Russia Escalating Hybrid Attacks across Europe

Russian hybrid and sabotage activity is nothing new; asymmetric responses to perceived provocations by Russia’s adversaries date back to at least the Soviet Union, when such tactics were called “active measures.” These tactics differ from conventional, kinetic warfare. They do not involve troops moving across a country’s border or a state’s military dropping bombs on an adversary’s capital city. Instead, they are a complex kit of psychological, cyber, and physical tactics meant to achieve several key aims:

• Test the enemy’s defensive capabilities, as Russia evaluates whether to escalate aggression into a formal, kinetic conflict
• Degrade the enemy’s critical infrastructure
• Sow an environment of fear in the enemy’s government and population to degrade the enemy’s ability to respond

These tactics fall broadly under a strategy Russian military officials in 2013 termed “New Generation Warfare” (NGW). Insikt Group assesses that Russia started using NGW tactics in Ukraine during and after it annexed Crimea in February 2014; however, since Russia’s full-scale invasion of Ukraine in February 2022, Russia has escalated its use of these tactics across Europe, far beyond the former Soviet Union, where Russia historically focused its aggression.

Valeriy Gerasimov, Chief of the General Staff of the Russian Armed Forces
Quoted from the 2013 article in Military-Industrial Kurier, where Gerasimov laid out the New Generation Warfare strategy

Figure 1: On the evening of August 4, 2026, an explosive quadcopter struck the wing near the fuel tank of an Antonov An-124 cargo aircraft in Leipzig, Germany, in what we assess is the first instance in Europe of a sabotage drone carrying military-grade explosives near critical infrastructure (Source: NPR)

Russia Using Varied Tactics, from Arson to Airspace Violations

Russia has used various tactics while employing NGW tactics across Europe, from influence operations to airspace incursions to physical sabotage operations.

Influence Operations: Russia has consistently launched influence operations to manipulate public opinion across Europe, and particularly in states Moscow likely views as Kyiv’s core European supporters: the UK, France, Germany, and Poland. These operations include Doppelgänger, Operation Overload, Operation Undercut, and CopyCop. They have often involved impersonating national and pan-European media outlets to disseminate Kremlin propaganda.

Airspace Incursions: Starting in September 2025, suspected violations of NATO airspace by what are likely Russian drones or jets reached unprecedented levels. Insikt Group tracked 30 such violations between September 2025 and January 2026, compared to 23 suspected or confirmed violations between March 2022 and August 2025. The most commonly targeted countries have been Poland and Romania; however, violations have occurred outside of Russia’s historic sphere of influence, including in Germany, the UK, Denmark, and Norway.

Territorial Waters Violations and Undersea Cable Targeting: Russia has increasingly used violations of NATO territorial waters and targeting of undersea cables to test NATO’s resilience, collect intelligence, and keep NATO in a reactive, defensive posture.

Figure 2: The Polish Government attributed a fire at the Marywilska 44 shopping center in Poland on May 12, 2024, to Russian intelligence services (Source: Reuters)

Physical Sabotage Operations: Russia-nexus individuals and entities have increasingly used physical sabotage operations to degrade critical infrastructure in NATO territory, propagate a narrative that Western states cannot protect their populations from threats, and harm NATO’s ability to collectively respond to Russian aggression. These attacks often target civilian or dual-use critical infrastructure that directly or indirectly supports either European collective defense or Europe’s material support for Ukraine.

Offensive Cyber Operations: Russian cyber activity directed at European targets has typically emphasized access-oriented operations, including attacks on internet-facing firewalls, virtual private networks (VPNs), email services, and web portals. These operations are likely intended to enable intelligence collection, operational reach, and long-term access rather than immediate disruption. Russian cyber activity has been broad in scope, targeting multiple regions and sectors.

Russia Likely to Escalate Aggression in Near-Term, Potentially into Full-Scale NGW Campaign

Insikt Group assesses that Russian hybrid warfare in Europe has thus far been largely opportunistic, despite employing increasingly aggressive tactics. Over the next two years, Russian President Vladimir Putin is likely to escalate aggression across Europe, potentially coalescing the above-described tactics into a full-scale NGW campaign.

Putin likely sees fractured European unity and inconsistent US assistance to European collective defense efforts as offering him a finite window of opportunity prior to the 2028 US Presidential election, which could result in a US President more willing to commit US military and political resources to bolstering Europe’s defensive capabilities.

In contrast to Russia’s current hybrid warfare campaign — which we assess is largely opportunistic — a full-scale NGW campaign is likely to involve more frequent incursions and violations, multiple tactics used concurrently to strain NATO resources, and escalated aggression as detailed in the chart below. Russia would still be unlikely to seek permanent damage to European critical infrastructure or mass civilian harm, as Russia likely does not want to risk invoking NATO’s Article 5 common defense clause.

Indicators of Full-Scale NGW Campaign in Europe, Implications, and Recommendations

About Insikt Group^®

Recorded Future’s Insikt Group, the company’s threat research division, comprises analysts and security researchers with deep government, law enforcement, military, and intelligence agency experience. Its mission is to produce intelligence that reduces risk for customers, enables tangible outcomes, and prevents business disruption.