Russian hybrid warfare

{{Short description|Russian efforts to foster instability}} {{Use dmy dates|date=October 2025}} {{Use American English|date=October 2025}}

Russia has used hybrid warfare to foster instability in other countries while avoiding all-out war.<ref name="p643">{{cite web| title=Russian hybrid warfare| website=Institute for the Study of War| date=25 September 2020| url=https://www.understandingwar.org/report/russian-hybrid-warfare| access-date=4 December 2024| archive-date=5 December 2024| archive-url=https://web.archive.org/web/20241205040147/https://www.understandingwar.org/report/russian-hybrid-warfare| url-status=live}}</ref><ref name="v676">{{cite web | last=Shamim | first=Sarah | title=Could Russian 'hybrid warfare' trigger NATO retaliation? | website=Al Jazeera | date=29 November 2024 | url=https://www.aljazeera.com/news/2024/11/29/could-russian-hybrid-warfare-trigger-nato-retaliation | access-date=4 December 2024 | archive-date=3 December 2024 | archive-url=https://web.archive.org/web/20241203203215/https://www.aljazeera.com/news/2024/11/29/could-russian-hybrid-warfare-trigger-nato-retaliation | url-status=live }}</ref>

==2014–2022== [[File:VOA-Crimea-unmarked-soldiers.jpg|thumb|Soldiers without insignia in Crimea, 2014, referred to as "little green men"]] {{See also|Russo-Ukrainian War|Syrian civil war}}

Russian hybrid efforts preceding the full-scale 2022 Russian invasion of Ukraine include using soldiers without insignia called "little green men" to annex Crimea in 2014, and the broad disinformation campaigns targeting the 2016 US election and Brexit referendum.<ref name="h466">{{cite web | last=Cecco | first=Leyland | title=What is hybrid warfare, which some fear Russia will use after Ukraine's strike? | website=The Guardian | date=19 November 2024 | url=https://www.theguardian.com/us-news/2024/nov/19/hybrid-warfare-russia-ukraine | access-date=4 December 2024}}</ref><ref name="p643"/>

The passage of the Russian Northern Fleet, led by the aircraft carrier ''Admiral Kutznezov'' and the battlecruiser cruiser ''Piotr Veliky'', on their way to support Syrian government forces around Aleppo on 21 October 2016 was part of Russia's "Heavy Metal Diplomacy" within the context of hybrid warfare.<ref>{{Cite web |last=Galeotti |first=Mark |date=19 December 2016 |title=Heavy Metal Diplomacy: Russia's Political Use of its Military in Europe since 2014 |url=https://ecfr.eu/publication/heavy_metal_diplomacy_russias_political_use_of_its_military_in_europe_since/ |access-date=18 September 2025 |website=ECFR |language=en-GB}}</ref>

==2022–present== {{main|Russian sabotage operations in Europe}}

On 24 February 2022, Russian president Vladimir Putin ordered the beginning of a large-scale invasion of Ukraine. Since then, there have been many incidents in Europe linked to Russian hybrid warfare.<ref name="p137">{{cite web | title=Russia's hybrid war in Europe enters a dangerous new phase | website=IISS | date=26 November 2024 | url=https://www.iiss.org/online-analysis/online-analysis/2024/11/russias-hybrid-war-in-europe-enters-a-dangerous-new-phase/ | access-date=4 December 2024}}</ref>

Western sources have accused Russia of being responsible for the Nord Stream pipelines sabotage in September 2022.<ref name="v676"/>

In May 2024, the foreign ministry of Estonia summoned the Russian embassy chief after flights by a Finnish airline to eastern Estonia were paused due to GPS disturbances suspected to be caused by Russia. Since the beginning of the e full-scale Russian invasion of Ukraine, almost all airlines flying over the Baltics have experienced navigation problems. Aside from signal jamming, other forms of Russian hybrid aggression against countries like Finland, Poland, and Sweden described are violations of territorial waters and air space, and encouraging or permitting migrants from third countries to arrive at borders in large numbers through Russia and Belarus.<ref name="r122">{{cite web | last=Cohen | first=Ariel | title=Russian hybrid warfare tactics: Will NATO's defenses be next? | website=Atlantic Council | date=24 May 2024 | url=https://www.atlanticcouncil.org/event/russian-hybrid-warfare-tactics-will-natos-defenses-be-next/ | access-date=7 December 2024}}</ref>

In October 2024, the head of MI5 Ken McCallum warned that Russian military intelligence were active in a campaign to "generate mayhem" on European and British streets using proxies that "further reduces the professionalism of their operations".<ref name="h466"/>

In October 2025, French intelligence services said that an instance of Holocaust Memorial vandalism committed in May 2024 in Paris by four Bulgarian nationals was linked to a long-term strategy by Russia to use paid proxies to sow division, spread false information and stoke social tensions.<ref name="v741">{{cite web | title=French trial examines Holocaust Memorial graffiti allegedly linked to Russia | website=RFI | date=30 October 2025 | url=https://www.rfi.fr/en/france/20251030-french-trial-examines-holocaust-memorial-graffiti-allegedly-linked-to-russia | access-date=5 November 2025}}</ref><ref name="l167">{{cite web | last=Harding | first=Andrew | title=Hand of Moscow? The men jailed for vandalism in French hybrid warfare case | website=BBC | date=1 November 2025 | url=https://www.bbc.com/news/articles/c891d43l8pyo | access-date=5 November 2025}}</ref>

In December 2025, Lithuania declared a state of emergency after several hundred balloons launched from Belarus as part of Russia's hybrid campaign caused both civil aviation disruptions and raised concern over national security, with senior Lithuanian officials reporting that they could be used to probe for air-defence gaps.<ref name="a414">{{cite web | last=Rothwell | first=James | title= Lithuania in state of emergency over smuggler balloons linked to Russia | website=The Telegraph | date=9 December 2025 | url=https://www.telegraph.co.uk/world-news/2025/12/09/lithuania-in-state-of-emergency-over-smuggler-balloons-link/ | access-date=26 December 2025}}</ref> In January 2026, Lithuanian prosecutors accused six foreign nationals of planning a terrorist attack in September 2024 targeting a private military supplier supporting Ukraine. The prosecutors said that their activities may have been coordinated from Russia by Colombian and Cuban nationals linked with the Russian GRU.<ref name="m926">{{cite web | last=Biržietis | first=Dominykas | title=Lithuania charges six suspects with 'terrorism' for targeting Ukraine military aid | website=lrt.lt | date=16 January 2026 | url=https://www.lrt.lt/en/news-in-english/19/2808132/lithuania-charges-six-suspects-with-terrorism-for-setting-fire-to-ukraine-military-aid | access-date=16 January 2026}}</ref>

In February 2026, the Swedish Armed Forces identified a drone that was jammed after it was seen near the French aircraft carrier Charles de Gaulle as Russian, saying it had taken off from a nearby Russian spy ship. The carrier was docked in Malmö and due to take part in NATO exercises seen as a response to a long period of Russian hybrid warfare.<ref name="f301">{{cite web | last=Kirby | first=Paul | title=Drone jammed near French aircraft carrier was probably Russian, says Sweden | website=BBC Home | date=27 February 2026 | url=https://www.bbc.com/news/articles/c1mj3e2nz8ko | access-date=4 March 2026}}</ref>

Also in February 2026, a denial-of-service attack was conducted on the Swedish forum ''Flashback'', which Bahnhof CEO Jon Karlung said had been launched by the Russian hacker group ″No names″. Karlung called it ″an attack on democracy″ and a matter of national security.<ref name="b819">{{cite web | title=Flashback attackerat av proryska gruppen | website=Expressen | date=15 February 2026 | url=https://www.expressen.se/nyheter/sverige/stor-overbelastningsattack-mot-flashback-/ | language=sv | access-date=5 March 2026}}</ref> In April 2026, Swedish Civil Defense Minister Carl-Oskar Bohlin said that Russia-linked hackers were increasing cyberattacks on critical European infrastructure, saying pro-Russian groups were switching from denial-of-service attacks to more aggressive and destructive attacks. He said a group linked to Russian intelligence targeted a Swedish heating plant in spring 2025, which was stopped by the security systems at the facility, adding that Norway and Denmark have faced similar challenges. A group tied to Russian intelligence was also accused of carrying out a large attempted attack on Poland's power grid in December 2025.<ref name="k789">{{cite web | last=Wälde | first=Milena | title=Russia ramps up 'destructive' cyberattacks on Europe, says Sweden | website=Politico | date=15 April 2026 | url=https://www.politico.eu/article/sweden-warns-russia-is-ramping-up-cyberattacks-on-critical-infrastructure/ | access-date=24 April 2026}}</ref>

In March 2026, Petr Mlejnek, former head of Czech intelligence, said that he suspected Russia of being behind an arson that took place at a Pardubice arms factory.<ref name="q225">{{cite web | last=Boubínová | first=Markéta | title=Vsadil bych se, že je to operace pod cizí vlajkou‚ říká o útoku bývalý šéf rozvědky. Podezírá Rusko | website=Deník N | date=20 March 2026 | url=https://denikn.cz/2009631/vsadil-bych-se-ze-je-to-operace-pod-cizi-vlajkou-rika-byvaly-sef-rozvedky-podezira-rusko/ | language=cs | access-date=10 May 2026}}</ref>

===Baltic underwater cable sabotage=== [[File:Crude oil tanker Eagle S at Porvoo 2024-12-31 a.jpg|thumb|The crude oil tanker Eagle S, a ship connected with the Russian shadow fleet suspected of carrying out sabotage in the Baltic Sea]] {{main|2024 Estlink 2 incident}} In November 2024, amidst intensifying Russian hybrid warfare efforts in Europe, two Submarine communications cables in the Baltic Sea were damaged in another instance of suspected Russian sabotage. The Chinese-flagged ship Yi Peng 3 was allegedly captained by a Russian as it passed the two cables at approximately the same time as each was cut. The deputy head of NATO's Allied Maritime Command had earlier in the year said that Russia and other malicious actors were targeting the vulnerable and extensive piped and underwater cables connecting Europe's energy and communications networks.<ref name="p137"/>

In December 2024, an underwater power cable between Estonia and Finland was damaged on Christmas Day in Finnish waters. Finnish authorities placed a tanker ship named ''Eagle S'' at the center of its investigation into the incident being sabotage. The Finnish Customs Service said that the ship is part of the Russian shadow fleet. According to MarineTraffic, the ship was on its way from Saint Petersburg to Egypt, but slowed in the vicinity of the underwater cables. The Finnish Border Guard inspected the ship and said that the ship's anchors were missing, the suspicion being that the ship cut the cables by dragging its anchors over them.<ref name="b781">{{cite web | last=Tahir | first=Tariq | title=Finns suspect Russian shadow fleet tanker sabotaged Baltic power cable | website=The National | date=26 December 2024 | url=https://www.thenationalnews.com/news/europe/2024/12/26/finns-suspect-russian-shadow-fleet-tanker-sabotaged-baltic-power-cable/ | access-date=26 December 2024}}</ref>

===Use of religious institutions=== The Russian Orthodox Church has been described as one strand in Russian covert operational activity against European states that support Ukraine. In 2024, the Swedish Security Service concluded that a recently consecrated Russian Orthodox church built in Västerås was linked to Russian intelligence operations, adding that the Putin regime uses the Russian Orthodox Church in Sweden as a platform for such operations. The church is located near critical national infrastructure and an airport used for Swedish military exercises.<ref name="p137"/>

In January 2026, according to Swedish media, several churches in Sweden may have been used to host fundraisers linked to the Belarusian St. Elizabeth Monastery, suspected of having ties to Russian military intelligence and supporting Russia's invasion of Ukraine. Women from the convent were allowed to set up a sales table at the parish of Täby with approval from the local priest, and the Church of Sweden later issued an official warning, saying that the collected funds could be used to support Russia's military aggression against Ukraine. The women were dubbed ″Z-nuns″ because of images of them displaying the pro-war Russian ″Z″ symbol, and visiting Russian-occupied territories in Ukraine. The Church of Sweden said that the case fits into a broader Russian pattern of attempting to influence public institutions and religious organizations across Europe, and also noted the Russian Orthodox Church seeking access to premises located near military facilities and airports.<ref name="i880">{{cite web | title=GRU-affiliated spy "nuns" who raised funds for Putin's war effort discovered in Sweden | website=The Insider | date=19 January 2026 | url=https://theins.ru/en/news/288591 | access-date=22 January 2026}}</ref><ref name="j850">{{cite web | last=Rothwell | first=James | title= Pro-Putin spy nuns infiltrating Sweden | website=The Telegraph | date=18 January 2026 | url=https://www.telegraph.co.uk/world-news/2026/01/18/pro-putin-spy-nuns-infiltrating-sweden/?WT.mc_id=tmgoff_youtube_putin-spy-nuns-infiltrating-sweden%2F | access-date=22 January 2026}}</ref>

=== Space and satellite activities === European security officials and independent satellite-tracking analysts have reported suspected Russian intelligence operations involving spacecraft conducting close-proximity manoeuvres near European geostationary communications satellites. Since the early 2020s, Russian satellites identified as part of the Russian ''Luch'' programme have repeatedly approached and remained near commercial and government satellites serving Europe, the Middle East and Africa. Analysts assess that these manoeuvres are consistent with signals intelligence collection, as the spacecraft position themselves within the transmission beams linking satellites to ground stations.<ref name="FT_Luch2026">Jones, S.; Hollinger, P.; Bott, I. “Russian spy spacecraft have intercepted Europe’s key satellites, officials believe.” Financial Times, 3 February 2026.</ref>

Officials have warned that such activity could expose unencrypted command or telemetry data used by older satellites, potentially enabling future interference. While the Russian spacecraft are not believed to possess the capability to directly disable or destroy satellites, experts caution that the intelligence gathered could support electronic warfare, spoofing of satellite commands, or coordinated cyber and ground-based jamming operations.<ref name="FT_Luch2026" />

==International reactions== On 2 May 2024, the North Atlantic Council of NATO said that members of the alliance were "deeply concerned" by activities attributed to Russia on NATO territory, citing investigations resulting in the charging of multiple individuals connected to "hostile state activity". NATO Secretary General Jens Stoltenberg said that actions such as sabotage, disinformation, acts of violence, and cyber and electronic interference would not "deter us from supporting Ukraine".<ref name="s178">{{cite web | title=NATO members 'deeply concerned' by activities such as sabotage on alliance soil. They blame Russia | website=The Independent | date=2 May 2024 | url=https://www.independent.co.uk/news/nato-ap-russia-jens-stoltenberg-brussels-b2538751.html | access-date=15 April 2025}}</ref><ref name="h406">{{cite web | last=Jones | first=Seth G. | title=Russia's Shadow War Against the West | website=CSIS | date=20 March 2025 | url=https://www.csis.org/analysis/russias-shadow-war-against-west | access-date=15 April 2025}}</ref>

German intelligence chief Bruno Kahl said in November 2024 that Russia's extensive use of hybrid warfare "increases the risk that NATO will eventually consider invoking its Article 5 mutual defence clause".<ref name="v676"/>

The Baltic States have been among the biggest advocates in NATO for the alliance taking steps to counter the Russian threat, with many believing that with the increased Russian hybrid attacks, NATO's eastern flank will be the next to be targeted if Russia wins in Ukraine.<ref name="r122"/> Following damage to underwater cables between Estonia and Finland in December 2024 suspected to have been caused by a ship part of the Russian shadow fleet, Estonian Foreign Minister Margus Tsahkna said that the incident must be regarded as an attack against "vital infrastructure", adding that the shadow fleet is a threat to security in the Baltic.<ref name="b781"/>

On 22 October 2024, the Polish Minister of Foreign Affairs, Radosław Sikorski, withdrew consent to the functioning of the Russian consulate in Poznań, citing Russian hybrid warfare targeting Poland and its allies, including cyberattacks and assaults at Poland's eastern border, which is also the border of the Schengen Area.<ref name="h406">{{cite web | last=Jones | first=Seth G. | title=Russia's Shadow War Against the West | website=CSIS | date=20 March 2025 | url=https://www.csis.org/analysis/russias-shadow-war-against-west | access-date=15 April 2025}}</ref><ref name="p668">{{cite web | title=Minister of Foreign Affairs decides to close Russian consulate in Poznań | website=Ministry of Foreign Affairs Republic of Poland | date=22 October 2024 | url=https://www.gov.pl/web/diplomacy/minister-of-foreign-affairs-decides-to-close-russian-consulate-in-poznan | access-date=15 April 2025}}</ref>

In March 2025, UK officials at a Defence Committee evidence session urged for stronger deterrence against hybrid threats, with the Director General of Security Policy at the Ministry of Defence, Paul Wyatt, noting adversaries seeking to do harm in a "manner they judge is below the Article 5 threshold".<ref name="c025">{{cite web | last=Langford | first=Craig | title=UK officials urge stronger deterrence against hybrid threats | website=UK Defence Journal | date=7 April 2025 | url=https://ukdefencejournal.org.uk/uk-officials-urge-stronger-deterrence-against-hybrid-threats/ | access-date=15 April 2025}}</ref>

==Russia's view on hybrid warfare== According to the Institute for the Study of War, Russia defines the concept of hybrid wars precisely as a type of war, rather than a set of means to conduct state policy. The Russian Armed Forces openly discuss ongoing conflicts as hybrid wars, and Russia sees hybrid wars as the future of military development.<ref name="p643"/>

== References == {{reflist}}

Category:Hybrid warfare Category:Russo-Ukrainian war (2022–present) Category:Russian Orthodox Church Outside of Russia Category:Russia–NATO relations