Russian hybrid warfare

• 1. Soldiers Without Insignia

  ›

  Russian hybrid warfare entered public consciousness in early 2014, when armed men in unmarked uniforms materialized on the streets of Crimea. The troops carried modern weapons and no identifying insignia. Local residents and journalists started calling them "little green men." Russia would not confirm or deny sending them. The annexation of Crimea proceeded without a formal declaration of war. The episode introduced a concept that would shape European security for the following decade: how to project military power while denying military action. How far would these tactics spread? How would European governments and NATO respond? And how do you deter an adversary who designs each operation to stay just below the threshold of open conflict?

  1435

• 2. Heavy Metal Diplomacy

  ›

  On the 21st of October 2016, Russia's Northern Fleet passed through European waters. At its head were the aircraft carrier Admiral Kuznetsov and the battlecruiser Piotr Veliky. The two ships were bound for the Syrian coast to support government forces near Aleppo. Russian military analysts described the passage as "Heavy Metal Diplomacy," framing a naval transit as a form of political pressure.

  That same year, broad disinformation campaigns targeted the US presidential election and the Brexit referendum. The campaigns reached into political debates on both sides of the Atlantic.

  On the 24th of February 2022, Vladimir Putin ordered a full-scale invasion of Ukraine, and the hybrid operations did not stop. According to the Institute for the Study of War, Russian military doctrine does not treat hybrid warfare as a set of tactics. Russia defines it as a distinct type of war, one the Armed Forces openly discuss as the future of military development.

  1435

• 3. Sabotage and the Shadow Fleet

  ›

  Western governments accused Russia of sabotaging the Nord Stream gas pipelines in September 2022. The pipelines ran beneath the Baltic Sea and had carried Russian gas supplies to Western Europe.

  In November 2024, two submarine communications cables in the Baltic Sea were cut. A Chinese-flagged vessel called Yi Peng 3 was allegedly captained by a Russian national and passed over both cables near the time each was severed.

  On Christmas Day 2024, a power cable connecting Estonia and Finland was cut in Finnish waters. Finnish authorities placed a tanker named Eagle S at the center of their investigation. The Finnish Customs Service said the ship belonged to Russia's shadow fleet. According to MarineTraffic data, the Eagle S had left Saint Petersburg bound for Egypt but slowed near the undersea cables. Finnish Border Guard officers who boarded the ship found that its anchors were missing. The working theory was that the ship had dragged its anchors over the cables as it passed.

  Earlier in 2024, the deputy head of NATO's Allied Maritime Command had warned that Russia was targeting Europe's undersea infrastructure. He warned that the network of undersea pipes and cables connecting Europe's energy and communications systems was both extensive and vulnerable to attack.

  26534

• 4. Proxies and Paid Agents

  ›

  In October 2024, MI5 Director General Ken McCallum issued a public warning about Russian military intelligence. Russian intelligence, he said, was running a campaign to "generate mayhem" on European and British streets using proxy agents. McCallum said the reliance on proxies "further reduces the professionalism of their operations."

  In May 2024, four Bulgarian nationals vandalized a Holocaust Memorial in Paris. French intelligence services, writing in October 2025, linked the act to a long-term Russian strategy. The aim, as described, was to pay proxies to sow division, spread false information, and stoke social tensions.

  In January 2026, Lithuanian prosecutors accused six foreign nationals of planning a September 2024 terrorist attack on a private military supplier supporting Ukraine. Prosecutors said the operation may have been coordinated from Russia by Colombian and Cuban nationals with ties to the GRU, Russia's military intelligence service.

  In March 2026, Petr Mlejnek, the former head of Czech intelligence, said he suspected Russia of commissioning an arson attack on an arms factory in Pardubice. Mlejnek described the suspected attack as part of a broader Russian pattern of targeting countries that supply weapons to Ukraine.

  7810143

• 5. Signals, Jamming, and Cyberattacks

  ›

  In May 2024, Estonia's foreign ministry summoned the Russian embassy's chief representative after a Finnish airline suspended flights to eastern Estonia. The cause was GPS signal disturbances that Estonian officials suspected were caused by Russia. Navigation disruptions from suspected jamming have since affected nearly every airline flying over the Baltic region. Finland, Poland, and Sweden have also reported violations of their territorial waters and airspace by Russian forces. European officials have also described Russia and Belarus as encouraging or permitting migrants from third countries to mass at NATO border crossings.

  In December 2025, Lithuania declared a state of emergency after several hundred balloons launched from Belarus flew into its airspace. Lithuanian officials said the balloons caused civil aviation disruptions and raised concern that they could be used to probe for air-defense gaps.

  In February 2026, the Swedish Armed Forces identified a drone jammed near the French aircraft carrier Charles de Gaulle as Russian in origin. The carrier was docked in Malmö and due to take part in NATO exercises. Swedish investigators said the drone had taken off from a nearby Russian spy ship.

  Also in February 2026, a denial-of-service attack struck the Swedish internet forum Flashback. Bahnhof CEO Jon Karlung attributed the attack to the Russian hacker group "No names," calling it "an attack on democracy" and a matter of national security.

  In April 2026, Swedish Civil Defense Minister Carl-Oskar Bohlin said that Russia-linked hackers were shifting from denial-of-service attacks to more destructive operations targeting critical infrastructure. A group tied to Russian intelligence attacked a Swedish heating plant in the spring of 2025. The facility's security systems stopped the attack. A group tied to Russian intelligence also carried out a large attempted attack on Poland's power grid in December 2025. Bohlin's briefing noted that Norway and Denmark had faced similar targeting, suggesting the campaign extended well beyond Sweden's borders.

  131191217

• 6. Churches as Cover

  ›

  In 2024, Sweden's Security Service concluded that a Russian Orthodox church recently consecrated in Vaesteraas had ties to Russian intelligence operations. The church sits near critical national infrastructure and an airport used for Swedish military exercises. Swedish security analysts described the Putin regime as using the Russian Orthodox Church as a platform for covert operations against states that support Ukraine.

  In January 2026, according to Swedish media, several churches in Sweden came under scrutiny for hosting fundraisers connected to the Belarusian St. Elizabeth Monastery. The convent was suspected of ties to Russian military intelligence and of supporting Russia's invasion of Ukraine. Women from the convent were allowed to set up a sales table at the parish of Taby, with approval from the local priest. The Church of Sweden later issued an official warning that the collected funds could be used to support Russia's military aggression against Ukraine. The women had been photographed displaying the pro-war Russian Z symbol and visiting Russian-occupied territories in Ukraine, earning them the nickname Z-nuns.

  The Church of Sweden said the case fit a broader Russian pattern of attempting to influence public institutions and religious organizations across Europe. The Church also noted that the Russian Orthodox Church had repeatedly sought access to premises located near military facilities and airports, a pattern that extended beyond Sweden.

  2728

• 7. Eyes in Orbit

  ›

  Since the early 2020s, Russian spacecraft identified as part of the Luch programme have repeatedly maneuvered close to commercial and government satellites. Those satellites serve Europe, the Middle East, and Africa. European security officials and independent satellite-tracking analysts have reported the behavior publicly. Analysts assessed that the maneuvers placed the Russian spacecraft inside the transmission beams linking satellites to ground stations.

  The Luch programme spacecraft are not believed capable of physically destroying the satellites they approach. Experts warned instead that the intelligence gathered could enable future electronic warfare, spoofing of satellite commands, or coordinated jamming operations. Officials specifically flagged that older satellites often rely on unencrypted command links, a vulnerability the Luch programme appeared designed to map.

  2930

• 8. The Alliance's Response

  ›

  On the 2nd of May 2024, the North Atlantic Council stated that its members were "deeply concerned" by activities attributed to Russia on NATO territory. Investigations had resulted in criminal charges against multiple individuals connected to what the statement called "hostile state activity." Secretary General Jens Stoltenberg said that sabotage, disinformation, violence, and cyber and electronic interference would not "deter us from supporting Ukraine."

  In November 2024, German intelligence chief Bruno Kahl issued a stark warning about Article 5. Russia's extensive use of hybrid warfare, he said, raised the risk that NATO would eventually invoke its mutual defence clause.

  The Baltic States have been among NATO's most vocal advocates for countering the Russian threat. After cable damage in the Baltic was attributed to Russia's shadow fleet, Estonian Foreign Minister Margus Tsahkna called it an attack on "vital infrastructure." Tsahkna named the shadow fleet a direct threat to Baltic security.

  On the 22nd of October 2024, Polish Foreign Affairs Minister Radoslaw Sikorski withdrew consent for the Russian consulate in Poznan to continue operating. Sikorski cited Russian hybrid warfare targeting Poland and its allies, including cyberattacks and attacks at Poland's eastern border. That border also serves as the outer edge of the Schengen Area.

  In March 2025, Paul Wyatt, Director General of Security Policy at the UK Ministry of Defence, appeared before a Defence Committee evidence session. He and other officials called for stronger deterrence against hybrid threats. Wyatt noted that adversaries were seeking to cause harm "in a manner they judge is below the Article 5 threshold." Many officials in the Baltic States have said they believe NATO's eastern flank will be the next target if Russia wins in Ukraine.

  34363752