Mastering the hybrid warfare toolkit from 2014
What started with masked soldiers in Crimea and covert proxies in Donbas has evolved into a complex, multi-layered hybrid strategy employed by the Kremlin against the West. Over the past decade, the Kremlin has refined its Soviet-inherited playbook of active measures, combining coordinated campaigns of subversion, sabotage, cyberattacks and disinformation to weaken democratic institutions, undermine public trust, and fracture European and Euro-Atlantic unity. It has stepped up its funding of anti-establishment parties across the EU while deploying covert operatives and disinformation strategies to maximize its scope without triggering open confrontation.
Documented attacks increased fourfold between 2022 and 2023 and threefold in 2024 compared to 2023. In this regard, the Kremlin has increased both the scope of targets, from critical infrastructure to transportation hubs, and the tactics used, including explosives and improvised tools. This evident escalation reflects the Kremlin’s shift towards more aggressive and adaptable hybrid disruption tactics, designed to stay just below the threshold of triggering a unified European response.
In early 2025, hybrid attacks have continued at pace, affecting multiple EU associate states. In May alone, plots uncovered in Poland, the Baltic states and Romania underscored how the Kremlin continues to operate across NATO’s east Flank. These hybrid incidents reflect a broader, decentralized strategy to undermine cohesion within both the EU and NATO.
Accelerating pace of hybrid attacks against NATO’s east Flank since 2024
In particular, NATO’s east Flank has come under an unprecedented wave of Russian hybrid attacks, with the Kremlin leveraging sabotage, disinformation and cyber instruments to undermine democratic institutions and disrupt critical infrastructure.
Poland, Ukraine’s leading supporter and a central hub for NATO logistics, has become a primary mark of the Kremlin’s hybrid attacks against critical infrastructure. 1 striking example came in May 2025, erstwhile Polish authorities confirmed that Russian intelligence was behind the fire that destroyed the large buying centre in Warsaw the erstwhile year, damaging over 1,400 shops and service outlets. In response, Radoslaw Sikorski, the Polish abroad minister, announced the closure of the Russian consulate in Krakow and warned of further action if specified attacks persist. In 2025, the trend has escalated, with Krzysztof Gawkowski, the Polish digital affairs minister, late warning of an unprecedented effort to interfere in the country’s presidential election that was scheduled for May 18th. Cyberattacks in Poland more than doubled compared to the erstwhile year. These targeted incidents, which include hybrid attacks against water systems, as well as energy and government facilities, form part of a broader run to paralyse the functioning of EU associate states, peculiarly those with a strong anti-Russian stance.
Poland has not been the only mark on NATO’s east Flank. Since 2024, many instances of Russian hybrid attacks have been recorded across the Baltic states and Romania. The Kremlin has directed these attacks against critical infrastructure, undersea cables and electoral systems, all while conducting well-coordinated disinformation campaigns.
In May 2025, Latvian authorities issued a informing about Russian agents gathering intelligence on critical infrastructure assets under the guise of tourists. In turn, in March 2025, Kremlin-linked agents conducted an arson attack on an IKEA store in Lithuania, along with the Russian sabotage of the Baltic Sea cable system, disrupting the country’s net connectivity.
Since 2024, Estonia has seen a notable spike in cyberattacks against critical infrastructure. In particular, there has been an increase in satellite-based cyberattacks, which have disrupted the operations of airport infrastructure. Currently, the country is working actively to track the Kremlin’s “shadow fleet”, which has increased its activities over the last year and poses crucial safety and environmental challenges to Estonia and the Baltic region.
At the same time, Romania is 1 of the fresh stark examples of the Kremlin’s application of modern hybrid warfare tools. In December 2024, the country’s constitutional court annulled the 2024 presidential election after the country’s intelligence services confirmed Russian interference via fake social media accounts and cyberattacks on election systems. The Kremlin’s application of hybrid tools persisted into 2025, with evidence existing of pro-Russian hacker groups launching coordinated cyberattacks targeting the country’s abroad ministry, constitutional court, and presidential run websites to undermine the democratic process in the country.
Collectively, these incidents confirm that Russia is applying a coordinated hybrid warfare playbook across NATO’s east Flank to paralyse democratic processes and undermine the resilience of its critical infrastructure.
A call to action to counter the Kremlin’s hybrid war
To respond effectively, the West must treat these operations as a direct assault on democratic resilience and economical stability. The Kremlin’s evolving, multi-layered strategy combines subversion, sabotage, cyberattacks and disinformation to undermine the West. Its actions across NATO’s east Flank show a deliberate and well-coordinated approach that demands more than isolated national responses or reactive crisis management. While NATO (e.g., the Joint Intelligence and safety Division) and EU (e.g., the East StratCom Task Force) structures be to counter hybrid threats, fragmented mandates and limited coordination proceed to pose crucial challenges.
NATO and the EU should step up their efforts to counter Russian hybrid attacks, not just by undertaking resilience measures but besides by exerting proactive, targeted force against Russia to rise the costs of continued attacks. This approach should include expanded sanctions targeting the Kremlin’s shadow fleet and key exports, as well as offensive cyber operations against critical Russian infrastructure. Additionally, strategical information campaigns targeted at the Russian population should besides challenge the Kremlin’s narratives and undermine its home influence.
A western consequence should not stay purely defensive. It has to counter the Kremlin’s hybrid attacks that fall below the threshold of triggering a unified European consequence and incorporate offensive measures. This way, the West can guarantee that the Kremlin is discouraged and, if necessary, respond with targeted retaliatory actions against its covert operations, peculiarly across the EU associate states. Otherwise, the Kremlin will proceed leveraging hybrid warfare tools to undermine democracies in the West.
Maksym Beznosiuk is simply a strategical policy expert and manager of UAinFocus, an independent platform connecting Ukrainian and global experts around key issues in the country. His work spans EU–Ukraine cooperation, energy and natural materials policy, governance in conflict-affected regions, and the security-policy nexus. He holds an LL.M. in Global Environment and Climate Change Law from the University of Edinburgh, a Double Master’s in European Studies (Euroculture) from Uppsala and Jagiellonian universities, and Bachelor and Specialist degrees in global Law and global Relations from Kyiv National Taras Shevchenko University.
Please support New east Europe's crowdfunding campaign. Donate by clicking on the button below.
