Bulgaria lies where the Western Balkan and Eastern Mediterranean routes meet. Five factors shape the criminal networks that move migrants through it: the terrain, a local service infrastructure, a foreign network of clients and money, legitimate businesses and officials drawn into the scheme, and the geopolitical use of the routes.
This paper examines how organized criminal groups in Bulgaria smuggle migrants across Europe as part of larger high-risk criminal networks, focusing on the trends of the last three years. It draws on open sources and on the author’s professional experience as an intelligence officer.
1. Three ways across the border
The Bulgarian–Turkish border runs through the rugged Strandzha–Sakar region, where policing resembles mountain warfare: conventional forces against guerrilla tactics. Groups use three methods:
- Alone, with navigation apps. Migrants cross on their own, with phones offline or on VPN data, along routes passed from one group to the next, and follow military-style instructions such as “walk by night and rest by day”. One of them stays in contact with a foreign coordinator who arranges the next steps with local contacts. This is the most dangerous method, often chosen by those with little money, and migrants frequently lose their lives at this stage.
- With a guide (“coyote”). A guide who knows the secure and vulnerable areas leads the group and hands it over to the drivers; groups with women and children are sometimes sheltered with locals or in abandoned buildings. Some guides cross illegally just to learn the terrain under experienced instructors.
- Through official checkpoints. Migrants are hidden in trucks, cars and buses. Many drivers know, but intent is hard to prove when migrants hide outside the cab; in one case they were using the driver’s password-protected Wi-Fi from their hiding place between the wheels.
2. The convoy model
After the crossing, almost all internal routes follow the same model:
- Lead vehicle: scouts for police, warns the main vehicle, keeps contact with higher-ranking members and navigates to the drop-off point; it sometimes carries a field captain.
- Main vehicle: carries the migrants and follows the route agreed with the lead vehicle.
- Rear vehicle: rear reconnaissance against police interception; the field captain may ride here because it is the safest position from which to escape.
The spacing between vehicles ranges from a few metres to intervals of 5 to 15 minutes. A typical run, from the Turkish border to the capital or from the capital to the Romanian or Serbian border, takes five to seven hours. Bulgarian groups now also offer this expertise in aggressive driving and transport logistics to other smuggling networks across the Western Balkans.
The cost shows on the roads. The year 2022 was the darkest for Bulgarian law enforcement since records began in 1942: more than five police officers lost their lives, most of them in operations against illegal migration. Drivers often drive dangerously, hoping to abandon the vehicle with the migrants inside and escape.
3. Drivers: the most wanted and most replaceable role
Drivers are the asset that network leaders seek most, and the role with the lowest entry barrier: anyone who can drive and is willing is recruited, regardless of nationality, age or even a driving licence. The typical driver is a middle-aged man of low socio-economic status or with a gambling addiction.
Drug-user communities have become a major pool. These drivers are among the most aggressive in police chases, often under the influence of stimulants. A recruit who completes a few profitable trips can become a “local star”, and the quick money turns neighbourhoods, villages and drug-user or gambling circles into recruitment pools.
The career ladder follows one rule: “The farther you are from the migrants, the safer you are from authorities.” Skilled drivers become field captains, and the best become recruiters or coordinators with minimal contact with migrants. Specialized roles, such as guides, hosts and boatmen, are harder to replace, so the networks invest in them and protect them.
4. Local providers, foreign clients
The networks work through two factors:
- The local factor: the criminal infrastructure in the host country that receives the migrants, moves them along domestic routes, shelters them and delivers them to the exit border. It can be entirely domestic, mixed or entirely foreign. Its roles range from a leader who stays far from the migrants and may also run drug trafficking, through a “general” who manages field operatives and liaises with the foreign side, a manager-accountant-recruiter and a logistics manager with legal businesses such as car rentals, to recruiters, field captains, three kinds of drivers, boatmen and guides.
- The foreign factor: people connected to the migrants by culture, family or origin who bring in clients and money: a head connection with trusted links to criminal groups, middle connections, for example in Türkiye, who keep supplying clients, and an accountant who handles transfers from bank accounts, crypto wallets or relatives.
In short, the foreign factor is the service seeker and the local factor the service provider. Payment often runs through hawala: a third-party guarantor holds the money until the service is done. In current Bulgarian cases the proof is a video recorded at the destination showing all the migrants alive and well; the guarantor then releases the funds.
5. Legitimate businesses and officials in the chain
Unlike burglary or drug dealing, migrant smuggling necessarily connects many spheres of society with the criminal underworld. The paper identifies, among others:
- Car rental companies: rented cars and buses are harder to trace than private vehicles; some firms do not check who rents or where they travel, and some are set up specifically as fronts, often without the drivers knowing.
- Proxy owners: people of low socio-economic status paid small sums to register cars, phone numbers, companies or property in their names.
- Truck parking areas: hubs where migrants are passed between drivers and where information on corrupt firms and willing drivers circulates.
- Officials: politicians, public employees and police officers who use state power for financial or other gain; one case involved representatives of a foreign embassy caught transporting migrants.
- Paramilitary groups and self-organized volunteers: unregulated groups accused of mistreating migrants and undermining the authority of the state.
6. The geopolitical factor
The same routes serve people with hostile intent. Europol’s 2023 terrorism report describes two foreign terrorist fighters, arrested in Spain and Austria in August 2022, who had entered the EU irregularly from Türkiye through Bulgaria and the Western Balkan route. Some of those crossing are former combatants from foreign armies or militias, whose reintegration is difficult even without malicious intent. Terrorist organizations and lone radicals use the resources of organized crime to enter Europe covertly, which makes migrant smuggling a strategic tool for adversaries.
7. Implications
The paper calls for:
- enhanced international cooperation and intelligence sharing;
- targeted operational measures against the networks;
- addressing the socio-economic disparities that feed recruitment;
- stricter regulatory oversight of vulnerable sectors such as car rental.
Atanasov, A. Modus Operandi and Trends of High-Risk Criminal Networks for Illegal Immigration Operating in the Republic of Bulgaria [research paper]. https://a-atanasov.eu/project/high-risk-criminal-networks-for-illegal-immigration/
Method: qualitative analysis of open-source information (books, academic and news articles) and the author’s professional experience, covering the last three years. The author’s views are also informed by classified sources, which are neither cited nor presented.