Russian hybrid warfare

Russia has used hybrid warfare to foster instability in other countries while avoiding all-out war.

Soldiers without insignia in Crimea, 2014, referred to as "little green men"

Russian hybrid efforts preceding the full-scale Russian invasion of Ukraine that started in 2022 include using soldiers without insignia called "little green men" to annex Crimea in 2014, and the broad disinformation campaigns targeting the 2016 US election and Brexit referendum.

The passage of the Russian Northern Fleet, led by the aircraft carrier Admiral Kutznezov and the battlecruiser cruiser Piotr Veliky, on their way to support Syrian government forces around Aleppo on 21 October 2016 was part of Russia's "Heavy Metal Diplomacy" within the context of hybrid warfare.

On 24 February 2022, Putin ordered the beginning of a large-scale Russian invasion of Ukraine. Since then, there have been many incidents in Europe linked to Russian hybrid warfare.

Western sources have accused Russia of being responsible for the Nord Stream pipelines sabotage in September 2022.

In May 2024, the foreign ministry of Estonia summoned the Russian embassy chief after flights by a Finnish airline to eastern Estonia were paused due to GPS disturbances suspected to be caused by Russia. Since the beginning of the e full-scale Russian invasion of Ukraine, almost all airlines flying over the Baltics have experienced navigation problems. Aside from signal jamming, other forms of Russian hybrid aggression against countries like Finland, Poland, and Sweden described are violations of territorial waters and air space, and encouraging or permitting migrants from third countries to arrive at borders in large numbers through Russia and Belarus.

In October 2024, the head of MI5 Ken McCallum warned that Russian military intelligence were active in a campaign to "generate mayhem" on European and British streets using proxies that "further reduces the professionalism of their operations".

In October 2025, French intelligence services said that an instance of Holocaust Memorial vandalism committed in May 2024 in Paris by four Bulgarian nationals was linked to a long-term strategy by Russia to use paid proxies to sow division, spread false information and stoke social tensions.

In December 2025, Lithuania declared a state of emergency after several hundred balloons launched from Belarus as part of Russia's hybrid campaign caused both civil aviation disruptions and raised concern over national security, with senior Lithuanian officials reporting that they could be used to probe for air-defence gaps. In January 2026, Lithuanian prosecutors accused six foreign nationals of planning a terrorist attack in September 2024 targeting a private military supplier supporting Ukraine. The prosecutors said that their activities may have been coordinated from Russia by Colombian and Cuban nationals linked with the Russian GRU.

In February 2026, the Swedish Armed Forces identified a drone that was jammed after it was seen near the French aircraft carrier Charles de Gaulle as Russian, saying it had taken off from a nearby Russian spy ship. The carrier was docked in Malmö and due to take part in NATO exercises seen as a response to a long period of Russian hybrid warfare.

Also in February 2026, a denial-of-service attack was conducted on the Swedish forum Flashback, which Bahnhof CEO Jon Karlung said had been launched by the Russian hacker group ″No names″. Karlung called it ″an attack on democracy″ and a matter of national security. In April 2026, Swedish Civil Defense Minister Carl-Oskar Bohlin said that Russia-linked hackers were increasing cyberattacks on critical European infrastructure, saying pro-Russian groups were switching from denial-of-service attacks to more aggressive and destructive attacks. He said a group linked to Russian intelligence targeted a Swedish heating plant in spring 2025, which was stopped by the security systems at the facility, adding that Norway and Denmark have faced similar challenges. A group tied to Russian intelligence was also accused of carrying out a large attempted attack on Poland's power grid in December 2025.

In March 2026, Petr Mlejnek, former head of Czech intelligence, said that he suspected Russia of being behind an arson that took place at a Pardubice arms factory.

The crude oil tanker Eagle S, a ship connected with the Russian shadow fleet suspected of carrying out sabotage in the Baltic Sea

In November 2024, amidst intensifying Russian hybrid warfare efforts in Europe, two Submarine communications cables in the Baltic Sea were damaged in another instance of suspected Russian sabotage. The Chinese-flagged ship Yi Peng 3 was allegedly captained by a Russian as it passed the two cables at approximately the same time as each was cut. The deputy head of NATO's Allied Maritime Command had earlier in the year said that Russia and other malicious actors were targeting the vulnerable and extensive piped and underwater cables connecting Europe's energy and communications networks.

In December 2024, an underwater power cable between Estonia and Finland was damaged on Christmas Day in Finnish waters. Finnish authorities placed a tanker ship named Eagle S at the center of its investigation into the incident being sabotage. The Finnish Customs Service said that the ship is part of the Russian shadow fleet. According to MarineTraffic, the ship was on its way from Saint Petersburg to Egypt, but slowed in the vicinity of the underwater cables. The Finnish Border Guard inspected the ship and said that the ship's anchors were missing, the suspicion being that the ship cut the cables by dragging its anchors over them.

The Russian Orthodox Church has been described as one strand in Russian covert operational activity against European states that support Ukraine. In 2024, the Swedish Security Service concluded that a recently consecrated Russian Orthodox church built in Västerås was linked to Russian intelligence operations, adding that the Putin regime uses the Russian Orthodox Church in Sweden as a platform for such operations. The church is located near critical national infrastructure and an airport used for Swedish military exercises.

In January 2026, according to Swedish media, several churches in Sweden may have been used to host fundraisers linked to the Belarusian St. Elizabeth Monastery, suspected of having ties to Russian military intelligence and supporting Russia's invasion of Ukraine. Women from the convent were allowed to set up a sales table at the parish of Täby with approval from the local priest, and the Church of Sweden later issued an official warning, saying that the collected funds could be used to support Russia's military aggression against Ukraine. The women were dubbed ″Z-nuns″ because of images of them displaying the pro-war Russian ″Z″ symbol, and visiting Russian-occupied territories in Ukraine. The Church of Sweden said that the case fits into a broader Russian pattern of attempting to influence public institutions and religious organizations across Europe, and also noted the Russian Orthodox Church seeking access to premises located near military facilities and airports.

European security officials and independent satellite-tracking analysts have reported suspected Russian intelligence operations involving spacecraft conducting close-proximity manoeuvres near European geostationary communications satellites. Since the early 2020s, Russian satellites identified as part of the Russian Luch programme have repeatedly approached and remained near commercial and government satellites serving Europe, the Middle East and Africa. Analysts assess that these manoeuvres are consistent with signals intelligence collection, as the spacecraft position themselves within the transmission beams linking satellites to ground stations.

Officials have warned that such activity could expose unencrypted command or telemetry data used by older satellites, potentially enabling future interference. While the Russian spacecraft are not believed to possess the capability to directly disable or destroy satellites, experts caution that the intelligence gathered could support electronic warfare, spoofing of satellite commands, or coordinated cyber and ground-based jamming operations.

On 2 May 2024, the North Atlantic Council of NATO said that members of the alliance were "deeply concerned" by activities attributed to Russia on NATO territory, citing investigations resulting in the charging of multiple individuals connected to "hostile state activity". NATO Secretary General Jens Stoltenberg said that actions such as sabotage, disinformation, acts of violence, and cyber and electronic interference would not "deter us from supporting Ukraine".

German intelligence chief Bruno Kahl said in November 2024 that Russia's extensive use of hybrid warfare "increases the risk that NATO will eventually consider invoking its Article 5 mutual defence clause".

The Baltic States have been among the biggest advocates in NATO for the alliance taking steps to counter the Russian threat, with many believing that with the increased Russian hybrid attacks, NATO's eastern flank will be the next to be targeted if Russia wins in Ukraine. Following damage to underwater cables between Estonia and Finland in December 2024 suspected to have been caused by a ship part of the Russian shadow fleet, Estonian Foreign Minister Margus Tsahkna said that the incident must be regarded as an attack against "vital infrastructure", adding that the shadow fleet is a threat to security in the Baltic.

On 22 October 2024, the Polish Minister of Foreign Affairs, Radosław Sikorski, withdrew consent to the functioning of the Russian consulate in Poznań, citing Russian hybrid warfare targeting Poland and its allies, including cyberattacks and assaults at Poland's eastern border, which is also the border of the Schengen Area.

In March 2025, UK officials at a Defence Committee evidence session urged for stronger deterrence against hybrid threats, with the Director General of Security Policy at the Ministry of Defence, Paul Wyatt, noting adversaries seeking to do harm in a "manner they judge is below the Article 5 threshold".

According to the Institute for the Study of War, Russia defines the concept of hybrid wars precisely as a type of war, rather than a set of means to conduct state policy. The Russian Armed Forces openly discuss ongoing conflicts as hybrid wars, and Russia sees hybrid wars as the future of military development.

• 2024 Baltic Sea submarine cable disruptions
• 2025 European drone sightings
• 2025 Russian drone incursion into Poland
• 2025 Russian railway sabotage in Poland
• Diplomatic expulsions during the Russo-Ukrainian War
• Øresund drone incident
• Russian disinformation
• Russian interference in the 2024 United States elections
• Russian shadow fleet
• Russia–European Union relations
• Severing of the Svalbard undersea cable
• Transnational repression by Russia
• Violations of non-combatant airspaces during the Russian invasion of Ukraine