Russian Hybrid Warfare: Rising Threats & New Tactics

Russia is actively rebuilding its hybrid attack capabilities in Europe, employing new tactics including the recruitment of individuals with criminal backgrounds and through social media, according to researchers at the International Center for Defense and Security.

Russia Rebuilding Hybrid Attack Capabilities

Russia’s hybrid attack capabilities suffered a setback in 2022 with the expulsion of spies operating under diplomatic cover from European countries. Researchers say Moscow is now actively rebuilding this capacity.

“Russia is now recruiting people with criminal backgrounds as well as ordinary people on social media,” said Marek Kohv, a research fellow at the International Center for Defense and Security.

Kohv noted that damage caused by these recruited individuals can be greater than that inflicted by traditional spies. “These people generally lack specialized training in firearms or explosives. When people without knowledge of explosives set fire to certain targets, the damage to civilians — casualties and injuries — can be significantly higher,” he said.

Attribution and legal proceedings related to these attacks can be complex, as recruited individuals often do not realize they are working for Russian intelligence services. “Very, very often these recruited individuals do not actually know they’re working for Russian intelligence services, and in such cases a trial can be more complicated because it might not be possible to prove a direct connection with Russian special services,” Kohv explained.

Estonia has recently updated its legislation to address this evolving threat. The law within the Internal Security Service’s area of responsibility has been changed to allow punishment for the intent to cooperate with Russian intelligence services, even without proof of actual cooperation.

Increased Attacks Expected

Igor Gretskiy, another research fellow at the International Center for Defense and Security, predicts Russia will intensify its hybrid attacks in the coming year, aiming to stir up conflict and division in countries supporting Ukraine.

Gretskiy noted a shift in threat perception among European countries. “At the beginning of the year, it would have been unthinkable for someone to suggest shooting down aircraft violating a country’s airspace. Now, that is no longer off the table,” he said.

He believes Russia exploits fears of escalation, given its status as a nuclear power. “Putin is clearly aware of this and exploits it. That is why he keeps raising the stakes. I predict that next year we’ll hear more nuclear blackmail messages from Russia. Russian authorities have always done this in extreme situations, trying to seize the initiative,” Gretskiy outlined.

Kohv also highlighted reports of Russia monitoring and mapping critical infrastructure sites in Europe, drawing parallels to Cold War-era Soviet sabotage doctrine, including railways and bridges.

To protect underwater infrastructure, Kohv stressed the need to update international agreements and enhance cooperation, noting that the current legal framework governing international waters is outdated. He also emphasized the importance of synchronization and revision of laws among Baltic Sea countries, as well as close cooperation on physical response measures.

Kaupo Rosin, head of Estonia’s Foreign Intelligence Service, stated earlier this week that Russia is not currently planning to attack the Baltic states, and that NATO’s countermeasures have been effective.