Russian hybrid warfare in Europe (2022–present)

Since the full-scale invasion of Ukraine in February 2022, European nations have witnessed a significant escalation in covert hostile activities attributed to or suspected to be orchestrated by the Russian Federation. Western intelligence agencies and government officials have described these actions as a coordinated "shadow war" or hybrid warfare campaign.^[1]

While Russia has conducted hostile operations in Europe for many years, the period since 2022 marks a distinct intensification and broadening of these efforts. Earlier incidents were often characterized as specific acts of sabotage, such as the 2014 ammunition depot explosions in the Czech Republic, which Czech authorities later confirmed were carried out by Russia's GRU Unit 29155.^[2] The post-2022 campaign is notable for its wider scope, integrating physical sabotage with large-scale cyberattacks and disinformation in a more cohesive and aggressive hybrid strategy. The campaign aims to destabilize European societies, disrupt military and logistical support for Ukraine, and undermine the continent's political and economic cohesion.

These operations are often executed through proxies, including recruited petty criminals, sympathizers, and sometimes unwitting individuals, who are directed and paid by Russian intelligence services. This approach allows Russia to maintain a degree of plausible deniability while achieving its strategic objectives.

Russian intelligence services employ a wide spectrum of tactics in their European campaign:

• Physical Sabotage: This includes arson attacks on factories, warehouses, and commercial properties, particularly those linked to military aid for Ukraine or with symbolic importance. Operatives have also been accused of plotting to damage military bases and other critical infrastructure.
• Cyberattacks: State-sponsored hacker groups conduct cyber-espionage and disruptive attacks against government networks, railway systems, hospitals, and energy infrastructure. These attacks aim to steal sensitive information and cause widespread disruption.
• Espionage: Traditional espionage continues, with intelligence operatives gathering information, monitoring exiled Russian dissidents, and recruiting agents. Several spy rings have been uncovered and dismantled across Europe.
• Disinformation and Influence Operations: Russia has invested heavily in sophisticated disinformation campaigns, such as the "Doppelgänger" network, which creates fake versions of mainstream European news outlets to spread pro-Kremlin propaganda. These operations seek to polarize societies, influence elections, and erode public trust in democratic institutions.
• Proxy Recruitment: A key tactic is the use of non-Russian nationals, often recruited online via platforms like Telegram and paid in cryptocurrency. These recruits are tasked with carrying out attacks, providing a layer of separation from the Kremlin.^[3]

The following is a list of notable confirmed and suspected incidents of Russian hybrid warfare in Europe since the 2022 invasion. "Confirmed" incidents are those where arrests have been made, charges have been filed, or official government statements have directly attributed the act to Russian intelligence with a high degree of certainty. "Suspected" incidents are those where high-level officials have publicly accused Russia, but investigations are ongoing or direct proof has not been made public.

Attributing these acts of hybrid warfare is a significant challenge for European security services. Russia systematically denies its involvement, and the use of proxies and cyber tools that obscure origins complicates the process of gathering definitive evidence. The GRU is frequently identified by Western intelligence agencies as the primary orchestrator of the more aggressive physical sabotage operations.^[16]

The strategic goals of this campaign appear to be multi-faceted:

• Disrupting Aid to Ukraine: A primary objective is to hinder the flow of weapons, ammunition, and other forms of aid from European countries to Ukraine by targeting supply chains, factories, and transportation infrastructure.
• Sowing Instability: By creating a climate of fear, confusion, and distrust, Russia aims to weaken European unity and resolve. Incidents are designed to make European citizens feel unsafe and to pressure their governments to reduce their support for Ukraine.
• Testing Western Responses: These low-level, deniable attacks allow Russia to gauge NATO's and the EU's reaction times, intelligence capabilities, and political will to respond, without crossing the threshold into overt military confrontation.

European nations and NATO have responded to this "shadow war" by:

• Increasing Intelligence Sharing: Enhanced cooperation between national security services to track and counter Russian operations.
• Boosting Security at Critical Sites: Heightened security measures at military bases, ports, energy facilities, and other critical infrastructure.
• Law Enforcement Action: Arresting and prosecuting individuals involved in sabotage and espionage rings.
• Sanctions: Imposing sanctions on individuals and entities linked to these hostile activities.
• Public Awareness: Officials are increasingly speaking out publicly to attribute these acts to Russia and to raise public awareness of the hybrid threat.^[1]

The campaign has significantly raised tensions between Russia and the West, contributing to a volatile and unpredictable security environment in Europe. It underscores the evolving nature of modern conflict, where the lines between peace and war are increasingly blurred.

• Cyberwarfare by Russia
• Foundations of Geopolitics
• Russian interference in United States elections
• List of cyberattacks
• 2014 Vrbětice ammunition warehouse explosions