Full Report
Explore Insikt Group's analysis on Russia's escalation of hybrid and New Generation Warfare (NGW) tactics across Europe since 2022, including cyber attacks, physical sabotage, and airspace incursions, along with projected trends for the next two years.
Analysis Summary
# Threat Actor: Russia-Nexus Actors (GRUs / SVR / FSB)
## Attribution & Identity
- **Actor Identification:** Russian intelligence services and their proxies, operating under the military strategy of **New Generation Warfare (NGW)**.
- **Aliases:** Historically associated with "Active Measures" (Soviet era).
- **Known Associations:**
- Russian General Staff (Valeriy Gerasimov).
- Russia-nexus physical sabotage networks and cyber threat actors.
- **Influence Campaign Names:** Doppelgänger, Operation Overload, Operation Undercut, and CopyCop.
## Activity Summary
Since February 2022, Russia has escalated hybrid operations across Europe, moving beyond the former Soviet sphere. Recent activities include:
- **Physical Sabotage:** An August 2026 explosive quadcopter attack on an Antonov An-124 at Leipzig/Halle Airport and a 2024 arson attack at the Marywilska 44 shopping center in Poland.
- **Disinformation:** The expansion of the "CopyCop" network in August 2026 using AI-generated text and voice clones to impersonate media in France and Norway.
- **Airspace/Maritime Incursions:** Significant spikes in NATO airspace violations (30 incidents between Sept 2025 – Jan 2026) and maritime drone threats near the Neptun Deep gas field in the Black Sea.
- **Cyber Operations:** Coordinated DDoS and access operations against Norwegian government portals in late August 2026.
## Tactics, Techniques & Procedures
- **Hybrid Warfare (NGW):** Integration of non-military means to exceed the effectiveness of traditional force.
- **Physical Sabotage:** Use of military-grade explosives (e.g., Hexogen) delivered via drones against logistics and cargo hubs.
- **Influence Operations:** Impersonating national media outlets, disseminating Kremlin propaganda, and utilizing AI for localized news impersonation and voice cloning.
- **Maritime/Airborne Harassment:** Territorial water violations, undersea cable targeting, and frequent drone/jet incursions to test response protocols.
- **Cyber TTPs:**
- Attacks on internet-facing firewalls and Virtual Private Networks (VPNs).
- Exploitation of email services and web portals for long-term access.
- Intelligence collection and operational reach.
- Coordinated Distributed Denial-of-Service (DDoS) attacks.
## Targeting
- **Sectors:** Critical infrastructure, military logistics, energy (offshore gas), government portals, and media/fact-checking organizations.
- **Geography:**
- **Core Targets:** UK, France, Germany, Poland.
- **Peripheral/Strategic:** Norway, Estonia, Romania, Denmark.
- **Victims:** Leipzig/Halle Airport, Marywilska 44 Shopping Center, Neptun Deep Gas Field, Norwegian Public Sector Infrastructure.
## Tools & Infrastructure
- **Malware & AI:** AI-generated text and voice cloning tools for disinformation.
- **Physical Tools:** Quadcopter drones, military-grade hexogen explosives, surface maritime drones.
- **Cyber Infrastructure:** Targeted exploitation of VPNs and firewalls.
- **Defanged Infrastructure:** (No specific IPs or URLs were provided in the source text for defanging beyond general campaign names).
## Implications
- **Strategic Intent:** Russia aims to test NATO defensive capabilities, degrade critical infrastructure, and sow fear to paralyze European decision-making and support for Ukraine.
- **Escalation Risk:** Insikt Group assesses a high likelihood of a full-scale NGW campaign over the next two years.
- **Shift in Warfare:** The transition from kinetic-only threats to a "complex kit" of psychological and physical tactics indicates a permanent change in the European security environment.
## Mitigations
- **Critical Infrastructure Defense:** Enhanced physical security and drone detection systems for dual-use logistics hubs and energy sites.
- **Cyber Hygiene:** Prioritize patching of internet-facing assets, specifically firewalls, VPNs, and email gateways.
- **Information Resilience:** Development of rapid debunking capabilities to counter AI-driven localized disinformation.
- **Maritime Security:** Increased monitoring and rapid-response protocols for undersea cables and offshore energy infrastructure.