Experts dissect Serbian espionage mechanisms following indictment against Fatmir Sheholli

Kosovo’s Special Prosecution Office filed an indictment against Fatmir Sheholli on August 25, 2026, accusing him of the criminal offenses of espionage and blackmail.

According to the prosecution’s allegations, Sheholli was recruited by the Serbian Intelligence Agency (BIA) and, until October 9, 2025, operated under the direction of BIA official Bojan Dimiç. He has remained in detention since October 2025 on suspicion of espionage.

The prosecution alleges that he collected and transmitted data and documents concerning political developments, the security situation and the functioning of Kosovo’s institutions.

The indictment also includes the offense of blackmail, alleging that Sheholli demanded money from an individual while threatening to publish videos and information damaging to that person’s reputation. The alleged financial damage exceeds 13,000 euros. The case has now been referred to the Basic Court in Pristina for review.

Arben Fetoshi, director of the “Octopus” Institute, says that espionage cases demonstrate that the activities of Serbian networks against Kosovo have become more sophisticated, while at the same time Kosovo has strengthened its capacity to detect and dismantle them through inter-institutional cooperation.

According to him, the Sheholli case and others show that these networks did not end with the war, but have become more complex within the context of Serbia’s hybrid strategy, and that Kosovo has developed the capacity to neutralize them. He notes that espionage networks serve as instruments for influence operations, manipulation, blackmail and religious radicalization, and that dismantling them highlights the importance of cooperation among the Kosovo Intelligence Agency, the Police and the Special Prosecution Office.

Fetoshi emphasizes that the indictment against Sheholli reveals the BIA’s “modus operandi,” which aims to collect or disseminate information for influence, delegitimize the Kosovo Liberation Army and NATO, and, above all, invest in religious radicalization in order to turn Kosovo into “Kandahar.” Within the framework of Serbia’s hegemonic goals, these are considered hybrid threats aimed at destabilizing and sabotaging the Republic of Kosovo; therefore, counterintelligence capabilities are vital to national security.

Meanwhile, security expert Valdet Hoxha explains that state espionage networks are complex and operate through a structured cycle: recruitment, the collection of information, its transmission and its use for subversion or destabilization.

He emphasizes that, in the case of Serbian services operating against Kosovo, the espionage network appears to function by exploiting financial needs, family pressure, compromising information, or ideological and ethnic beliefs, often through NGOs or individuals with access to institutions who are funded through shell companies or unofficial transfers.

Hoxha adds that, regardless of the methods used, the goal of Serbian intelligence services remains the same: spreading fake news, inflaming interethnic tensions and creating narratives designed to sow fear and panic among citizens, with the ultimate aim of damaging Kosovo’s image on the international stage.

Nevertheless, he assesses that Kosovo’s security structures, including the Kosovo Intelligence Agency, the Police and the Special Prosecution Office, have established strong operational capabilities and cooperate closely with international partners, including KFOR and allied services, to identify, pursue and neutralize these espionage networks through counterintelligence measures.