Russia has used hybrid warfare to foster instability in other countries while avoiding all-out war.
Examples of Russian hybrid warfare include the use of unmarked soldiers, disinformation campaigns, sabotage, cyberwarfare, and fostering illegal immigration. Following the 2022 Russian invasion of Ukraine, reports of Russian hybrid warfare have increased significantly.
2014–2022
Russian hybrid efforts preceding the full-scale 2022 Russian invasion of Ukraine include using soldiers without insignia called "little green men" to annex Crimea in 2014, and the broad disinformation campaigns targeting the 2016 US election and Brexit referendum.
The passage of the Russian Northern Fleet, led by the aircraft carrier Admiral Kutznezov and the battlecruiser cruiser Piotr Veliky, on their way to support Syrian government forces around Aleppo on 21 October 2016 was part of Russia's "Heavy Metal Diplomacy" within the context of hybrid warfare.
2022–present
On 24 February 2022, Russian president Vladimir Putin ordered the beginning of a large-scale invasion of Ukraine. Since then, there have been many incidents in Europe linked to Russian hybrid warfare.
Western sources have accused Russia of being responsible for the Nord Stream pipelines sabotage in September 2022.
In May 2024, the Ministry of Foreign Affairs of Estonia summoned the Russian embassy chief after flights by a Finnish airline to eastern Estonia were paused due to GPS disturbances suspected to be caused by Russia. Since the beginning of the 2022 Russian invasion of Ukraine, almost all airlines flying over the Baltics have experienced navigation problems. Aside from signal jamming, other forms of Russian hybrid aggression against countries like Finland, Poland, and Sweden described are violations of territorial waters and airspace, and encouraging or permitting migrants from third countries to arrive at borders in large numbers through Russia and Belarus.
In October 2024, the head of MI5 Ken McCallum warned that Russian military intelligence were active in a campaign to "generate mayhem" on European and British streets using proxies that "further reduces the professionalism of their operations". The same month, Polish Prime Minister Donald Tusk accused Russia and Belarus of aiding illegal immigration into Europe in an effort to destabilize the European Union.
In October 2025, French intelligence services said that an instance of Holocaust Memorial vandalism committed in May 2024 in Paris by four Bulgarian nationals was linked to a long-term strategy by Russia to use paid proxies to sow division, spread false information and stoke social tensions.
In December 2025, Lithuania declared a state of emergency after several hundred balloons launched from Belarus as part of Russia's hybrid campaign caused both civil aviation disruptions and raised concern over national security, with senior Lithuanian officials reporting that they could be used to probe for air-defence gaps. In January 2026, Lithuanian prosecutors accused six foreign nationals of planning a terrorist attack in September 2024 targeting a private military supplier supporting Ukraine. The prosecutors said that their activities may have been coordinated from Russia by Colombian and Cuban nationals linked with the Russian GRU.
In February 2026, the Swedish Armed Forces identified a drone that was jammed after it was seen near the French aircraft carrier Charles de Gaulle as Russian, saying it had taken off from a nearby Russian spy ship. The carrier was docked in Malmö and due to take part in NATO exercises seen as a response to a long period of Russian hybrid warfare.
In March 2026, Petr Mlejnek, former head of the Security Information Service, said that he suspected Russia of being behind an arson that took place at a Pardubice arms factory.
On 10 August 2026, the Swedish Security Service (SÄPO) said it had shut down a Russian spying operation directed by Russia's Foreign Intelligence Service that had attempted to influence Swedish decision-making as well as discredit Sweden and its allies. SÄPO said that the operation involved three people working under the cover of diplomatic immunity. Also on 10 August, the Russian outlet Proekt reported that at least 21 out of the 117 Russian diplomats working at the Russian embassy in Vienna are linked with Russian intelligence.
On 13 August 2026, Tusk said that a Russian citizen had been detained in Poland after being accused of planning to assassinate a dual US-Ukrainian citizen on behalf of Russian intelligence. Tusk said it was the first case of Russia attacking an American citizen on NATO territory, and described the situation as part of Russia's broader hybrid campaign against western nations supporting Ukraine.
On 25 August 2026, Slovak police said it had arrested three foreign nationals whose identities have not been disclosed over a foiled plan to set a drone manufacturing plant on fire. According to TVP World, concerns were raised over possible Russian involvement due to a series of recent incidents targeting defense companies in Europe.
On 26 August 2026, ABC News reported that it had been told by a U.S. intelligence source that an explosive drone which was found on 5 August near a Ukrainian aircraft at Leipzig/Halle Airport, Germany, was similar to ones typically used by the Russian GRU, both in terms of explosives and the structure of the device. German authorities investigated and formally blamed Russia for the attack.
On 15 September 2026, the United States Department of Justice accused Russian agents of trying to recruit foreigners, including U.S.-based individuals, to assassinate individuals who are perceived to support Ukraine. Five men allegedly connected to Russia's Foreign Intelligence Service were charged with participating in a conspiracy to finance terrorism. On 23 September, the Polish military reported that a Russian military helicopter had violated NATO airspace north of Braniewo, close to Poland's border with the Russian Kaliningrad exclave. Tusk also warned against potential Russian ″hybrid drone and missile strikes″ against Poland and other NATO members, which Russia would portray as accidental.
Baltic underwater cable sabotage
In November 2024, amidst intensifying Russian hybrid warfare efforts in Europe, two Submarine communications cables in the Baltic Sea were damaged in another instance of suspected Russian sabotage. The Chinese-flagged ship Yi Peng 3 was allegedly captained by a Russian as it passed the two cables at approximately the same time as each was cut. The deputy head of NATO's Allied Maritime Command had earlier in the year said that Russia and other malicious actors were targeting the vulnerable and extensive piped and underwater cables connecting Europe's energy and communications networks.
In December 2024, an underwater power cable between Estonia and Finland was damaged on Christmas Day in Finnish waters. Finnish authorities placed a tanker ship named Eagle S at the center of its investigation into the incident being sabotage. The Finnish Customs Service said that the ship is part of the Russian shadow fleet. According to MarineTraffic, the ship was on its way from Saint Petersburg to Egypt, but slowed in the vicinity of the underwater cables. The Finnish Border Guard inspected the ship and said that the ship's anchors were missing, the suspicion being that the ship cut the cables by dragging its anchors over them.
Destabilization and electoral interferrence in Moldova
Use of religious institutions The Russian Orthodox Church has been described as one strand in Russian covert operational activity against European states that support Ukraine. In 2024, the Swedish Security Service concluded that a recently consecrated Russian Orthodox church built in Västerås was linked to Russian intelligence operations, adding that the Putin regime uses the Russian Orthodox Church in Sweden as a platform for such operations. The church is located near critical national infrastructure and an airport used for Swedish military exercises.
In January 2026, according to Swedish media, several churches in Sweden may have been used to host fundraisers linked to the Belarusian St. Elizabeth Monastery, suspected of having ties to Russian military intelligence and supporting Russia's invasion of Ukraine. Women from the convent were allowed to set up a sales table at the parish of Täby with approval from the local priest, and the Church of Sweden later issued an official warning, saying that the collected funds could be used to support Russia's military aggression against Ukraine. The women were dubbed ″Z-nuns″ because of images of them displaying the pro-war Russian ″Z″ symbol, and visiting Russian-occupied territories in Ukraine. The Church of Sweden said that the case fits into a broader Russian pattern of attempting to influence public institutions and religious organizations across Europe, and also noted the Russian Orthodox Church seeking access to premises located near military facilities and airports.
Space and satellite activities European security officials and independent satellite-tracking analysts have reported suspected Russian intelligence operations involving spacecraft conducting close-proximity manoeuvres near European geostationary communications satellites. Since the early 2020s, Russian satellites identified as part of the Russian Luch programme have repeatedly approached and remained near commercial and government satellites serving Europe, the Middle East and Africa. Analysts assess that these manoeuvres are consistent with signals intelligence collection, as the spacecraft position themselves within the transmission beams linking satellites to ground stations.Jones, S.; Hollinger, P.; Bott, I. “Russian spy spacecraft have intercepted Europe’s key satellites, officials believe.” Financial Times, 3 February 2026.
Officials have warned that such activity could expose unencrypted command or telemetry data used by older satellites, potentially enabling future interference. While the Russian spacecraft are not believed to possess the capability to directly disable or destroy satellites, experts caution that the intelligence gathered could support electronic warfare, spoofing of satellite commands, or coordinated cyber and ground-based jamming operations.
In June 2026, Gizmodo said a team of researchers noticed a pattern that had been occurring over the past seven years where a sudden drop in signal strength occurred simultaneously throughout Europe, the team had documented 75 days where this had occurred. After investigating, the researchers traced the disruptions to a constellation of Russian satellites that may be jamming the signals on purpose.
Sabotage and provocation campaign in the UK
In June 2026, the BBC said it had identified evidence that Evgeny Lyukshin, the son of a senior Russian official, had acted as the handler directing crimes in the UK, where individuals were recruited on Telegram to perform criminal acts in exchange for payment. The orders included arson attacks on Prime Minister Keir Starmer's house, for which one Ukrainian national and one Ukrainian-born Romanian national were convicted of conspiring to commit arson. Messages sent by Lyukshin showed him glorifying Vladimir Putin and offering Russian citizenship in return for more attacks.
BBC also said it found that Russian operatives were responsible for setting up fake online UK far-right and Muslim groups, used to organize vandalism and stir up fear and division. Russia-based accounts were used to post lies about the motive for the arson attacks, which were further promoted by far-right figures such as Tommy Robinson.
Cyberattacks on European infrastructure