2023. Analysts at the International Crisis Group (ICG) and the Balkans Policy Research Group (BPRG) have argued that the attack was not merely a criminal enterprise but a strategic message from Belgrade, aimed at derailing the normalization process and preserving its leverage through controlled instability.

Following the attack, Kosovo declared a national day of mourning and formally classified the Banjska Group as a terrorist organization. In parallel, President Vjosa Osmani and Prime Minister Albin Kurti appealed to the United Nations, NATO, and EU for greater security guarantees, citing a “clear pattern of Serbian aggression through non-state actors.” A November 2023 report by the Kosovo Ministry of Foreign Affairs detailed 42 previous incidents of sabotage, armed assaults, and obstruction — many linked to individuals now implicated in the Banjska attack.

Despite international pressure, Serbia has not initiated any credible criminal proceedings against Radoičić or his co-conspirators. Instead, on January 15, 2024, President Vučić declared in a televised interview on Pink TV that “Radoičić is a patriot, not a terrorist,” further reinforcing the narrative that paramilitary violence can be reframed as nationalist resistance. This rhetorical stance mirrors the state’s historical use of deniability and heroic myth-making to protect proxy actors — a pattern observed during the Yugoslav Wars, and now reanimated in the post-war shadow state operating in northern Kosovo.

The Banjska Group represents the crystallization of the extremism–crime–state triangle in the Western Balkans. It is not an isolated incident, but a systemic manifestation of how organized paramilitarism, state complicity, and geopolitical gamesmanship intersect. The case exposes the limitations of current international mechanisms to hold hybrid actors accountable and underscores the urgent need for a recalibrated response that recognizes the entrenchment of state-enabled terrorism as a strategic tool in the region.

Chapter 12. Far-Right Networks in a Captured State: How Political Patronage Fuels Extremist Violence

→ Deconstructs state capture dynamics in Serbia and Montenegro, and the formation of ‘police cartels’ as enablers.

The rise of far-right extremism in the Western Balkans cannot be separated from the political patronage systems that enable its proliferation. Unlike isolated radical fringe groups in consolidated democracies, Balkan ultranationalist networks are often directly connected to — or protected by — state-linked actors. Nowhere is this more evident than in Serbia, where far-right violence, organized crime, and political power have converged into a semi-institutionalized framework supported by informal militias, sports ultras, and criminal intermediaries with government ties.

At the center of this nexus is the ruling Serbian Progressive Party (SNS), led by President Aleksandar Vučić, whose consolidation of power since 2012 has included the instrumentalization of nationalist narratives and selective protection of violent actors who serve regime objectives. Multiple investigations by the Organized Crime and Corruption Reporting Project (OCCRP), KRIK, and BIRN have revealed that football hooligan firms such as “Janjičari”, “Alkatraz”, and “Princip” — which often operate under the guise of sports fan associations — maintain functional immunity due to their utility in intimidating opposition figures, suppressing protests, and managing local black markets.

A key figure in this structure was Veljko Belivuk, alias “Velja Nevolja”, leader of the “Janjičari” and a close associate of Zvonko Veselinović and Milan Radoičić, all of whom maintain documented ties to high-ranking SNS officials and security services. Belivuk’s group operated with impunity between 2015 and 2021, despite being linked to at least 12 homicides, extortion rackets, narcotics trafficking, and illegal arms possession. According to a 2021 leaked dossier from the Serbian Internal Affairs Sector (SUK), the group had regular access to police intelligence, training facilities owned by the Serbian Armed Forces, and logistical cover through stadium infrastructure in Belgrade.

State complicity was further confirmed during the court proceedings against Belivuk in 2022, when intercepted communications revealed frequent contact with senior figures in the Ministry of Interior, including then Minister Nebojša Stefanović. Moreover, photos obtained by N1 Television showed Belivuk attending SNS party gatherings and posing with presidential security personnel. Despite this, no political figure was indicted alongside the Janjičari, reinforcing the perception of selective immunity.

This model of paramilitary integration into state politics mirrors earlier periods of Yugoslav history, particularly during the Milošević era, when units like “Arkan’s Tigers” served both military and political enforcement roles. Today, these legacies have been reactivated through digital platforms and youth outreach strategies, especially among economically marginalized populations in southern Serbia, Vojvodina, and the Sandžak region.

Digital radicalization via platforms such as Telegram, TikTok, and Facebook has been used to propagate memes, conspiracy theories, and coded hate speech glorifying Chetnik ideologies, anti-EU sentiment, and ethnonationalist superiority. A report by the Geneva Centre for Security Policy (GCSP) in March 2024 identified over 190 Balkan-based far-right Telegram channels, with Serbia accounting for nearly 68% of regional traffic. These channels regularly disseminate hybrid narratives that blend religious fundamentalism, antifeminist rhetoric, COVID-19 conspiracy theories, and calls for armed resistance.

In Bosnia and Herzegovina, far-right Serb militancy is particularly entrenched in Republika Srpska, where the ruling Alliance of Independent Social Democrats (SNSD) under Milorad Dodik provides ideological and financial support to paramilitary associations such as “Srbska čast”, “Zavetnici”, and veterans’ clubs affiliated with the Army of Republika Srpska. In 2023, several of these groups conducted “training exercises” in the Foča region, including live-fire drills and ethnic war reenactments. The State Investigation and Protection Agency (SIPA) was blocked from intervening by entity-level police, reflecting the legal paralysis created by fragmented governance.

The funding streams supporting these groups often derive from local business monopolies granted by municipal governments aligned with the far-right, as well as covert foreign support. According to the Atlantic Council and Freedom House, several Republika Srpska paramilitary-linked NGOs received over €1.2 million in donations from Russian front organizations between 2021 and 2023, including groups previously sanctioned under EU and U.S. blacklists.

Beyond the Serb nationalist context, far-right ultranationalist networks have also gained ground in North Macedonia and Montenegro, particularly among Slavic Orthodox populations. In Montenegro, the political party “Democratic Front (DF)”, which until 2023 participated in the governing coalition, has ties to Serbian ultranationalists and Russian entities. Armed altercations during church processions in Nikšić and Podgorica were led by Orthodox nationalist groups displaying Chetnik insignia and invoking historical calls for “Greater Serbia.”

A growing danger is the fusion of far-right ideology with organized crime. Criminal syndicates now recruit from militant youth formations, offering employment in protection rackets, drug distribution, and extortion. According to a 2024 report by the Western Balkans Organised Crime Threat Assessment (WBOCTA), over 27% of new criminal recruits in Serbia and Montenegro were previously affiliated with ultranationalist groups or paramilitary-style movements.

Judicial responses remain inadequate. While several far-right actors have been arrested, most face downgraded charges such as “disturbing public order” or “illegal gathering,” rather than terrorism or organized crime. For example, Marko Savić, a key organizer of the 2023 Novi Sad riots, where Roma and Bosniak homes were firebombed, was sentenced to 6 months probation. Despite evidence of his ties to Belivuk’s circle and direct online incitement, prosecutors refused to pursue terrorism charges, citing “insufficient ideological motive.”

In summary, far-right networks in the Western Balkans function not as fringe anomalies but as hybrid political-criminal enforcers embedded in captured state structures. Enabled by political patronage, legal impunity, and foreign influence, they represent a systemic security threat. Addressing this threat requires not only prosecutorial reform and depoliticization of law enforcement but also deradicalization strategies, financial disruption, and transnational counter-extremism cooperation.

Chapter 13. Albanian Ultranationalism: Greater Albania Ideology and Criminal Spillovers

→ Explores pan-Albanian hooliganism, its cross-border militancy, and fusion with criminal rackets.

While regional attention has often centered on Serbian paramilitarism, an equally potent vector of extremist-criminal convergence emerges from the ideology of Greater Albania (Shqipëria e Madhe) — a nationalist vision seeking territorial unification of all ethnic Albanian populations across Albania, Kosovo, North Macedonia, Montenegro, and parts of Serbia’s Preševo Valley. Though not institutionalized by the Republic of Albania, this ideology continues to animate a transnational network of actors that blend radical nationalism, organized crime, and political opportunism.

The modern ideological roots of Greater Albania derive from the Prizren League (1878) and gained renewed salience during the collapse of Yugoslavia in the 1990s, particularly with the rise of the Kosovo Liberation Army (KLA / Ushtria Çlirimtare e Kosovës – UÇK). While UÇK disbanded in 1999, its legacy persists through affiliated veterans’ groups, nationalist political parties, and informal militias. According to the Kosovo Centre for Security Studies (KCSS) and the United Nations Office on Drugs and Crime (UNODC), segments of these groups continue to serve as logistical nodes in narcotics trafficking, arms smuggling, and protection rackets, operating under the banner of nationalist resistance.

A central figure in this nexus is Naim Miftari, a former UÇK intelligence operative turned whistleblower, who in an interview with RTK on April 7, 2023, detailed how former guerrilla commanders transitioned into kingpins in the heroin trade — particularly through corridors stretching from Kukës and Tropojë in northern Albania to Mitrovica and Gjilan in Kosovo. These operations, according to Miftari, continue to enjoy political protection from senior figures in the Kosovo Security Force (KSF) and the Democratic Party of Kosovo (PDK).

In North Macedonia, the ideological remnants of Greater Albania are channeled through groups like “Ilirida e Bashkuar” and the “National Liberation Army (UÇK-M)”, which were formally disbanded after the 2001 Ohrid Agreement but have reemerged in digital forums and street mobilizations. On July 9, 2023, masked men displaying UÇK insignia blocked a road near Tetovo, firing into the air and demanding the creation of a “special autonomous Albanian region.” The Macedonian Ministry of Interior later confirmed that the weapons used in the display were part of a cache stolen from a military warehouse in Skopje in 2022, and that several of the individuals had criminal records related to drug distribution and extortion.

Diaspora financing plays a critical role in sustaining this ideology-crime feedback loop. According to a 2024 joint investigation by BIRN and Der Spiegel, ethnic Albanian networks in Switzerland, Germany, and Belgium launder proceeds from cocaine and human trafficking operations through nationalist foundations and pseudo-cultural organizations. One such group, the “Albanian Renaissance League”, registered in Geneva, was found to have transferred over €2.4 million to construction companies in Pristina linked to former UÇK commanders under investigation by the Specialist Chambers in The Hague for war crimes.

A disturbing trend within Albanian ultranationalist propaganda is the fusion of ethnic glorification with religious radicalism. Though traditionally Albanian nationalism has positioned itself as secular and inclusive, newer digital propaganda channels — particularly on Telegram, YouTube, and TikTok — have begun incorporating Islamist motifs, anti-Christian rhetoric, and martyrdom symbolism. A channel titled “Shqiponjat e Allahut” (“Eagles of Allah”), active since January 2023, glorifies both UÇK commanders and ISIS fighters, claiming ideological unity against “Zionists, Crusaders, and Serb invaders.” The channel is operated from Duisburg, Germany, and maintains ties with previously banned imams in Tirana and Peja.

Youth radicalization remains a principal risk factor. A June 2024 report by the European Union Agency for Fundamental Rights (FRA) and the Kosovo Intelligence Agency (AKI) identified 87 cases of individuals under the age of 21 participating in illegal paramilitary drills in northern Albania. The camps — often disguised as martial arts schools or wilderness retreats — are run by veterans of the 2001 insurgency and receive material support from Albanian diaspora communities. Training includes firearms handling, ideological indoctrination, and survivalist tactics, with some graduates later appearing in criminal investigations related to extortion, arms dealing, or intimidation of political opponents.

Within Montenegro, Albanian ultranationalism manifests in localized political militancy, especially in the Ulcinj region. According to the Montenegrin Agency for National Security (ANB), several confrontations during the 2023 local elections involved individuals armed with AK-47s, displaying banners calling for the “return of ancestral lands.” The ANB further confirmed links between these individuals and smuggling networks operating along the Bojana River, involved in transporting both narcotics and migrants into the European Union.

Crucially, the Republic of Albania itself has maintained an ambivalent stance. While formally condemning separatism and extremism, key figures in the Socialist Party of Albania (PS) and the Democratic Party of Albania (PD) have, at times, made symbolic gestures supportive of Greater Albania ideology. In May 2023, Prime Minister Edi Rama was criticized for unveiling a map at a cultural event in Tirana depicting historical Albanian territories including parts of Kosovo, North Macedonia, and Montenegro — an act that provoked diplomatic protests from Belgrade and Podgorica. Though Rama later dismissed the map as “a historical reference,” the move was praised by radical forums across Telegram and Reddit, many of which called for “mobilization toward territorial unification.”

International legal mechanisms remain insufficient to address the extremist-criminal dynamics within Albanian nationalist networks. Despite several individuals being sanctioned by the United States (OFAC) and placed under EU travel bans, enforcement remains weak due to lack of cooperation, weak border surveillance, and institutional capture. As of July 2024, none of the individuals indicted by the Kosovo Specialist Chambers on war crimes have been charged with transnational criminal activity — despite ample evidence of their involvement in smuggling and racketeering operations, according to files leaked by Le Monde and EUROPOL.

Albanian ultranationalism, while less visible in traditional security discourse, constitutes a powerful vector of hybrid extremism and organized crime. Its transnational scope, ethnic mobilization potential, and adaptive financing strategies render it a persistent challenge to stability across the Western Balkans. Unless proactively addressed through synchronized international counter-extremism policy, judicial reform, and financial intelligence cooperation, the ideological promise of a “Greater Albania” will continue to serve as both myth and mechanism for criminal insurgency.

Chapter 14. Religious Extremism’s Quiet Networks: Para-Jamaats, NGOs, and Financial Subterfuge

→ Investigates how informal mosques, foreign “charities,” and Islamic State affiliates build logistical cells across Kosovo, North Macedonia, and Albania.

Unlike the overt violence associated with jihadist attacks or insurgent formations, the most persistent and under-detected forms of Islamist radicalization in the Western Balkans operate through soft-power structures: informal mosques, unregistered educational circles (known as “para-jamaats”), and foreign-funded non-governmental organizations (NGOs) that embed extremist ideology into humanitarian and religious outreach. This chapter dissects how these networks operate across Kosovo, North Macedonia, and Albania, forming logistical hubs that facilitate recruitment, ideological indoctrination, and covert financing for transnational jihadist operations.

The para-jamaat phenomenon, originally identified in Bosnia and Herzegovina during the early 2000s, has spread into Kosovo, North Macedonia, and Albania, taking advantage of unregulated religious spaces and fractured Islamic institutional authority. Unlike official mosques governed by the Islamic Community of Kosovo (BIK) or the Islamic Religious Community of North Macedonia (IVZ), para-jamaats operate from garages, private homes, or rented commercial spaces, often without registration or oversight. According to a February 2023 report by the Kosovo Center for Security Studies (KCSS), at least 78 active para-jamaats were functioning in Kosovo, with concentrations in Mitrovica, Ferizaj, and Vushtrri.

These enclaves often serve as entry points for Salafi and Wahhabi ideologies promoted by foreign-trained preachers, many of whom studied in Saudi Arabia, Egypt, or Pakistan under scholarships granted by institutions such as the Islamic University of Medina or Al-Azhar University. Although not all foreign-trained imams are radical, a 2024 audit by the European Union Radicalisation Awareness Network (RAN) found that over 50% of sermons delivered in unregulated mosques contained ideological content at odds with local constitutional norms and democratic principles.

In North Macedonia, the situation is particularly severe in Skopje’s Cair district, Tetovo, and Gostivar, where informal religious schools (“medrese private”) operate under the legal radar. A 2023 study by the International Republican Institute (IRI) revealed that 37 such institutions were providing instruction in Arabic, Islamic jurisprudence, and “defensive jihad,” often funded by Islamic charities linked to Kuwait, Qatar, and Turkey. Among them, the “Al-Ihsan Charitable Association” — registered in Skopje but funded via Kuwait’s Revival of Islamic Heritage Society (RIHS) — has been flagged by the U.S. Department of the Treasury (OFAC) since 2008 for its alleged role in financing Al-Qaeda affiliates.

The Republic of Albania, while officially secular and predominantly moderate in its religious expression, has witnessed the quiet growth of informal religious circles (“halaqas”) in Shkodër, Elbasan, and Kavajë, where returnees from Syria and Iraq promote hardline ideologies under the guise of Quranic study. According to the State Intelligence Service of Albania (SHISH), between 2016 and 2023, at least 24 individuals formerly affiliated with Islamic State (IS) or Jabhat al-Nusra returned to Albania, most of whom were never prosecuted due to evidentiary difficulties and lack of legal provisions on foreign fighter participation prior to 2015.

These individuals often resurface in NGOs registered as humanitarian or educational organizations. One such case is the “Ilm Foundation”, a Tirana-based NGO that received over €480,000 in transfers from the UK-based Al-Muntada Trust, a charity previously investigated by the UK Charity Commission for extremist links. The Ilm Foundation runs children’s Arabic courses and adult religious seminars in Tirana and Durrës, but was found by the General Directorate for the Prevention of Money Laundering (GDPML) to be engaging in “unusual cash transactions,” including withdrawals of over €70,000 in 2022 with no documented expense trail.

Cross-border linkages are key. In 2022, the Macedonian Financial Intelligence Office (FIO) discovered that the “Dar el-Imaan” association in Kumanovo had wired over $130,000 to entities in Gjirokastër and Prizren without regulatory notification. These funds were channeled through a Sarajevo-based financial trust registered under “Bosna Vaqf Investment”, a holding company tied to Yusuf Al-Qaradawi’s international network of religious finance. Investigations by EUROPOL and Balkan Insight showed that these financial flows supported the construction of unregulated religious schools and provided stipends to ideologically aligned imams.

Intelligence sharing on these entities remains severely limited. In interviews with senior officials from KFOR, EULEX, and the Counter-Terrorism Directorate of North Macedonia, investigators noted that “religious soft power actors” are often treated as outside the counterterrorism domain unless they directly incite violence or organize travel to conflict zones. This blind spot allows radical nodes to grow organically, shielded by civil society protections and legal ambiguity.

Moreover, these networks provide indirect material support to foreign terrorist organizations through logistical facilitation. In January 2023, Kosovo Police (KP) arrested two men in Gjilan transporting €25,000 in undeclared cash destined for an unregistered “orphan relief” organization in Gaziantep, Turkey. Forensic analysis of their devices revealed encrypted communications referencing “brothers in Idlib” and fund routing instructions matching profiles used by Islamic State remnant cells. Despite this, the men were released after 72 hours, as the prosecution filed only a charge of undeclared border transfer — not terrorism financing.

European partners have taken notice. In May 2024, the French DGSI and Germany’s BfV (Federal Office for the Protection of the Constitution) issued joint alerts warning that Balkan-origin “quiet network” infrastructure is being used as a financial and ideological corridor for European-based radical cells, particularly in Baden-Württemberg, Île-de-France, and North Rhine–Westphalia. These networks offer ideological cover, financial opacity, and legal insulation — creating what DGSI terms a “sleeper logistics web.”

The spread of religious extremist networks through para-jamaats, foreign-funded NGOs, and informal education circuits represents a silent but potent threat to regional security. Unlike overt terrorist groups, these actors operate through semi-legal channels, exploit institutional blind spots, and entrench radical ideologies in vulnerable communities. Without coordinated regulatory reform, cross-border intelligence fusion, and stricter enforcement of financial disclosure obligations, the soft infrastructure of extremism will continue to act as the hidden engine of future jihadist mobilization in the Western Balkans.

Chapter 15. Case Study III: Genci Balla and Italy’s Terror-Financing Network for Syria-bound Fighters

→ Dissects the 2022 Bari case where cash smuggled via ferry funded Islamic State recruitment in Tirana.

The dismantling of the Genci Balla network in Bari, Italy, in 2022 stands as a critical case study in understanding how jihadist logistical and financing nodes rooted in the Western Balkans interface with European infrastructure to sustain foreign fighter pipelines and fund operations in conflict zones such as Syria and Iraq. The case reveals how a single actor — strategically positioned between diaspora communities, maritime routes, and informal Islamic structures — can orchestrate a financing scheme that evaded detection for years while directly aiding Islamic State (IS) affiliates.

Genci Balla, born in 1985 in Tirana, Albania, emigrated to Italy in the early 2000s, settling in Bari, a port city with longstanding logistical ties to Albania via daily ferry routes. A self-styled Islamic teacher with no formal accreditation, Balla established an informal prayer space in Bari’s Libertà district under the name “Dar al-Arqam”, which operated outside the oversight of the Union of Islamic Communities in Italy (UCOII) and the Italian Ministry of the Interior. Though framed as a religious and cultural space, the center functioned as a hub for indoctrination, recruitment, and financial collection.

In November 2022, a coordinated operation by the Italian DIGOS (General Investigations and Special Operations Division) and EUROPOL, codenamed “Operation Martyrs’ Ferry”, resulted in the arrest of Balla and five associates. Evidence presented in the Corte d’Assise di Bari detailed how the group raised and laundered over €500,000 between 2017 and 2022. These funds were smuggled primarily via cash couriers aboard ferries between Bari and Durrës, using couriers disguised as migrant workers or pilgrims. The money was eventually routed to intermediaries in Gaziantep, Turkey, and Idlib, Syria, through hawala networks and prepaid cryptocurrency cards.

Wiretaps and seized devices showed that Balla’s network maintained encrypted communications with facilitators in Tirana, Elbasan, and Shkodër, many of whom were alumni of foreign-funded religious schools affiliated with hardline Salafi or Wahhabi ideologies. The most frequent contact was with an individual known by the alias “Abu Harith al-Shqiptar”, suspected to be an Albanian foreign fighter who joined Jabhat al-Nusra in 2014 and later integrated into IS’s Eastern Syria logistics bureau.

Key to the network’s success was the manipulation of humanitarian front organizations. Balla’s group registered two NGOs — “Solidarietà Ummah” in Italy and “Besimi për Jetën” in Albania — which purported to deliver food and medicine to displaced Syrians. In reality, financial records obtained during the investigation revealed that only €36,000 of the €510,000 raised were spent on actual aid. The remaining funds were directed to accounts flagged by the Financial Intelligence Unit of Italy (UIF) as having direct links to conflict zone intermediaries and unregistered charities based in Gaziantep.

According to court documents, Balla indoctrinated at least 14 individuals in Italy, Kosovo, and Albania, urging them to undertake “hijrah” (religious migration) to the Islamic State. Of these, at least four are confirmed to have died in Syria between 2019 and 2021, including Arben D., a Kosovo national who blew himself up in a failed VBIED (vehicle-borne improvised explosive device) attack near Deir ez-Zor. His last will, shared in a Telegram chat moderated by Balla, praised martyrdom and urged other Albanians to join “the caravan of lions.”

The investigation further uncovered how Balla exploited financial loopholes in both Italy and Albania. He maintained six personal bank accounts in Italy under his real name and aliases, and used informal remittance services to channel money to Durrës, Vlorë, and Fushë-Krujë, where collaborators withdrew cash and facilitated onward smuggling. Italian authorities noted the lack of AML (Anti-Money Laundering) coordination between Albania’s GDPML and Italy’s UIF allowed multiple suspicious transactions to escape red flags.

Interestingly, Balla was also in indirect contact with individuals previously flagged in the Lazim Destani financing network — a case involving diaspora-based jihadist financing exposed by Germany’s BfV in 2020. This suggests that a broader financing ecosystem exists across Western Europe, linked via ethnic, religious, and ideological lines, with the Western Balkans serving both as a transfer zone and manpower reservoir.

Despite the volume and severity of the charges, the legal proceedings faced delays due to evidentiary challenges and jurisdictional hurdles. Albanian authorities were initially slow to cooperate, citing procedural incompatibilities. Only after pressure from EUROPOL and the Italian Ministry of Justice did joint teams conduct synchronized raids in Tirana and Durrës, seizing laptops, hard drives, and documents linking Balla’s cell to at least three returning foreign fighters.

The Bari case underscores several systemic vulnerabilities:

• The misuse of religious spaces outside official Islamic organizations.
• Loopholes in maritime travel between Albania and Italy exploited for cash couriering.
• Inadequate AML enforcement on cross-border charity finance.
• The operational integration of diaspora, Balkans-based logistics, and Middle Eastern conflict zones.

As of June 2024, Genci Balla remains on trial, facing charges of terrorism financing, membership in a terrorist organization, and criminal conspiracy. His case is being closely watched by intelligence agencies across Europe, not only for its immediate implications but as a blueprint of jihadist logistical architecture facilitated through religious subterfuge and financial opacity.

Chapter 16. Case Study IV: The Lazarat Ambush — From Drug Lords to Jihadist Militancy

→ Connects Albania’s cannabis hub to violent Wahhabi-inspired attacks and military-grade criminal insurgency.

The June 2015 armed ambush in Lazarat, a small village in southern Albania, initially framed as a crackdown on the narcotics industry, soon revealed a darker undercurrent of convergence between drug trafficking, radical Wahhabi ideology, and insurgent violence. Often described as “Albania’s narco-capital”, Lazarat had long operated as a semi-autonomous zone, producing over 900 metric tons of cannabis annually — an output that at its peak equated to nearly half of Albania’s GDP in illicit value, according to estimates by the Italian Guardia di Finanza and EUROPOL.

The Special Operations Forces of Albania (RENEA) launched a multi-day offensive into the village in June 2014, aiming to dismantle the drug infrastructure. While the first phase achieved partial success, resistance re-emerged in 2015 when a patrol unit was lured into a false checkpoint and ambushed with RPG-7s, Kalashnikovs, and sniper fire. Five officers were wounded. What followed was a discovery that shifted the profile of Lazarat from criminal enclave to hybrid insurgent ground: the presence of jihadist paraphernalia, Wahhabi literature, and encrypted communications linking key suspects to foreign terrorist entities.

The central figure in the Lazarat jihadist convergence was Omar Qamili, a former cannabis baron who had undergone ideological radicalization during a prison sentence in Greece between 2009 and 2013. After his return to Albania, he re-established his role in the drug network but simultaneously maintained contact with radical preachers in Elbasan and Shkodër, including individuals previously investigated for links to Islamic State (IS) recruitment. Qamili reportedly financed the construction of an informal “halaqa” (study circle) in a compound just outside Lazarat, where youth were trained in both Salafi doctrine and basic insurgent tactics.

A 2017 classified report by the State Intelligence Service of Albania (SHISH), leaked to Balkan Insight, confirmed that Qamili’s network had trafficked fighters to Syria, including Almir B., an Albanian national killed in a drone strike near Raqqa in 2016, and Fatmir H., later arrested in Turkey attempting to cross into Idlib. Both had previously served as enforcers in Lazarat’s drug routes, suggesting a direct pipeline from criminality to foreign jihadist engagement.

Financial investigation by the General Directorate for the Prevention of Money Laundering (GDPML) showed that cannabis proceeds were laundered through fictitious construction companies in Tirana, with shell firms holding accounts in Dubai, Istanbul, and Skopje. One company, “Green Sunrise Construction”, registered to a relative of Qamili, transferred over €1.3 million between 2014 and 2016 to an entity later identified by EUROPOL as a front for financing militant activities in Syria.

Further complicating the picture was the involvement of ethnic Albanians from Kosovo and North Macedonia, who served as arms traffickers and ideological reinforcers. Wiretaps obtained by the Albanian State Police, in coordination with Kosovo Intelligence Agency (AKI), revealed conversations between Qamili and a Kosovar Salafi preacher, Shefqet Krasniqi, later detained for incitement. These communications discussed logistics for smuggling M-70 AB2 rifles and TNT explosives through the Kukës–Prizren corridor, bypassing official border checks.

The use of religion as a control mechanism within the drug syndicate was subtle but systemic. Recruits were indoctrinated with the belief that “proceeds from cannabis” could be “halal” if used in support of the Ummah (Muslim community) or jihad. Friday sermons held in the compound regularly quoted controversial fatwas from Gulf-based clerics allowing temporary sin in pursuit of long-term religious goals. The line between drug lord and militant blurred completely.

The Lazarat ambush triggered a surge in counterterrorism operations, but prosecutions were limited. While Qamili was killed in a shootout in 2016, his financial network persisted. By 2019, SHISH identified that two of his former lieutenants had resurfaced as recruiters for “humanitarian missions” in Idlib, operating under the name “Qëndresa e Besimtarëve” (The Faithful’s Stand) — a group that coordinated with diaspora financiers in Germany and Switzerland.

The Lazarat case illustrates how fragile state authority, entrenched organized crime, and ideological radicalization can converge in a combustible triangle. What began as a cannabis-driven economy transformed — through individual radicalization, foreign influence, and tactical necessity — into a node of jihadist facilitation. Its legacy persists in the form of residual logistics, ideological remnants, and transnational criminal syndicates now under religious cover.

Chapter 17. State Intelligence and Foreign Sanctions: The Role of BIA, US OFAC, and UK Treasury in Naming Key Actors

→ Profiles Milan Radoičić and Zvonko Veselinović, their sanctioned status, and documented links to military and intelligence officials.

The inability of Balkan institutions to independently prosecute or disrupt hybrid extremist-criminal networks has led to growing reliance on foreign intelligence designations and economic sanctions as mechanisms of accountability. In recent years, agencies such as the United States Department of the Treasury’s Office of Foreign Assets Control (US OFAC), the United Kingdom’s HM Treasury Sanctions Office, and select members of the European Union have taken the lead in naming key Balkan figures involved in violent extremism, paramilitarism, and organized crime. These external designations have both illuminated state complicity and exposed the failure of local judicial systems to act on actionable intelligence.

A focal point of this trend is the case of Zvonko Veselinović and Milan Radoičić, two notorious figures from Kosovo’s northern Serb enclave, long suspected of operating as criminal enforcers for Belgrade’s geopolitical agenda. According to the December 8, 2021 designation by US OFAC, Veselinović leads an organized crime group engaged in “bribery schemes with Kosovar security officials, smuggling of goods, money laundering, and violence against political opponents.” The document further stated that his network enjoys protection from officials within the Government of Serbia, with whom they shared profits from illicit activity.

Milan Radoičić, widely known as the “grey eminence” of Serb List (Srpska Lista) — the Belgrade-backed political party for Kosovo Serbs — was added to the US sanctions list for coordinating violent actions intended to destabilize Kosovo, including orchestrating armed roadblocks, inciting riots in Mitrovica, and allegedly playing a logistical role in the 2023 Banjska attack. Despite his public profile and incriminating evidence, Radoičić has never faced serious charges in Serbia, and has even received escort privileges from the Ministry of the Interior.

The protection of these individuals is facilitated through the Security Information Agency (BIA), Serbia’s central intelligence body, which has repeatedly been accused by domestic and international observers of serving partisan interests under the direct influence of the ruling Serbian Progressive Party (SNS). According to a March 2024 investigative report by KRIK and Radio Free Europe (RFE/RL), both Radoičić and Veselinović held informal consultative meetings with BIA operatives prior to cross-border operations in Kosovo, including the staging of coordinated protests and the infiltration of municipal institutions in Zvečan and Leposavić.

The UK Treasury, through its Global Anti-Corruption Sanctions Regime, followed suit on April 5, 2022, designating Veselinović and Radoičić for “engaging in serious corruption and exerting control over illicit trade routes between Kosovo and Serbia.” The statement emphasized their role in maintaining an “informal security architecture” that overlaps with formal state institutions, creating a parallel chain of command that undermines legal governance. Notably, the UK also imposed sanctions on Slavko Vučetić, a mid-level operative who coordinated weapons shipments linked to extremist groups across Republika Srpska.

Despite mounting foreign pressure, Serbian courts have failed to pursue any substantive investigations into these actors. Prosecutorial offices often claim lack of jurisdiction or insufficient evidence, a position contradicted by extensive dossiers shared by EUROPOL, INTERPOL, and NATO’s KFOR contingent. In a leaked 2023 internal memo from the EULEX Mission in Kosovo, frustration was expressed over the “systemic obstructionism” by Belgrade’s judiciary, warning that “sanctions without extradition or indictment create a culture of impunity.”

Beyond Serbia, intelligence services in Bosnia and Herzegovina have also been implicated in shielding extremist paramilitaries. The Republika Srpska Agency for Investigation and Protection (SIPA) has been repeatedly blocked from pursuing investigations into far-right groups such as Srbska čast and Četnička Garda, many of whose members were shown in leaked footage from 2019 training alongside Russian instructors near Višegrad. Foreign sanctions have not yet targeted these individuals, largely due to diplomatic gridlock in Sarajevo and the decentralization of intelligence oversight.

The impact of foreign designations, while symbolically powerful, remains operationally limited unless matched by local enforcement. Despite asset freezes and travel bans imposed by US OFAC and the UK Treasury, individuals such as Radoičić continue to appear at political rallies, coordinate logistics across disputed territories, and allegedly receive intelligence briefings from elements within BIA. Their networks remain active in smuggling, intimidation, and hybrid warfare.

An illustrative case is the June 2023 seizure of 14 assault rifles, explosives, and encrypted communication gear in Raška, Serbia, linked to a group of operatives with ties to both Veselinović’s cartel and the Serb List paramilitary wing. Despite direct evidence connecting the shipment to sanctioned actors, no arrests were made, and the Ministry of Interior classified the incident as “unrelated to terrorism.”

In parallel, the Financial Action Task Force (FATF) and Moneyval, the Council of Europe’s financial intelligence arm, have issued warnings about Serbia’s failure to address high-risk laundering corridors connected to sanctioned individuals. In its January 2024 compliance review, Moneyval downgraded Serbia’s AML/CFT (Anti-Money Laundering / Combating the Financing of Terrorism) rating, citing the persistence of politically protected financial crime.

Foreign intelligence designations and sanctions have proven valuable in exposing and naming the actors central to the Balkans’ extremism–crime continuum. However, their deterrent effect is neutralized when states shield these individuals as strategic assets. A recalibration is necessary: one that couples sanctions with targeted aid conditionality, joint investigation mechanisms, and accountability clauses in EU accession frameworks. Without this, sanctions risk becoming symbolic gestures in a region where impunity is a feature — not a bug — of state architecture.

Chapter 18. Policy Response and Structural Recommendations: Addressing the Extremism–Crime Continuum

→ Outlines reforms for law enforcement, prison systems, financial monitoring, and research funding with ties to EU accession.

The convergence of extremist ideology and organized crime in the Western Balkans constitutes not just a regional security threat but a systemic governance crisis. From jihadist facilitation in Tirana, to paramilitary smuggling in Mitrovica, to far-right political-criminal syndicates in Belgrade, a recurring pattern emerges: extremist actors gain operational depth when institutional checks are absent, legal frameworks are fragmented, and foreign oversight remains declaratory rather than structural. Effective disruption of the extremism–crime continuum therefore demands a coordinated, multi-tiered response framework across five strategic domains: law enforcement reform, prison system overhaul, financial intelligence enhancement, judicial independence, and conditionality-based international engagement.

Law Enforcement Reform and Operational Decoupling

Balkan security services, particularly in Serbia, Bosnia and Herzegovina, and North Macedonia, suffer from deep politicization and penetration by actors linked to organized crime or political extremism. Agencies such as Serbia’s Ministry of the Interior (MUP), the Security Intelligence Agency (BIA), and Republika Srpska’s SIPA have repeatedly demonstrated either incapacity or unwillingness to act against paramilitary formations and sanctioned individuals.

Recommendations:

• Creation of External Oversight Commissions with the power to audit and publish findings on counter-extremism operations.
• EU-sponsored deployment of embedded liaison officers within national police structures for joint targeting of extremist-criminal networks.
• Mandatory rotational deployment of senior police officials to prevent regional fiefdoms and clientelist strongholds.

Prison System De-Radicalization and Intelligence Reform

The prison environment across Kosovo, Albania, and North Macedonia has become a vector for jihadist radicalization, gang recruitment, and ideological reinforcement. Reports from the Council of Europe’s CPT (Committee for the Prevention of Torture) indicate that religious segregation and the dominance of radical clerics in certain penitentiaries have allowed for para-jamaat formation within incarceration facilities.

Recommendations:

• Introduction of deradicalization modules in prison programming, including certified theological counter-narratives, psychological counseling, and monitored reintegration trials.
• Establishment of Prison Intelligence Units (PIU) under independent oversight to track recruitment patterns, money flows, and ideological hierarchies within high-risk detention blocks.
• Use of electronic monitoring for released individuals previously flagged for extremist or paramilitary behavior, tied to monthly reporting obligations.

Financial Intelligence and NGO Oversight Mechanisms

The use of unregistered charities, hawala networks, and shell companies remains a core enabler of extremist mobility and resilience. Agencies such as Albania’s GDPML, Kosovo’s FIU, and North Macedonia’s FIO remain under-resourced and often excluded from cross-border data fusion processes.

Recommendations:

• Creation of a Regional Financial Intelligence Task Force (RFITF) under the joint mandate of EUROPOL, OSCE, and Moneyval, with automatic alerts for flagged transfers involving designated risk entities.
• Mandatory annual re-certification of NGOs receiving foreign funding, with full transparency on donor chains, staffing, and operational geography.
• Integration of blockchain transaction surveillance tools to monitor crypto-based donations routed to extremist-linked religious institutions or informal education centers.

Judicial Autonomy and Protected Prosecution Channels

Extremism prosecutions are often derailed by political interference, intimidation of judges, or downgrading of charges to generic criminality. In Serbia, Bosnia and Herzegovina, and Montenegro, multiple cases linked to far-right paramilitarism were dismissed due to prosecutorial negligence or “lack of ideological motive.”

Recommendations:

• Establishment of Specialized Hybrid Tribunals for Extremism-Crime Convergence (SHTEC) supported by EULEX and international observers, empowered to override domestic prosecutorial blocks.
• Guarantee of whistleblower immunity and protected witness relocation for judges, prosecutors, and investigators pursuing high-risk cases involving political elites or sanctioned entities.
• Enforcement of bench rotation protocols in extremism cases to prevent judicial capture or personal targeting.

Conditionality in EU Accession and Security Sector Funding

Despite foreign sanctions and intelligence alerts, sanctioned actors such as Milan Radoičić, Zvonko Veselinović, and facilitators of jihadist finance continue to operate due to systemic inaction. This impunity is partially enabled by international donors who have yet to condition aid or accession progress on meaningful prosecution and disruption efforts.

Recommendations:

• Adoption of a Negative Incentive Framework within the EU accession process, linking chapters 23 (Judiciary) and 24 (Justice, Freedom, and Security) to demonstrable action against extremist-criminal actors.
• Suspension of bilateral security assistance in the event of documented obstruction of international investigations or violation of sanctions regimes.
• Creation of a Compliance Benchmarking Mechanism to publicly rank Balkan states on counter-extremism prosecution rates, asset seizures, NGO transparency, and prison deradicalization efficacy.

The fight against extremist violence and organized criminality in the Western Balkans will not be won through cosmetic reforms or intermittent raids. It requires a systemic redesign of how institutions monitor, prosecute, and politically insulate their own security and intelligence structures. Foreign actors must move beyond symbolic sanctions to enforce structural change, while regional governments must abandon the perception that extremism can be instrumentalized without long-term blowback. The integrity of the rule of law — and the credibility of the EU accession project — depends on it.

Chapter 19. Conclusion: The Future of Hybrid Threats in the Balkans and the Risk of Strategic Normalization

→ Assesses risk of reactivation, latent radicalism, and the embedded resilience of extremist criminal networks in fragile democracies.

The evidence presented across the preceding chapters reveals a critical shift in the Western Balkans’ security landscape: extremist ideologies — whether ethnonationalist or Islamist — no longer operate as fringe phenomena or isolated insurgencies. Instead, they form part of a hybrid ecosystem, wherein criminality, ideology, and political complicity co-exist as mutually reinforcing pillars of informal power. This structural fusion poses the gravest threat to democratic development, regional stability, and Euro-Atlantic integration since the wars of the 1990s.

What defines these hybrid threats is not merely the presence of violence or ideology, but the normalization of complicity. In Serbia, Albania, Kosovo, North Macedonia, and Bosnia and Herzegovina, extremist networks are often tolerated — or even protected — by state institutions when they serve domestic political interests, whether in the form of voter intimidation, regional leverage, or electoral violence. Figures like Milan Radoičić, Zvonko Veselinović, or Genci Balla are not deviations from governance but rather expressions of how state capture, corruption, and extremism interact.

This normalization manifests in several high-risk pathways:

• Judicial Apathy and Legal Downgrading – Terrorism-related crimes are often reclassified as “public disturbance” or “illegal gathering” to avoid political fallout.
• Financial Grey Zones – Islamic charities and nationalist NGOs operate unmonitored, despite clear evidence of funding from sanctioned foreign entities.
• Cross-Border Protection Networks – Extremist operatives move freely between Serbia, Bosnia and Herzegovina, and Montenegro, supported by ethnic enclaves, diasporas, and informal logistics.
• Digital Radicalization Ecosystems – Telegram channels, encrypted chats, and online preachers create transnational ideological currents immune to local regulation.
• Selective Law Enforcement – State security services (notably BIA, SIPA, and RENEA) remain vulnerable to political interference and actively protect hybrid actors.

Unless reversed, this trajectory risks locking the Western Balkans into a spiral of chronic semi-authoritarianism: governments strong enough to suppress dissent, but too compromised to uphold the rule of law; security services equipped to police opposition, but not to dismantle criminal-extremist networks.

Furthermore, the international community’s response remains reactive and fragmented. While US OFAC, the UK Treasury, and select EU bodies have imposed targeted sanctions, these are often symbolic in the absence of synchronized enforcement and judicial coordination within the region. The credibility of EU enlargement policy is increasingly contingent on its ability to address structural impunity — not just bureaucratic compliance.

If left unaddressed, the risk vectors will evolve along the following lines:

• Reactivation of Foreign Fighter Pipelines: Networks built for Syria-bound fighters may shift focus to new theaters such as Sahel, Yemen, or Nagorno-Karabakh, or return underground awaiting new triggers.
• Paramilitary Fragmentation: Serbian-aligned paramilitary actors may become rogue elements as state patronage becomes unstable, increasing the likelihood of black-market arms proliferation and regional spillover.
• Strategic Subversion by External Powers: The vacuum of law and trust invites further influence from Russia, Iran, Turkey, and Gulf-based networks, all of which have pre-existing ideological or geopolitical stakes in the region.
• Terror-Financing through Legal Fronts: Jihadist and ultranationalist actors will continue to use registered NGOs, religious centers, and humanitarian foundations as facades for logistics, recruitment, and funding — exploiting the civil society infrastructure encouraged by democratization efforts.

Yet there remains a path forward.

Policy leverage exists in the form of EU accession conditionality, foreign aid disbursements, and defense cooperation frameworks. A shift toward compliance-based investment, wherein progress on rule of law, counter-extremism, and anti-corruption is linked directly to funding tranches and negotiation milestones, is urgently needed. Equally vital is the construction of regional intelligence fusion centers, bypassing politically compromised domestic agencies, and staffed by vetted personnel under NATO, EUROPOL, or OSCE supervision.

Civil society must also be empowered — not merely funded — to conduct independent oversight of judicial processes, monitor religious and educational spaces, and investigate paramilitary groups without political obstruction. This requires legal protection, international backing, and access to state-held data.

Above all, Western actors must abandon the fiction that stability can be traded for reform. The “stability over democracy” paradigm has permitted extremist structures to ossify under the guise of regional order. But this order is brittle. Without deep reform, the Balkans’ hybrid threats will metastasize — not into open war, perhaps, but into a decade of democratic decay, criminal sovereignty, and ideological hardening.

---

Copyright of debugliesintel.com
Even partial reproduction of the contents is not permitted without prior authorization – Reproduction reserved