From Bomb Threats to Hybrid Warfare: Is Albania Becoming a Target of Intimidation and Influence Operations in the Balkans?

Isuf B.Bajrami

Threatening emails sent on October 9, 2026, to state institutions in Albania have once again drawn attention to the vulnerability of institutions to forms of intimidation that exploit insecurity, interethnic tensions, and political disputes in the Balkans. According to media reports, the messages contained claims that explosive devices had been planted, threats against Albanians, and direct references to the status of Kosovo. The State Police initiated verification procedures to identify the perpetrators and clarify the circumstances.¹

The content of the messages raises questions about the sender’s motives and the possible objective of the threats. Nevertheless, the identity of the perpetrator, any potential links to an organization, and responsibility for the incident cannot be established solely on the basis of the language used in the communication.

The case also deserves to be examined within the broader context of regional security. This does not necessarily mean that we are dealing with a hybrid operation, but rather that the incident raises issues related to institutional security, public communication, and the potential political exploitation of existing tensions.

The central question is whether this is an isolated threat or whether the investigation could uncover elements linking it to a broader attempt at intimidation and political influence.

1. A Threat That Goes Beyond the Content of an Email

According to reporting by A2 CNN, a threatening message was sent to several state institutions in Albania, including the School of Magistrates. In the message, the sender claimed to be the leader of a Serbian militia and threatened to plant an explosive device. The message also contained threats against Albanians, linked to the demand that Kosovo be recognized as Serbian territory.²

According to media reports, the messages were sent to more than 140 email addresses. This figure should be understood as a number reported by the media, rather than an officially confirmed count of the different institutions affected.

The police began verification procedures to assess the situation and identify the perpetrators. At this stage, the content of the messages must be distinguished from facts confirmed by the authorities. The claim that an explosive device had been planted is not, in itself, proof that such a device exists.

Nevertheless, even an unsubstantiated threat can have concrete consequences. It may require the deployment of security personnel, temporarily disrupt institutional activities, and cause concern among employees and the public.

Three characteristics stand out in this case.

First, targeting several institutions may require a coordinated response by the relevant authorities.

Second, a warning of an explosion within a short period creates the perception of an immediate danger and places pressure on the authorities.

Third, the combination of a physical threat with nationalist language and the issue of Kosovo gives the incident a political and regional dimension.

These characteristics make it reasonable to examine the case from a national security perspective. However, they are not sufficient to determine whether the sender intended merely to cause panic or was acting as part of an organized effort.

The answer requires evidence that goes beyond the content of the message.

2. Hybrid Warfare: Pressure Without Direct Military Confrontation

In contemporary security analysis, hybrid threats describe the combined use of military and non-military means, both overt and covert, to weaken institutions, influence public opinion, or undermine a state’s security.

NATO includes methods such as disinformation, cyberattacks, sabotage, economic pressure, and other activities intended to create uncertainty and destabilize societies within this category. The Alliance also emphasizes that these activities may be carried out by state or non-state actors.³

An important characteristic of hybrid threats is the possibility of exerting pressure without necessarily engaging in direct military confrontation. Through information manipulation, intimidation, or attacks on critical systems, an actor can create uncertainty and consume institutional resources, while determining responsibility may prove difficult.

In Albania’s case, the use of electronic communication, the targeting of institutions, and the inclusion of a sensitive geopolitical issue are elements that can be analyzed within this framework.

However, similarities to known methods of intimidation do not prove that the incident is part of a coordinated hybrid operation directed from abroad.

Such a conclusion would require verifiable information about the technical origin of the messages, the sender’s identity, possible coordination among the perpetrators, and any links to other structures.

Therefore, the question is not whether every threatening email constitutes hybrid warfare, but whether the investigation will uncover elements linking this incident to a broader influence operation.

This distinction is essential to avoid both underestimating the threat and exaggerating it through unsupported interpretations.

3. Russia and Foreign Influence in the Western Balkans

The Western Balkans remains an area where political disputes, European and Euro-Atlantic integration processes, and the interests of external actors intersect.

In its 2025 report on the Western Balkans, the NATO Parliamentary Assembly assesses that the region is vulnerable to external influence. The document emphasizes that Russia exploits ethnic divisions and spreads disinformation to undermine Euro-Atlantic integration, particularly in Bosnia and Herzegovina and Serbia. The report also addresses Belgrade’s relations with Moscow and the ongoing security challenges in the region.⁴

The European Commission has also addressed the Western Balkans within the framework of integration challenges and the functioning of democratic institutions. The 2022 Communication on the European Union’s enlargement policy provides an institutional source for analyzing political developments and the challenges facing the countries of the region.⁵

These documents help explain the strategic context in which the incident in Albania has occurred.

Nevertheless, the regional context must not be confused with evidence of responsibility for a specific event.

The fact that Russia uses influence tools in the region does not mean that it is behind every threat containing nationalist language. Likewise, political relations between Moscow and Belgrade do not prove that a particular action was planned or carried out by the authorities of both countries.

For Albania and Kosovo, the challenge lies in identifying actual interference without allowing unconfirmed suspicions to replace investigation and professional analysis.

A serious security analysis must be able to examine the possibility of foreign influence, but also to rule it out if the evidence does not support it.

4. The Russian-Serbian Humanitarian Center in Niš: Strategic Context, Not Evidence of Involvement

The Russian-Serbian Humanitarian Center in Niš is an institution established on the basis of an agreement between the governments of the Russian Federation and the Republic of Serbia, signed on April 25, 2012. According to its official website, the center was established to conduct humanitarian activities and contribute to emergency response in Serbia and the Balkan region.⁶

The institution has been mentioned in public discussions concerning Russian-Serbian relations and the strategic dimension of Russia’s presence in the region. However, the mission declared by the center itself and external assessments of its strategic significance are different matters and must be treated separately.

Regarding the incident of October 9, 2026, there is no verified public evidence linking this institution to the sending, organization, or coordination of the threatening messages.

For this reason, any claim that it was involved would be unsupported by the available information.

Such a connection may be examined only if concrete evidence emerges to justify that line of investigation. It cannot be inferred from the institution’s location, political relations between the two states, or the content of an anonymous message.

Including the center in the regional context may be useful for understanding Russian-Serbian relations, but it should not create the impression that a proven connection to the incident exists.

5. Serbia, Kosovo, and the Exploitation of Albanian-Serbian Tensions

Albanian-Serbian relations continue to be affected by political disputes over Kosovo and the legacy of past conflicts.

In this context, a threat that uses language directed against Albanians and demands a change in Kosovo’s status may provoke strong public reactions. An actor seeking to polarize society may exploit national symbols, territorial claims, and language of revenge to increase mistrust or create the perception of a broader threat.

Nevertheless, the use of a purported Serbian identity does not prove that the sender is a Serbian citizen, is acting on behalf of a Serbian organization, or has links to the authorities in Belgrade.

The sender’s self-identification as the “leader of the Serbian Militia,” according to the text published by the media, remains a claim made by the author of the message, not an identity confirmed by the authorities.²

The use of such an identity may be genuine, fabricated, or intended to direct suspicion toward a particular party. These possibilities may be examined during the investigation, but none can be presented as a conclusion without evidence.

Security analysis must keep several possibilities open: the actions of an individual, the activities of an informal group, an organized provocation, or an attempt to create the impression that an external actor is involved.

These are analytical hypotheses, not conclusions about the specific case.

Responsibility must be established through investigation and evidence, not through premature interpretations of the political content of the messages.

6. Albania and Kosovo as a Sensitive Regional Security Space

Albania and Kosovo have close political, social, and historical ties. For this reason, an incident in Albania involving threats against Albanians and references to Kosovo’s status may attract public attention in both countries.

The dissemination of the messages through the media and social networks may cause concern and encourage different interpretations of the author’s motives.

If the incident proves to be part of a coordinated influence operation, its consequences could extend beyond the intimidation of institutions to include attempts to influence public perceptions and exploit existing tensions.

Nevertheless, this remains a possibility that must be assessed on the basis of evidence, not a confirmed conclusion.

Cooperation among security institutions, investigative bodies, and judicial authorities can help identify the source of the communications and establish responsibility, particularly if evidence emerges of a cross-border origin.

The way institutions and the media communicate about the incident is also important in this process.

The spread of unconfirmed accusations may increase tensions and divert attention from identifying the perpetrators. Conversely, accurate communication and transparency regarding the results of investigations help limit opportunities for manipulation.

7. The Institutional Response: Security, Investigation, and Public Communication

Addressing bomb threats requires a coordinated response in three main areas.

First, immediate security. Every claim that explosive devices have been planted must be assessed by the competent authorities. The credibility of a threat cannot be determined solely by its wording or the sender’s purported identity.

Second, technical investigation. Identifying the perpetrator requires examining available electronic data and other elements that may help establish the source of the communication. The investigation should also examine the possibility of coordination if indicators emerge that justify pursuing this line of inquiry.

Third, public communication. Authorities must distinguish confirmed facts from information that remains under investigation. Accurate communication helps prevent panic and limits the spread of unsubstantiated claims.

If evidence of coordinated activity emerges, the incident should be assessed within the broader security framework, including its cyber and cross-border dimensions.

If it is established that the messages were sent by an individual with no links to any organization, the response should focus on individual responsibility and preventing similar incidents.

In both cases, conclusions must be based on evidence, not political assumptions.

Conclusion: The Threat Must Be Investigated, Not Interpreted Prematurely

The threatening electronic messages reported in Albania on October 9, 2026, constitute a serious incident requiring thorough verification and the identification of those responsible. Claims of planted explosive devices, violent language directed against Albanians, and references to Kosovo make it necessary to examine the case from the perspective of regional security as well.

NATO and European Union documents show that external influence and hybrid threats are important issues for the security of the Western Balkans.³⁻⁵ This context justifies examining the possibility of external influence, but it does not prove that the specific case is part of a Russian, Serbian, or other state actor’s operation.

Likewise, the existence of the Russian-Serbian Humanitarian Center in Niš does not constitute evidence of its involvement in the reported threats.⁶ Such a claim can be supported only by specific and verifiable information.

The main challenge for institutions and public analysis is to avoid separating the incident from its geopolitical context while also avoiding the replacement of evidence with suspicion.

In a region where political disputes may be exploited to generate fear and polarization, the most sustainable response is to strengthen institutional security, promote cross-border cooperation, and ensure transparency regarding the results of investigations.

If the messages are part of an organized effort to intimidate or destabilize, identifying the perpetrators and documenting their connections will be decisive. If the investigation finds no evidence of such coordination, that outcome must also be made clear to the public.

In either case, the security of Albania and Kosovo is best protected through effective institutions, professional investigations, and a public that distinguishes fact from propaganda, claims from evidence, and geopolitical context from concrete responsibility.

Footnotes,
1. A2 CNN, “The Threatening Message Targeting Institutions: State Police Respond,” October 9, 2026, https://a2news.com/shqiperia/kronike/mesazhi-kercenues-ndaj-institucioneve-reagon-policia-e-shtetit-i1186758.
2. A2 CNN, “We Will Kill Albanians Until You Recognize Kosovo as Serbian Territory,” October 9, 2026, https://www.a2news.com/shqiperia/kronike/do-te-vrasim-shqiptare-derisa-ta-njihni-kosoven-si-territor-te-i1186754.
3. North Atlantic Treaty Organization (NATO), Countering Hybrid Threats, NATO, https://www.nato.int/en/what-we-do/deterrence-and-defence/countering-hybrid-threats.
4. NATO Parliamentary Assembly, Western Balkans: 30 Years Since Signing of the Dayton Accords, General Report, document 019 PC 25 E rev. 2 fin., October 11, 2025, https://www.nato-pa.int/document/2025-western-balkans-report-valasek-019-pc.
5. European Commission, 2022 Communication on EU Enlargement Policy, COM(2022) 528 final, Brussels, October 12, 2022, https://enlargement.ec.europa.eu/2022-communication-eu-enlargement-policy_en.
6. Russian-Serbian Humanitarian Center, About Us, official institutional website, https://www.ihc.rs/about-us/.

Prishtina,09.10.2026