What started with masked soldiers in Crimea and covert proxies in Donbas has evolved into a complex, multi-layered hybrid strategy employed by the Kremlin against the West. Over the past decade, the Kremlin has refined its Soviet-inherited playbook of active measures, combining coordinated campaigns of subversion, sabotage, cyberattacks and disinformation to weaken democratic institutions, undermine public trust, and fracture European and Euro-Atlantic unity. It has stepped up its funding of anti-establishment parties across the EU while deploying covert operatives and disinformation strategies to maximize its reach without triggering open confrontation.
Documented attacks increased fourfold between 2022 and 2023 and threefold in 2024 compared to 2023. In this regard, the Kremlin has increased both the range of targets, from critical infrastructure to transportation hubs, and the tactics used, including explosives and improvised tools. This evident escalation reflects the Kremlin’s shift towards more aggressive and adaptable hybrid disruption tactics, designed to remain just below the threshold of triggering a unified European response.
[...]
Poland, Ukraine’s leading supporter and a central hub for NATO logistics, has become a primary target of the Kremlin’s hybrid attacks against critical infrastructure. One striking example came in May 2025, when Polish authorities confirmed that Russian intelligence was behind the fire that destroyed the large shopping centre in Warsaw the previous year, damaging over 1,400 shops and service outlets.
[...]
Numerous instances of Russian hybrid attacks have been recorded across the Baltic states and Romania. The Kremlin has directed these attacks against critical infrastructure, undersea cables and electoral systems.
[...]
In March 2025, Kremlin-linked agents conducted an arson attack on an IKEA store in Lithuania, along with the Russian sabotage of the Baltic Sea cable system, disrupting the country’s internet connectivity.
[...]
Since 2024, Estonia has seen a notable spike in cyberattacks against critical infrastructure. In particular, there has been an increase in satellite-based cyberattacks, which have disrupted the operations of airport infrastructure. Currently, the country is working actively to track the Kremlin’s “shadow fleet”.
[...]
Romania is one of the recent stark examples of the Kremlin’s application of modern hybrid warfare tools. In December 2024, the country’s constitutional court annulled the 2024 presidential election after the country’s intelligence services confirmed Russian interference via fake social media accounts and cyberattacks on election systems.
[...]
A western response should not remain purely defensive. It has to counter the Kremlin’s hybrid attacks that fall below the threshold of triggering a unified European response and incorporate offensive measures. This way, the West can ensure that the Kremlin is discouraged and, if necessary, respond with targeted retaliatory actions against its covert operations, particularly across the EU member states. Otherwise, the Kremlin will continue leveraging hybrid warfare tools to undermine democracies in the West.