Russian Hybrid War on Europe
From Assassinations to Cyber-attacks
18 June 2026
Russia is waging hybrid war on Europe: attacks that do not count as formal acts of war.
On 15 June 2026, a 2nd assassination was added to the total, as a caricature artist from Russia was shot in Poland.
In 2024, a Russian helicopter pilot who defected to Ukraine was killed in Spain.
6 key aspects of Russian hybrid operations:
Plausible deniability: hybrid attacks are hard to attribute to a specific country because of their indirect nature, keeping political costs low.
Use of proxies: Russian intelligence sometimes hires local, financially vulnerable people (who may not know they are working for Russia) through messaging apps.
Limited deterrence: Europe's response has been mainly defensive, with new naval patrols and higher defence spending; attacks have continued into 2026 at a slower rate than during the 2024 peak.
Cost asymmetry: the attacks are cheap to launch but expensive to counter; intercepting cheap drones requires multiple fighter jets and expensive rockets; repairs to one damaged undersea cable cost $60M.
Geographic spread: more than 20 European countries have been hit, with Germany the most affected at 28 recorded incidents, ahead of France and Poland at 22 each.
Extension of the Ukraine front: some attacks target infrastructure related to supplying weapons to Ukraine, or focus on reducing European support for Ukraine with disinformation and other means.
What were the attacks?
128 separate Russian operations against Europe were reported between 2022 and 2025, peaking at 61 in 2024 before falling to 34 in 2025.
This does not include drone incursions.
Sabotage: damaging physical infrastructure, from railways to parcel depots, or disrupting its work.
In November 2025, an explosive device damaged a railway in Poland used to move military aid to Ukraine.
Arson destroyed a shopping centre in Poland in May 2024, and a store in Lithuania was set alight by recruits offered 10,000 euros and a used car.
Incendiary devices hidden in parcels caught fire at DHL delivery hubs in Germany and the UK in July 2024, part of a Russian test run for attacks on cargo flights.
Airspace violations: drones or jets entering a country's airspace without permission.
In September 2025, around 20 Russian drones entered Polish airspace from Belarus, and NATO fighters shot down at least 3.
Days later, 3 Russian jets entered Estonian airspace and stayed for 12 minutes.
Influence operations: shaping public opinion and elections through false information and targeted funding.
In Moldova's October 2024 presidential election and EU membership referendum, Russia used vote-buying and false information to support pro-Russian candidates.
Electronic warfare: disrupting (jamming) or faking (spoofing) a signal, such as GPS location.
Russian jamming of satellite navigation used by aircraft affected 123,000 flights over the Baltic in the first 4 months of 2025.
Russian shadow fleet ships use spoofing to hide their true location.
Undersea damage: cutting or breaking the seabed cables and pipelines that carry data, electricity or energy sources.
Undersea cables carry about 99% of intercontinental data.
In December 2024, a tanker from Russia's shadow fleet (older ships with hidden owners used to evade oil sanctions) damaged a power cable between Finland and Estonia.
Weaponised migration: directing migrants towards a border to pressure a neighbouring state.
In 2021 and 2022, Belarus directed thousands of refugees to the EU border; Poland, Lithuania and Latvia responded by building border fences.
Cyber-attacks: targeting computer systems and networks.
Russia-linked groups carried out 39% of state-backed attacks against EU public administration between mid-2024 and mid-2025.
India was 2nd with 32%; China followed with 24%.
In December 2025, a Russia-linked cyber-attack targeted Poland's power grid.
The attack was stopped before a widespread power outage, but hackers gained access to some key systems and destroyed some valuable equipment.
Assassinations: killing or attempting to kill specific people.
In February 2024, a Russian defector to Ukraine was killed in Spain.
The same year, German authorities uncovered a plot to kill the head of Rheinmetall, the 5th largest European weapons company.
On 15 June 2026, a Russian caricature artist who mocked and criticised Vladimir Putin and other figures was shot dead in Poland.
Influence operations and sabotage are the largest categories of hybrid operations, at 30 reported events each.