Not Yet War, but Peace Long Gone: Russia’s Hybrid Attacks Against Europe and European Response Options

By Mikhail A. Polianskii

In November 2025, British and Norwegian patrols once again tracked the Yantar’(Янтарь), a Russian Ministry of Defence ‘research vessel’ which has long been suspected of mapping undersea cables carrying Europe's financial transactions and military communications. For years, the ship has sailed from the Kola Peninsula along Norway’s coast and up the east coast of North America, quietly mapping critical NATO infrastructure.

Yet chances are you have never heard of the Yantar or other similar Russian reconnaissance ships, since there have been no explosions or other incidents that have made the headlines involving them. Since they are sailing in international waters, there is little that the Western powers can legally do to prevent such activities (except announce military drills and force the ship to leave the area immediately, which they rarely do).

Against the backdrop of the largest conventional war in Europe since 1945, Russia’s grey zone activities are increasingly organised around the accumulation of thousands of small and deniable actions that seem manageable or even harmless individually, but which collectively erode the foundations of European security in the long term. As this think piece demonstrates, regardless of how the war in Ukraine ends, this shadow war is unlikely to stop. The central question that policymakers should thus grapple with is not only how to end the current conventional war, but also how it might continue and how best to prepare for what comes next.

Two Stories

In the years following 2022, some Western policymakers viewed Russia’s hybrid attacks as a wartime phenomenon that would diminish once hostilities ceased. However, this assumption is no longer supported by the available evidence. For example, a Soufan Center study of 255 hybrid incidents across six European states since the invasion found that Russian activity did not subside, but rather intensified, even despite Trump’s renewed attempts to negotiate a settlement in 2025. Alongside the increased bombing of Ukrainian cities, Russian hybrid warfare has also escalated to include the use of drones over military bases and airports and bombs on cargo planes.

Today, no one in Brussels or Berlin disputes that Russia is waging war on Europe in some form anymore. Yet there are still open questions as to what these activities are for and what long-term goals Moscow is pursuing. Two theses currently dominate this debate.

The first is that Russian grey zone attacks are a form of military pre-positioning for a larger-scale war against NATO countries. The choice of targets (energy grids, cables, ports and GPS systems), as well as the clustering of hybrid incidents in potential frontline states such as Poland, the Baltic States and Finland, serve as strong indicators of potential military preparation. Read alongside Russian military writings on nontraditional or ‘new-generation’ warfare, in which non-military tools often precede open conflict, the situation increasingly starts looking like a pre-battle reconnaissance. In short, once Russia’s forces have recovered from the war in Ukraine (or potentially even in parallel), the argument goes, hybrid campaigns will escalate and conventional conflict will follow, as occurred before the invasion of Ukraine in winter 2021-2022.

A second, widely held thesis challenges this logic, arguing that Russia’s hybrid attacks in Europe are not a prelude to a larger conflict, but the conflict itself. Russia’s conventional inferiority against NATO countries (even without the USA) makes the persistence of grey zone operations a rational long-term strategy. Moscow’s grey zone operations are cheaper and growing increasingly potent, making them unlikely to trigger Article 5 or the EU's Article 42. Furthermore, some of the hybrid tactics, such as disinformation and cyber campaigns, have already demonstrated their effectiveness in undermining European defences. Therefore, Putin, who is generally risk-averse, the supporters of this view argue, would see no need to escalate conventionally and would instead continue increasing the hybrid pressure in Europe.

Why The Binary Misleads

Although the two sides of the debate are not strictly mutually exclusive, closer examination reveals the deficiencies of both. If we take the ‘war preparation’ thesis at face value, it struggles to explain why the Russian leadership has time and again resorted to military provocations such as drone overflights into Poland and Romania. If war preparation was indeed the dominant logic, these reckless actions seem counterintuitive. They make Western powers more alert and willing to invest in common defences, which would make a future attack on Europe more costly for Moscow.

The second 'hybrid war' thesis, in turn, cannot explain why hybrid pressure focuses so heavily on potential frontline states rather than spreading more evenly across Europe. A pure hybrid warfare strategy would exploit vulnerabilities more evenly and not predominantly in Eastern Europe. Not to mention the general questionability of the long-term strategic effects of disinformation and other hybrid attacks on target countries' political decisions, whose cumulative effects remain heavily debated in academic and policy circles.

Most importantly, both sides of the debate assume that Russian hybrid strategy is a coherent plan waiting to be decoded. However, given the paranoid nature of the Russian security state, which is often characterized as a competitive ecosystem of rival services, many pundits doubt the existence of such a unified blueprint. It is possible that both aforementioned logics coexist within competing Kremlin “towers”, each pushing their own vision of how confrontation with the West should unfold.

Acting Under Ambiguity

If this analysis proves accurate, the good news for the European powers is that they do not need to know Moscow's intentions for certain before preparing for the next step. Rather than asking what Putin might be up to, it can prove to be more productive to adopt countermeasures based on already observable effects of Russian operations. For now, these activities i) collect intelligence, ii) test response times, iii) map infrastructure, and iv) build agent networks. Many operations may accomplish several of these objectives simultaneously, creating both immediate pressure and future options, regardless of who in Moscow ordered them or why.

This does not mean that intent is irrelevant. This think-piece merely argues that European powers should adopt measures appropriate both for conventional warfare and escalating hybrid warfare. These measures should provide the necessary degree of deterrence without offering Russia a pretext for further escalation. However, if stronger evidence of Russia’s preparation for conventional attacks emerges, priorities and posture must be adapted accordingly

Policy Recommendations

Below are four “no-regrets” measures that European powers can adopt regardless of whether Russia is preparing for a conventional war or a hybrid escalation.

The first one is to disrupt the criminal-proxy layer since the sharp rise in criminal intermediaries in Russian operations in Europe is the fastest-growing vulnerability, as revealed by numerous investigations. Recruitment and payment increasingly run through encrypted channels, and execution is carried out by “disposable agents” (often associated with organised crime) who absorb the legal risk while Moscow remains one step removed. Disrupting recruitment pipelines, payment rails, and cross-border logistics networks would strip Moscow of its often-assumed deniability. This can be done at comparatively low political cost.

A second priority is denying benefits without mirroring the attacker’s tools. For instance, rather than launching hack-back operations that imitate authoritarian techniques, states can directly target the attackers’ infrastructure. A useful precedent is the U.S. response to the Colonial Pipeline ransomware attack, in which investigators froze the hackers' cryptocurrency wallets and recovered a substantial portion of the ransom. This approach increased the cost of the attack without drawing the West into the attackers' preferred domain of cyber conflict.

Third, a fix built specifically for each structural weakness and domain (cyber, disinformation, sabotage) is needed. The fragmented reporting across agencies and countries should give way to a shared operating picture. Also, there is also a need for a graduated attribution process (as opposed to all or nothing approach that current persist) that can escalate from private warnings to public naming as evidence accumulates. Germany's newly established Joint Center for Countering Hybrid Threats (GAZ) and its Drone Defense Center (GDAZ) could offer a working model. Both are empowered to collect intelligence, issue public judgments, and recommend proportionate countermeasures. Scaling this approach to the EU level with shared assessments and agreed-upon response triggers can close many of the gaps that fragmentation currently leaves open.

Finally, infrastructure must be designed to be resilient from the beginning rather than having resilience added on later. This means embedding sensors and redundancy into cables, wind farms, and pipelines from the outset. This approach must be backed by dedicated repair capacity and regular exercises that test how quickly damage can be found and fixed. Complete invulnerability should and cannot be the goal because no European state can defend everything at once. A more realistic aim is to enable the ability to reroute around damage and provide decision-makers with viable options when disruption occurs, which can significantly alter the cost calculation of attackers in the first place.

Conclusion

The question of whether Russia is planning to provoke European NATO countries is once again being actively discussed in expert and intelligence circles. However, this question is less decisive than it appears when it comes to responding to hybrid attacks. Hybrid warfare is here to stay and will most likely escalate regardless.

Therefore, it is crucial to review how European states will upgrade their deterrence capabilities in the coming years. Taken together, Europe still has the upper hand over Russia in technological and industrial capacity, a lead that is now further reinforced by the 5% pledge. However, precisely because NATO retains the conventional advantage, Russia has invested so heavily in grey zone capabilities, where the balance of power is less clear. Treating hybrid defense as a secondary addition to traditional force planning could be detrimental to the overall deterrence posture against Moscow. Within the five percent framework, investment in hybrid defense should no longer be the residual category within the 1.5 percent allocated for military infrastructure. Going forward, it should be set as the minimum. One euro spent on hybrid defences may now influence Russian calculations as much as one euro spent on a tank or howitzer.

The peace that Europe knew before 2022 is not coming back. The real choice is whether Europeans will treat Russian hybrid attacks as background noise or as the terrain on which the European security order is already being written.

Bio: Dr. Mikhail Polianskii is a postdoctoral researcher in the International Institutions Department at the Peace Research Institute Frankfurt (PRIF). He specialises in Russian politics, foreign policy, hybrid warfare and European security. He has published in leading journals such as Contemporary Security Policy, and has held visiting positions at Carleton University and the Berlin Center for Cold War Studies.