RUSSIA is intensifying hybrid operations against European countries supporting Ukraine, combining cyber sabotage, disinformation, drone activity and other physical threats. Recorded Future’s Insikt Group said the activity is designed to test defences, disrupt critical infrastructure and create fear without becoming a conventional military invasion.
Reported examples include attacks on water and wastewater systems in Norway and Poland, energy infrastructure incidents in Poland, drones near Estonia and Romania, and alleged attempts to damage cargo infrastructure at a German airport. Romanian authorities reportedly destroyed a Russian drone near the Neptun Deep offshore gas project after determining that it threatened energy infrastructure and tested NATO’s maritime response.
The influence campaign has included Russia’s CopyCop network impersonating European news and fact-checking organisations, reportedly using AI-generated text and voice. Recorded Future analyst Chelsea Cederbaum said organisations closest to providing material support for Ukraine face the greatest risk, including logistics companies, dual-use businesses and manufacturers of subsea cable repair equipment, marine navigation systems and industrial defence systems.
Viakoo’s John Gallagher warned that Russia could eventually coordinate cyber-physical attacks, system takeovers, deepfakes and corrupted data, although the components currently operate largely independently.
Insikt Group assesses that Russian activity, much of it opportunistic so far, could escalate over the next two years into a broader “New Generation Warfare” campaign involving simultaneous tactics and more frequent incursions. For cyber sabotage, the report identifies internet-facing firewalls, VPNs, email services and web portals as recurring access points, and recommends phishing-resistant multifactor authentication.