Full Report
For the first few years of the war in Ukraine, Russia’s hybrid warfare attacks in Europe remained just below the threshold that might trigger a collective response. As the United States’ permanent representative to NATO from 2021 to 2024, I watched the campaign develop: undersea cables cut, incendiary devices hidden in cargo packages, and arson…
Analysis Summary
# Threat Actor: Russian State-Sponsored Hybrid Warfare Units
## Attribution & Identity
- **Actor Identification:** Russian Federation (State-sponsored)
- **Primary Attribution:** Under the direction of Russian President Vladimir Putin.
- **Associated Groups:** While specific unit numbers (e.g., GRU Unit 29155) are not explicitly named in the text, the activities described align with Russian military intelligence and special operations forces.
## Activity Summary
The article describes a shift from deniable, "below-threshold" hybrid attacks to overt kinetic violations of NATO territory. Recent campaigns include:
- **Kinetic Encroachment (2026):** Russian cruise missiles entering Polish territory and drones violating Romanian and Moldovan airspace.
- **Sabotage Operations:** Arson attacks targeting weapons factories and depots across Europe.
- **Logistics Disruption:** Hidden incendiary devices placed within cargo packages and explosives found at Leipzig airport.
- **Subsea Interference:** Cutting of undersea telecommunications and power cables.
## Tactics, Techniques & Procedures
- **Hybrid Sabotage:** Using arson and physical explosives to damage industrial facilities.
- **Aerial Incursions:** Deployment of explosive-laden drones and cruise missiles into sovereign NATO airspace.
- **Physical Interference:** Cutting undersea infrastructure to disrupt communication.
- **Threshold Manipulation:** Executing attacks just below the level that would trigger a NATO Article 5 collective response, though recently escalating to "undeniable" actions.
- **Plausible Deniability:** Historically using methods that allowed Moscow to wave away accusations, though this trend is shifting toward overt aggression.
## Targeting
- **Sectors:** Defense Industrial Base (weapons factories/depots), Transportation (airports/cargo), Telecommunications (undersea cables), and Energy.
- **Geography:** Europe (specifically Poland, Germany, Romania, Moldova, and the Baltic Sea region).
- **Victims:** NATO member states, weapons depots supporting Ukraine, and international logistics hubs.
## Tools & Infrastructure
- **Kinetic Weaponry:** Russian cruise missiles and explosive-laden drones.
- **Incendiary Devices:** Hidden packages in commercial cargo streams.
- **Physical Assets:** Naval vessels or specialized equipment used for cutting subsea cables.
## Implications
- **Strategic Goal:** Fracturing NATO unity and testing the resolve of Article 5 commitments.
- **Escalation Risk:** The transition from "deniable" hybrid acts to overt airspace violations represents a dangerous new phase that challenges the alliance's defensive posture.
- **Cost Imposition:** By targeting the European defense industry, Russia aims to raise the political and material cost of continued Western support for Ukraine.
## Mitigations
- **Infrastructure Hardening:** Reinforcing critical infrastructure against physical sabotage.
- **Enhanced Monitoring:** Increased patrols in the Baltic Sea and other strategic maritime corridors.
- **Intelligence Integration:** Expanding intelligence sharing among NATO allies to attribute "gray zone" activities more rapidly.
- **Active Defense:** Scrambling F-16s and using air defense systems to intercept aerial incursions (as demonstrated by Romania and Spain).
- **Collective Response:** Establishing a clearer framework for responding to hybrid threats that fall just below the traditional definition of armed conflict.