How Wagner Group’s Shadow Network Is Infiltrating NATO

When Yevgeny Prigozhin was killed in a plane crash in August 2023, two months after his failed mutiny against Russia’s military leadership, many assumed the Wagner Group would die with him.

Prigozhin’s mercenary force had become one of Moscow’s most feared tools of power. It fought brutally in Ukraine and expanded deep into Africa. His sudden fall looked like the end of Wagner as an independent force.

It wasn’t.

A Financial Times investigation, citing Western intelligence officials, shows that Wagner has not disappeared. It has been reshaped. The fighters may no longer be in uniform on the front lines, but the networks behind them are still active, and now serving Russian interests from inside NATO countries.

From Private Army to Kremlin Tool

Under Prigozhin, Wagner operated in the gray zone between state and private army. The Kremlin denied direct control, yet Wagner advanced Russian interests abroad by protecting friendly regimes, securing mining contracts and fighting in Ukraine.

Wagner’s rise turned parts of Russian foreign policy into a kind of franchise system. Armed contractors and political operatives extended Moscow’s reach without the formal deployment of Russian troops. The blurred lines were deliberate. Wagner gave the Kremlin muscle with plausible deniability.

Prigozhin’s Fall—and What Came Next

Prigozhin’s brief rebellion in June 2023 changed that balance.

Russia officially confirmed Prigozhin died in the August 23, 2023, plane crash via genetic testing, alongside key Wagner figures including Dmitry Utkin. U.S. intelligence assessed the crash likely involved an intentional explosion, widely seen as retaliation after Prigozhin’s mutiny two months earlier.

After his death, the Russian state moved quickly to take control. Wagner’s command structure was dismantled. Fighters were told to sign contracts with the defense ministry or disband.

The Kremlin signaled continuity by elevating a longtime Wagner commander. In September 2023, Putin ordered Colonel Andrei Troshev, described by the Associated Press as a top Wagner commander, to “deal with forming volunteer units” for combat tasks in Ukraine. Kremlin spokesman Dmitry Peskov confirmed Troshev now works for the Defense Ministry, demonstrating that Wagner manpower would be repurposed under state command rather than operating as Prigozhin’s personal army.

However, the system he built was not destroyed.

Operations in Africa were folded into new state-controlled structures such as the Africa Corps, which now maintains Russia’s paramilitary presence in parts of the Sahel once dominated by Wagner. The brand faded, but the personnel, contacts and methods did not.

A Shift Toward Sabotage in Europe

The Financial Times reports that Western intelligence agencies now believe parts of Wagner’s network have pivoted toward covert operations in Europe.

Instead of recruiting fighters for trench warfare, intermediaries are thought to be identifying economically vulnerable young men inside NATO countries and encouraging acts of sabotage.

Encrypted platforms—especially Telegram—are used to make contact. The structure creates distance between attackers and Russian intelligence services such as the GRU, allowing Moscow to deny involvement.

The FT highlights cases where individuals were radicalized online and carried out arson attacks linked to Ukraine-related targets. These were not large-scale operations. But they show how digital recruitment can quickly translate into real-world actions.

Why This Matters for NATO

Russia’s traditional spy networks in Europe have been weakened since the invasion of Ukraine. Hundreds of suspected intelligence officers were expelled. Security services tightened surveillance.

In response, Moscow appears to be relying more on looser, harder-to-trace networks. Using intermediaries is cheaper, less risky and often effective. The goal is not major destruction, but small acts that create fear, division and uncertainty.

The Associated Press, which built a database based on interviews with more than 40 European and NATO officials, has tracked 145 cases of disruption Western officials blame on Russia (or proxies or Belarus) since the 2022 invasion of Ukraine. In that AP database, arson and explosives plots spiked from one in 2023 to 26 in 2024 (with more documented in 2025).

In the UK, a judge’s sentencing remarks in the Dylan Earl case, who orchestrated an arson attack on a London business connected to Ukraine, read like a summary of 21st-century subversion: “The hidden hand of the internet delivered results,” she said, because anonymous proxies found young men “prepared to…betray their country for what seemed easy money.”

The Shadow That Remains

Wagner is no longer the semi-independent army it once was. But its operating model, which is flexible, deniable and network-based, has survived.

What began as a mercenary force on distant battlefields has become part of a broader strategy aimed at testing Western unity from within. Prigozhin is gone. The shadow system he built is not. The looming strategic decision for the United States in the Trump era is whether to keep treating Wagner’s attacks from within NATO allies as “Europe’s problem.”