As the war in Ukraine continues to dominate headlines, a more insidious conflict is unfolding across the globe. This one fought not with tanks and missiles, but with Russian malware, disinformation, and deep-cover spies (1, 2). This sophisticated blend of espionage, cyberattacks, spreading disinformation and sabotage is collectively known as hybrid warfare, orchestrated by Russian intelligence agencies such as the GRU and FSB (1, 3). Russian hybrid warfare is reshaping the nature of modern conflict, blurring the boundaries between war and peace, and extending the battlefield deep into (Western) democracies (4). As the number and intensity of these operations surge, understanding their scope and impact is crucial for governments, businesses, and citizens worldwide. Ultimately, this is not just a strategic or military dilemma, but a test of democratic resilience, demanding coordinated, civilian and institutional responses.

The anatomy of Russian hybrid warfare

According to Frank Hoffman’s concept of ‘tailored’ hybrid warfare, Russia deliberately blends conventional military force with irregular tactics, cyber intrusions, disinformation, and sabotage to achieve strategic, political goals (5). Hoffman is a former U.S. Reserve Marine Officer and Senior Research Fellow at the National Defense University's Center for Strategic Research (6). By employing this 'tailored' approach, as Frank Hoffman describes, Russia seeks plausible deniability, avoids direct military confrontation with NATO and Western powers, and projects power while disrupting opponents beyond conventional battlefields (7).

Cyber warfare is central to this strategy. Russian state-sponsored hacking groups like Fancy Bear (GRU Unit 26165) have carried out extensive operations targeting defense, transportation, and technology firms, particularly those aiding Ukraine (8). These attacks employ spear-phishing, malware, and the exploitation of known software vulnerabilities. In some cases, even hijacking internet-connected border cameras to monitor aid deliveries into Ukraine (8). However, such hybrid warfare tactics are not only confined to the digital domain. Physical sabotage has also become more prevalent since the invasion in Ukraine, with undersea cables, power grids, and rail networks across Europe becoming targets (9, 10). These acts are often carried out using local proxies or clandestine networks such as sanctioned-evading commercial fleets (11).

Disinformation is another key pillar. Through state-controlled media and covert influence campaigns Russia amplifies social divisions, erodes trust in institutions, and undermines the cohesion of democratic societies. In Moldova for instance, Russian-backed disinformation intensified ethnic tensions, promoted opposition to EU integration, and fueled anti-government protests in the context of the war in Ukraine (12, 13). And lastly, traditional espionage remains just as vital. Russian operatives have adopted deep-cover identities, sometimes built over years in countries such as Brazil and Portugal, to infiltrate institutions. These agents not only gather intelligence but also lay the groundwork for future operations - digital or physical (14).

Expanding frontlines

Unlike conventional warfare, Russia’s hybrid tactics disregard geographical borders. Instead, it unfolds across a vast, often invisible battlefield that touches nearly every continent.

In Ukraine, the most direct and violent manifestations of hybrid warfare are evident. Since the annexation of Crimea in 2014, and especially following the 2022 invasion, Russian cyberattacks have relentlessly targeted government agencies, military networks, and critical infrastructure (15). Across Europe, countries like the Netherlands, Germany, and the UK have faced a surge in Russian cyber intrusions, espionage, and threats to public infrastructure. The MIVD’s annual report notes that the Netherlands has been a frequent target, with multiple cyber-espionage attempts against the government and sensitive data stolen from officials and companies. Russian cyber actors have managed to obtain sensitive data, including personal information of Dutch government employees and companies, through these operations (16).

In early 2024, Dutch authorities confirmed that Russian state-sponsored hackers attempted to sabotage the digital control system of a Dutch public facility, marking the first known cyber sabotage attack of its kind on Dutch critical infrastructure. The MIVD confirmed that a public facility’s digital control system was targeted, but did not specify what facility. Broader warnings mention threats to water, energy, and internet infrastructure (16).

To counter these threats, the MIVD partners with private security firms to detect and mitigate Russian cyber activities, emphasizing that this collaboration is vital for the Netherlands’ digital resilience. The MIVD warns that Russia is acting more boldly in the so-called “gray zone” between peace and war (16).

North America has also been targeted. In both the United States and Canada, cyberattacks against military bases, logistics firms, and critical tech providers that support Ukraine illustrate the global reach of Russian intelligence (17). Meanwhile, countries such as Brazil have been exploited as logistical and operational hubs (18). Russian spies have assumed false identities to infiltrate institutions and launch long-term influence operations. Together, these tactics reveal a sprawling and borderless conflict.

The gray zone: between war and peace

The defining feature of Russian hybrid warfare is its operation in the “gray zone”, the ambiguous space between conflict and peace. This ambiguity is precisely what makes hybrid operations so effective. It allows Russia to strike at adversaries without triggering a formal military response, exploiting the West’s legal and political reluctance to escalate (19).

The MIVD assesses that the Russian threat to Europe is intensifying, not lessening. Even in a post-Ukraine war scenario, the speed and potential impact of Russia's actions on security remain unprecedented (20, 21). The 'gray zone' between peace and war has become a tangible reality, with state actors increasingly resorting to hybrid assaults to destabilize societies. MIVD Director Peter Reesink has emphasized Russia's heightened willingness to take risks (20). This ambiguous space provides Russia a strategic sanctuary, allowing the Kremlin to act aggressively without being labeled an aggressor. This ambiguity creates uncertainty, delays coordinated responses, and ultimately weakens the cohesion of Western alliances.

The impact: destabilization, disruption, and strategic advantage

One of the most profound consequences is the internal destabilization of societies (22). Cyberattacks on hospitals, transport systems, and government platforms create fear and confusion, while disinformation campaigns stoke division, breed distrust, and erode democratic consensus. Critical infrastructure also is a frequent target. Attacks on energy grids, logistics networks, and communications infrastructure threaten not only the economy but also national security. The sabotage of undersea internet cables, for instance, can disrupt digital traffic and financial transactions across continents in an instant (23).

Beyond mere disruption, Russia’s operations serve a strategic intelligence purpose. By infiltrating computer systems and surveilling aid routes or military deployments, Moscow gains valuable insights that it can use to refine its diplomatic positioning and wartime tactics. This form of intelligence-gathering gives the Kremlin a tactical advantage without ever declaring war (24).

Perhaps most troubling is how such hybrid warfare undermines the rules-based international order. Russia’s use of sabotage, espionage, and information warfare during peacetime blurs legal boundaries; it challenges established norms and tests the limits of legal accountability (25). It forces Western democracies into a reactive stance, constantly negotiating how to respond without provoking an open conflict.

Responding to hybrid threats

Recognizing the scope of Russia’s hybrid strategy is only the beginning. The next, and perhaps most urgent step, is crafting a multidimensional response. Russia's objective is not only to weaken adversaries but to unravel the cohesion and legitimacy of democratic systems. These methods have the potential to destabilize the basic principles of Western society if left unchecked.

It is essential that collective defense evolves beyond conventional military doctrine. NATO and the EU are actively taking steps to improve cyber resilience and information integrity, but efforts remain fragmented (25). Defending against hybrid threats requires integrated cooperation between intelligence agencies, the private sector, and civil society across borders. Just as the threat knows no borders, neither should the defense. At the same time, policy and legislation must also adapt, as nations must tighten regulations around foreign influence operations, strengthen oversight over digital platforms, and invest in counter-disinformation tools.

Additionally, deterrence must be recalibrated for the digital and political domains. Responses to cyberattacks and covert aggression must be swift and consistent. Without clear consequences, the Kremlin is emboldened to push further, as demonstrated by their military actions in the Baltic Sea (26, 27).

Lastly, individual awareness matters. Citizens play an active role in recognizing and resisting manipulation. Knowing how hybrid tactics work - and how to critically assess information - is a form of everyday resistance against an adversary that counts on confusion.

A war without borders

This type of hybrid warfare and espionage represent a new era of conflict, one in which the frontlines are everywhere. They run through data centers, courtrooms, media platforms, and public institutions as much as through physical terrain. The weapons range from malware and false passports to manipulated narratives and economic sabotage. The impact is profound: societies have the potential to be destabilized, infrastructure is threatened, and the boundaries between war and peace are increasingly blurred.

As long as Russia pursues this strategy, the conflict will continue to be waged not only in Ukraine, but in capitals, boardrooms, and public spaces across the globe. The challenge for the democratic nations is to recognize the scale and complexity of this new reality, adapt its defenses, and forge a united response to a threat that is as complex as it is relentless. This is not just a military confrontation, but a test of democratic endurance, international solidarity, and the very principles that underpin global stability. Shall we?

This article is part of The Outside World, ftrprf’s very own research center.

For organizations, it’s pivotal to thoroughly understand what is happening in society. We help companies generate comprehensive insights into societal change and its potential effects on their strategy and operations, both negative and positive. With actionable societal insights, courageous plans, and a can-do mentality, we connect the outside world to your company's strategy. For these outside-world insights, we use a rigorous methodology that includes data processing, quantitative and qualitative analysis, and a thorough review process to ensure the accuracy and consistency of our findings.

For more information, please contact theoutsideworld@ftrprf.com.

At The Outside World, our very own research center, we keep a pulse on global developments through a societal lens. As part of this mission, we’ve created The Outside World Journal—a weekly digest delivering a curated selection of the most compelling news insights with our interpretation of why this matters and what the consequences for society might be. Read the journal here.

Sources:

1. CISA. 2025. “Russian GRU Targeting Western Logistics Entities and Technology Companies | CISA,” Cybersecurity and Infrastructure Security Agency CISA, May 21, 2025. https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-141a
2. Van Rensbergen, Arno, and Matt Lynes. 2025. “Hybrid threats: Russia’s shadow war escalates across Europe.” The Parliament, January 21, 2025. https://www.theparliamentmagazine.eu/news/article/hybrid-threats-russias-shadow-war-escalates-across-europe
3. Clark, Sam. 2024. “Russia’s Hybrid Warfare Could Cause ‘Substantial’ Casualties, Senior NATO Official Says.” POLITICO, December 29, 2024. https://www.politico.eu/article/russia-hybrid-warfare-defense-substantial-casualties-james-appathurai-nato/
4. Jones, Seth G. 2025. “Russia’s Shadow War Against the West.” Center for Strategic & International Studies, March 18, 2025. https://www.csis.org/analysis/russias-shadow-war-against-west
5. Kofman, Michael. 2016. “Russian Hybrid Warfare and Other Dark Arts.” War on the Rocks, March 11, 2016. https://warontherocks.com/2016/03/russian-hybrid-warfare-and-other-dark-arts/
6. Hoffman, Frank. 2014. “On Not-So-New Warfare: Political Warfare Vs Hybrid Threats - War on the Rocks.” War on the Rocks. July 28, 2014. https://warontherocks.com/2014/07/on-not-so-new-warfare-political-warfare-vs-hybrid-threats/
7. Bilal, Arsalan. 2024. “NATO Review - Russia’s Hybrid War Against the West.” NATO Review. April 26, 2024. https://www.nato.int/docu/review/articles/2024/04/26/russias-hybrid-war-against-the-west/index.html
8. Rahman-Jones, Imran & Chris Vallance. 2025. “UK Exposes Russian Cyber Campaign Targeting Support for Ukraine.” BBC, May 21, 2025. https://www.bbc.com/news/articles/c17rrjdr79po
9. Fillingham, Zachary. 2025. “Russia’s Gray Zone Warfare Campaign in Europe.” Geopolitical Monitor, May 21, 2025. https://www.geopoliticalmonitor.com/russias-gray-zone-warfare-campaign-in-europe/
10. Reuters. 2023. “Russia targets Netherlands' North Sea infrastructure, says Dutch intelligence agency”. Reuters, February 20, 2023. https://www.reuters.com/world/europe/russia-targets-netherlands-north-sea-infrastructure-says-dutch-intelligence-2023-02-20/
11. Van Rensbergen, Arno, and Matt Lynes. 2025. “Hybrid threats: Russia’s shadow war escalates across Europe.” The Parliament, January 21, 2025. https://www.theparliamentmagazine.eu/news/article/hybrid-threats-russias-shadow-war-escalates-across-europe
12. Botero Arcila, Beatriz, and Florent Parmentier. “Under 35 and under siege: How young European citizens propose to combat disinformation in democratic societies.” Policy brief commissioned by the Paris School of International Affairs Tech & Global Affairs Innovation Hub. November 2024. https://www.sciencespo.fr/api/portal/uploads/Disinformation_and_Democracy_answering_the_Youth_b53de3a91c.pdf
13. Bilal, Arsalan. 2024. “NATO Review - Russia’s Hybrid War Against the West.” NATO Review. April 26, 2024. https://www.nato.int/docu/review/articles/2024/04/26/russias-hybrid-war-against-the-west/index.html
14. Schwirtz, Michael and Jane Bradley. 2025. “The Spy Factory.” The New York Times, May 21, 2025. https://www.nytimes.com/2025/05/21/world/americas/russia-brazil-spies-deep-cover.html
15. Clark, Sam. 2024. “Russia’s Hybrid Warfare Could Cause ‘Substantial’ Casualties, Senior NATO Official Says.” POLITICO, December 29, 2024. https://www.politico.eu/article/russia-hybrid-warfare-defense-substantial-casualties-james-appathurai-nato/
16. Ministerie van Defensie. 2025. “Openbaar Jaarverslag 2024, Militaire Inlichtingen- En Veiligheidsdienst.” Jaarverslag | Defensie.nl. April 22, 2025. https://www.defensie.nl/downloads/jaarverslagen/2025/04/22/openbaar-jaarverslag-2024-militaire-inlichtingen--en-veiligheidsdienst
17. CISA. 2025. “Russian GRU Targeting Western Logistics Entities and Technology Companies | CISA,” Cybersecurity and Infrastructure Security Agency CISA, May 21, 2025. https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-141a
18. Schwirtz, Michael and Jane Bradley. 2025. “The Spy Factory.” The New York Times, May 21, 2025. https://www.nytimes.com/2025/05/21/world/americas/russia-brazil-spies-deep-cover.html
19. Jones, Seth G. 2025. “Russia’s Shadow War Against the West.” Center for Strategic & International Studies, March 18, 2025. https://www.csis.org/analysis/russias-shadow-war-against-west
20. Ministerie van Defensie. 2025. “Russische Brutaliteit Om Samenleving Te Ontwrichten Neemt Toe.” Nieuwsbericht | Defensie.nl. April 22, 2025. https://www.defensie.nl/actueel/nieuws/2025/04/22/russische-brutaliteit-om-samenleving-te-ontwrichten-neemt-toe
21. NOS. 2025. “MIVD: Nederland in Grijs Gebied Tussen Vrede En Oorlog.” NOS, April 22, 2025. https://nos.nl/artikel/2564540-mivd-nederland-in-grijs-gebied-tussen-vrede-en-oorlog
22. Parlow, Anita. 2025. “Hybrid War and National Security: NATO, the US, and the West.” Wilson Center, November 8, 2024. https://www.wilsoncenter.org/blog-post/hybrid-war-and-national-security-nato-us-and-west
23. CISA. 2025. “Russian GRU Targeting Western Logistics Entities and Technology Companies | CISA,” Cybersecurity and Infrastructure Security Agency CISA, May 21, 2025. https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-141a
24. Fillingham, Zachary. 2025. “Russia’s Gray Zone Warfare Campaign in Europe.” Geopolitical Monitor, May 21, 2025. https://www.geopoliticalmonitor.com/russias-gray-zone-warfare-campaign-in-europe/
25. NATO. 2025. “Allies Review Progress With NATO Cyber Defence Pledge, Identify Next Steps to Increase Cyber Resilience.” NATO, May 23, 2025. https://www.nato.int/cps/en/natohq/news_235531.htm
26. Steketee, Hans, Iddo Havinga, and Ilse Eshuis. 2025. “Begint De Oorlog Tussen Rusland En De NAVO Op De Oostzee?” NRC, May 27, 2025. https://www.nrc.nl/nieuws/2025/05/27/begint-de-oorlog-tussen-rusland-en-de-navo-op-de-oostzee-a4894757
27. Edwards, Charlie. 2024. “Russia’s Hybrid War in Europe Enters a Dangerous New Phase.” IISS, November 26, 2024. https://www.iiss.org/online-analysis/online-analysis/2024/11/russias-hybrid-war-in-europe-enters-a-dangerous-new-phase/