From Russia With Love: The Scale of Russia’s Hybrid Warfare Against the EU

Samuele Quarantini
10 hours ago
7 min read

In recent months, the so-called “Russian Hybrid Warfare” has become increasingly popular in the headlines of newspapers and in the speeches of European leaders, mostly due to the growing number of NATO airspace violations by Russia. German Chancellor Friedrich Merz said that, when it comes to Russia, “we are not at war, but we are no longer at peace either.” Eliza Manningham-Buller, the former head of British intelligence, reflected that it “may be right [to say] we’re already at war with Russia.” In a recent interview with the Financial Times, Danish PM Mette Frederiksen commented on the drones incursions into Danish airspace saying “we need all Europeans to understand what is at stake and what’s going on. When there are drones or cyber attacks, the idea is to divide us”.

Finally, the air in Brussels has changed, as the winds of war have penetrated the institutions of the EU and NATO. In her State of the Union on 10 September, Commission President Ursula von der Leyen said “Europe is in a fight” and warned that “Battle lines for a new world order based on power are being drawn right now.”, urging Europe to defend its values and for the right to choose its destiny, she said.

Although many diplomats consider these statements as a wake-up call for Europe, Russian Hybrid Warfare didn’t start today and it’s definitely much more complex than a few NATO airspace violations. As Frederiksen explained, it is “drones one day, cyber attacks the next day, sabotage on the third day.” The Russian term “Гибридная война” or gibridnaya voyna (hybrid war) describes a state effort that blends non-military means with military force, a ratio outlined by Russian Chief of the General Staff Valery Gerasimov.

The First Layer: NATO Airspace Violations

First of all, as mentioned above, the tip of the iceberg of Russia’s Hybrid War is the latest wave of unknown drones and Russian fighter jets into Eastern European countries’ airspaces, which increased in a Wagnerian crescendo since September 2025. It all began on September 9^th, when over 20 Russian drones breached Polish airspace, forcing airport closures and prompting Warsaw to invoke Article 4 of the NATO Treaty. Similar incidents followed: Russian jets crossed into Estonian airspace, drones entered Romania and Poland again, and unidentified aircraft were spotted over Denmark and Estonia. Even Lithuania reported brief intrusions by Russian fighters coming from the exclave of Kaliningrad. Regarding Moscow’s strategic intentions, there is an ongoing debate among experts about the objective of those incursions.

Some argue that these moves reflect weakness rather than strength, as Putin appears to be using drones and jets to pressure the EU and its military aid to Ukraine—support that has been crucial to Kyiv’s war efforts. This is particularly notable given that Ukraine has managed to hit nearly half of Russia’s oil refineries with missiles and drones, while EU sanctions continue to squeeze the Russian economy. Others claim that the aim is to test NATO’s response and sow division within the alliance over how to best address the attacks.

As for the possible countermoves, one option is to provide Ukraine with more intelligence and weaponry to target the Russian bases launching such drone attacks. Another is to redirect a share of frozen Russian assets toward supporting Ukraine’s defense. A third approach would be for European and NATO officials to begin coordinated discussions on joint air defense coordination, as Ukrainian President Volodymyr Zelensky has urged. What is clear, though, is that we Europeans “only start organizing ourselves when we are threatened,” said an EU official to The Economist.

The Second Layer: Russia’s Sabotage Operations and Criminal Networks Targeting the EU

The second layer of the Russian Hybrid Warfare consists of the series of sabotage operations against European critical infrastructure (ECI) orchestrated by the Russian secret services via criminal proxies. According to a recent paper by the International Institute of Strategic Studies (IISS), Russian sabotage of ECI increased 246% from 2023 to 2024. This sharp escalation aligns closely with the Western removal of restrictions on Ukraine’s use of advanced Western weapons, particularly long-range systems used to strike inside Russia.

Although kinetic attacks have surged, this appears at odds with the mass expulsion of 400 Russian intelligence officers in 2022, a discrepancy that can be explained by Moscow’s change in the recruitment strategy. GRU Unit 29155, Russia’s military intelligence sabotage unit, started recruiting low-level criminals, migrants, or extremists via Telegram or other social media channels. It assigns simple, deniable tasks like vandalism, arson, planting cameras near rail lines, and similar acts. These operations are cheap, scalable, and hard to trace, though often ineffective. A few outliers, most notably the attempted assassination of Rheinmetall CEO Armin Papperger, point to a more aggressive turn. These types of operations, which don’t fit into the traditional espionage scheme, have been analyzed in a second paper published by the International Center for Counter-Terrorism (ICCT) & GLOBSEC, providing more data on their scale.

The report identifies 131 individuals residing in Europe and involved in such activities between 01/01/2022 and 31/07/2025, of whom at least 35 had previous criminal involvement. Of 131 perpetrators identified, 62% carried out multiple attacks, and 89% acted in groups of at least two. 93% of perpetrators were male, 30 years old on average, coming from a post-soviet country, motivated by financial compensation. Only 58% of them were aware that their activities were directed by Russian services. In cases where recruitment pathways could be established, online recruitment accounted for 55% of incidents, with Telegram involved in 88% of those cases. These new tactics show how the espionage world is rapidly evolving, as Europol said, “Geopolitical tensions have created a window for hybrid threat actors to exploit criminal networks as tools of interference, while rapid technological advancements, especially in artificial intelligence (AI), are reshaping how crime is organized, executed, and concealed."

*Figure 1: Methods of Russian hybrid-warfare activity across Europe, January 2018–June 2025 | The International Institute for Strategic Studies (IISS)*

*Figure 2: Incidents of Russian kinetic activities by type, 01/01/2022 - 31/07/2025 | International Centre for Counter-Terrorism (ICCT) & GLOBSEC*

The Third Layer: Russia’s Influence in European Elections and Media

Finally, the third and most hidden layer of Russian Hybrid Warfare consists of all the cyberattack operations and disinformation campaigns through social media and political corruption.

Russia is a well known player in the field of Foreign Information Manipulation and Interference (FIMI). In fact, as a report from the European External Action Service (EEAS) analyzed, “Russia’s approach to the weaponization of information to advance its geopolitical objectives is complex, long-term, and employs both state and non-state structures. The concept of ‘information confrontation’ (Информационное противоборство) is central to Russian doctrine, where information is both the weapon and the environment.” The operational pattern is as follows: setting up the FIMI infrastructure well in advance, attacks on the democratic process, cyber-enabled interference, a surge in activity just before the vote, and post-election efforts to undermine trust in the results. A few notable examples include: the Slovak parliamentary elections of 2023, the European elections of 2024, the Georgian parliamentary elections of 2024, the Romanian presidential elections of 2024-25, and the Moldovan parliamentary elections of 2025.

The Moldovan elections, in particular, showed Russia’s modus operandi perfectly. Măriuța Nistor and Natalia Zaharescu, two investigative journalists working for the Moldovan independent newspaper Ziarul de Gardă, won the European Press Price 2025 with their article “Serving Moscow”. Under false identities, they infiltrated the network, attended protests and political meetings, and documented how money, propaganda, and instructions moved from Moscow through local intermediaries to Moldovan citizens. They revealed that participants were paid via Russian state bank accounts (Promsvyazbank in particular, a state-owned Russian bank from Moscow) to vote against the EU integration referendum and for pro-Russian presidential candidates, while spreading anti-EU and pro-Russia disinformation through Telegram and local street activism. Russian FIMI through social media is then followed by actual political corruption and ties with Europe’s populist parties.

In 2022, a senior Biden administration official who spoke to reporters on condition of anonymity, said that Russia sent more than $300 million to foreign political parties, officials and politicians in more than two dozen countries since 2014. Similarly, in 2019, the Austrian newspaper Der Spiegel published a video from 2017 showing far-right leader Heinz-Christian Strache discussing election campaign funding and media support with the supposed niece of a Russian oligarch in exchange for public contracts, an affair that led to the government’s collapse, Strache’s resignation as vice-chancellor, and new elections.

Thuringia’s Interior Minister Georg Maier and Bundestag oversight chair Mark Henrichmann accused AfD of serving Kremlin interests by using parliamentary inquiries to collect sensitive data, citing the party’s detailed requests, ties to pro-Russian figures, and intelligence warnings of Moscow’s influence. Other European parties accused (some proven, some not) of receiving funding or having ties with the Kremlin are: UKIP (United Kingdom), Jobbik (Hungary), Rassemblement national (France), Lega (Italy), Movimento 5 Stelle (Italy).

This brief analysis shows how the EU might not be at war with Russia yet, but Russia is definitely at war with the EU now. However, it’s not a conventional war. In 1940, Churchill said “We shall fight on the beaches, we shall fight on the landing grounds, we shall fight in the fields and in the streets, we shall fight in the hills.” In 2025, perhaps Europe shall fight in the Telegram chats, counterintelligence, suspect financial channels and money flows, counterterrorism and drone defense.