The Shadow War: How Intelligence Agencies Became the Primary Weapon of Modern Hybrid Warfare

Executive Summary

In November 2025, a bomb tore through the Warsaw-Lublin railway line in Poland, prompting Prime Minister Donald Tusk to personally inspect the blast site - one incident among a rapidly accelerating pattern that, by the close of 2025, had seen suspected Russian hybrid warfare activity across European states surpass the entire total recorded for 2024. Estonian airspace was violated by Russian fighter jets. Drones intruded over Polish airports. Germany alone recorded 321 suspected hybrid incidents in a single year. Assassination plots linked to Russian operatives were exposed. Undersea cables connecting Taiwan to the outside world were severed by vessels with documented links to Chinese state interests. None of these were random provocations or isolated criminal acts. Each was the visible fragment of a coordinated, doctrinally grounded campaign in which intelligence agencies - not militaries, not diplomats, but the SVR, the GRU, the FSB, and their counterparts in Beijing's Ministry of State Security - have become the primary architects and executors of contemporary great power competition.

This represents a fundamental inversion of the traditional relationship between intelligence services and statecraft. For most of the twentieth century, intelligence agencies existed to inform policy - to collect, analyze, and warn, while the actual conduct of confrontation between states remained the domain of diplomats, economists, and, when deterrence failed, militaries. What multiple Western intelligence assessments, defense institutions, and strategic analysts now converge in describing is a reversal of that hierarchy: in Russia specifically, and increasingly in China's more calibrated model, intelligence services have grown institutionally powerful enough that they now shape rather than merely serve national strategy, and the tools of espionage - sabotage, disinformation, cyber intrusion, covert financing, proxy recruitment - have become the primary instruments through which great powers contest one another below the threshold that would trigger open war.

This report provides a doctrine-level assessment of the role intelligence agencies now play in modern hybrid warfare - the historical and doctrinal roots of this transformation, the specific agencies and operational patterns driving it, the mounting toll across Europe and the Indo-Pacific, and the profound difficulty Western democracies face in constructing an effective deterrent posture against a form of conflict explicitly engineered to remain beneath the threshold of collective defense response.

Strategic Background

Hybrid warfare, in its contemporary form, is best understood as the deliberate, coordinated blending of military and non-military instruments of power - cyberattacks, disinformation, economic coercion, sabotage, covert financing, proxy recruitment, and irregular armed activity - applied in a synchronized fashion across physical and digital domains, calibrated specifically to remain below the threshold that would justify a conventional military or collective defense response. The doctrinal foundation most frequently cited for Russia's contemporary application traces to a 2013 address by Valery Gerasimov, now Russia's chief of the general staff, who argued that modern conflict would increasingly rely on non-military and information means whose effectiveness could, in certain circumstances, exceed that of conventional weapons - a formulation that Western analysts have since termed the Gerasimov Doctrine, though Russian military scholars themselves generally describe it as new generation warfare, rooted in a much older Soviet tradition of active measures.

What distinguishes the current era from previous decades of espionage and covert action is not the existence of these tools individually - sabotage, disinformation, and covert influence have deep roots stretching back through the entire Cold War and beyond - but rather their systematic integration, their acceleration through digital technology, and critically, the institutional empowerment of the intelligence services that plan and execute them. Analysts increasingly describe hybrid warfare as the weaponization of everything: information manipulation campaigns segue seamlessly into cyberattacks, which give way to political influence operations, economic pressure, or covert sabotage, synchronized specifically to keep a target state off balance, unable to definitively attribute responsibility, and therefore unable to mount the kind of clear, proportionate, and internationally legitimate response that a conventional military attack would justify.

The strategic logic underlying this approach is explicit and has been articulated by its practitioners with striking candor. The objective is not battlefield victory in any traditional sense but the opening of continual second fronts that stretch adversaries thin, blur the line between war and peace, and normalize a state of constant, low-grade pressure that erodes an adversary's institutional resilience, political cohesion, and public trust over an extended timeline - years or decades rather than the compressed timeframes of conventional military campaigns. This is warfare designed to be endured rather than won in any single decisive engagement, and it is precisely this characteristic that makes traditional deterrence frameworks, built around clear red lines and proportionate response to unambiguous acts of aggression, so poorly suited to countering it.

Historical Context

The institutional empowerment of intelligence services within Russian state decision-making has developed over more than three decades, accelerating dramatically following Vladimir Putin's own background within the KGB and its successor FSB, and further consolidating through the Foreign Intelligence Service, known as the SVR, and the military intelligence directorate, the GRU. These three institutions - the FSB under Alexander Bortnikov, the SVR under Sergei Naryshkin, and the GRU - have grown sufficiently powerful within the Russian state apparatus that they now play a significant and arguably dominant role in national security decision-making, a development whose consequences became starkly visible in the lead-up to Russia's 2022 invasion of Ukraine, when the FSB's Fifth Service reportedly provided Putin with deeply flawed intelligence assessments predicting that Kyiv would fall quickly and that Ukrainian resistance would prove minimal.

This intelligence failure carries a lesson of profound significance for understanding the institutional dynamics now driving hybrid warfare: agencies granted the power to shape rather than merely inform policy can become echo chambers, reinforcing the political assumptions and preferences of leadership rather than challenging them with objective assessment. Even after the catastrophic inaccuracy of their pre-invasion battlefield predictions became undeniable, Russia's intelligence services retained and arguably expanded their institutional dominance, ensuring that Moscow's strategic preference for covert action, sabotage, cyber operations, and political warfare - rather than the kind of sober reassessment that battlefield failure might otherwise have prompted - became further entrenched as the organizing principle of Russian power projection, executed increasingly through proxies including criminal hackers, organized crime networks, and individuals recruited from prison populations to maintain the plausible deniability that is central to the entire hybrid warfare model.

The historical template for this approach - active measures, covert influence operations, and the deliberate exploitation of political polarization - was refined and tested in Georgia in 2008 and Ukraine in 2014, providing Moscow with an operational playbook that has since been scaled dramatically across the whole of Europe and, in certain dimensions, well beyond it. China's parallel development of hybrid capability has followed a somewhat different institutional path, less centered on the personal empowerment of specific security services within top-level decision-making and more focused on the systematic integration of cyber espionage, economic coercion, and technological dependency creation into a broader, more patient strategy explicitly aligned with Beijing's stated industrial and technological self-sufficiency objectives under its successive Five-Year Plans.

Current Situation Assessment

The scale of hybrid warfare activity attributed to Russian intelligence services across Europe reached an unprecedented level through 2025 and into early 2026, according to multiple independent assessments converging on strikingly similar conclusions. Data compiled by the threat intelligence firm Dragonfly found that suspected Russian hybrid warfare activity in European states during 2025 had, as of early October, already surpassed the total number of incidents recorded across the entirety of 2024 - a trajectory that continued accelerating into 2026, with analysis published in connection with the Munich Security Report 2026 identifying more than 150 suspected hybrid incidents across European Union and NATO member states, and Germany alone recording 321 suspected incidents including escalating drone intrusions into national airspace and disinformation campaigns specifically targeting critical infrastructure.

Research conducted by the International Centre for Counter-Terrorism and GLOBSEC documented a fourfold increase in sabotage and vandalism operations across Europe compared to the previous year, with a substantial proportion of these operations involving criminal networks specifically recruited by Russian intelligence services to execute physical acts of sabotage while preserving the deniability that shields the Kremlin from direct attribution and consequence. The specific incidents underlying these statistics are individually alarming and collectively unmistakable in their pattern: the violation of Estonian airspace by Russian fighter jets, drone intrusions over Polish airports in late 2025, the sabotage attack on the Warsaw-Lublin railway line that prompted Prime Minister Tusk's personal site visit in November 2025, disrupted sabotage plots specifically targeting European rail infrastructure, and exposed assassination attempts linked directly to Russian intelligence operatives.

The disinformation dimension of this campaign has evolved considerably in sophistication following the European Union's blocking of overt Russian state media channels including RT and Sputnik. Proxy outlets and coordinated operations - most notably the campaign known as Matryoshka, involving deepfakes and AI-generated manipulation deployed with particular intensity in Moldova and Romania during 2024 and 2025 - have emerged as the dominant vector for continued Russian information operations, supplemented by a phenomenon researchers term LLM grooming, in which large language model outputs are deliberately corrupted through coordinated content seeding to spread disinformation through ostensibly neutral artificial intelligence systems, a technique documented extensively in the Policy Genome 2026 research initiative. Key electoral targets for this propaganda apparatus have included Hungary's April 2026 elections and various German state elections, with narratives specifically engineered to exploit migration anxiety and energy security concerns in order to amplify pro-Russian populist political movements across the ideological spectrum.

China's parallel hybrid warfare posture, while less kinetically visible than Russia's European sabotage campaign, has demonstrated its own distinctive and strategically significant pattern through 2025 and into 2026. Cyber targeting patterns closely mirrored the priorities articulated in Beijing's 15th Five-Year Plan, with manufacturing and semiconductor companies targeted at meaningfully higher rates than in previous years - activity directly aligned with China's stated drive toward technological self-sufficiency and reduced dependence on Western imports across strategic industrial sectors. Government agencies linked to economic development and foreign policy formulation, alongside think tanks, law firms, and financial institutions, faced sustained targeting reflecting Beijing's consistent interest in acquiring the regulatory, legal, and policy intelligence that strengthens its negotiating position across international trade and diplomatic disputes. Taiwan's acute vulnerability to this form of pressure was starkly illustrated by reported incidents involving Chinese-linked vessels implicated in damage to the limited number of undersea fiber-optic cables upon which the island's internet connectivity substantially depends - a vulnerability compounded by Taiwan's dependence on imported energy for over 97 percent of its needs and natural gas reserves sufficient for less than two weeks under blockade conditions.

Power Center Analysis

Russia's Intelligence Triad: SVR, GRU, and FSB

The institutional architecture driving Russia's hybrid warfare campaign rests on the coordinated but distinct roles of three primary services. The Foreign Intelligence Service, the SVR under Sergei Naryshkin, focuses on foreign political intelligence collection and the cultivation of influence networks abroad. The Main Intelligence Directorate, the GRU, has historically specialized in more aggressive and kinetically oriented operations, including the sabotage campaigns increasingly documented across European rail, energy, and telecommunications infrastructure, alongside its long-standing role in military intelligence and special operations. The Federal Security Service, the FSB under Alexander Bortnikov, combines domestic security functions with an increasingly assertive foreign operations portfolio, including the flawed pre-invasion intelligence assessments produced by its Fifth Service that illustrate both the institutional power these agencies now wield and the analytical distortions that such power can produce when agencies become more invested in confirming leadership assumptions than challenging them. The coordination among these three services, and their demonstrated willingness to operate through deniable proxies including criminal networks, hacktivist collectives, and individuals recruited through prison systems, has created an operational model whose flexibility and deniability represent its core strategic advantage against Western democracies constrained by legal attribution requirements and proportionate response norms.

China's Ministry of State Security: The Patient Strategist

China's hybrid warfare apparatus, centered on the Ministry of State Security alongside the cyber and intelligence components of the People's Liberation Army, has pursued a demonstrably more patient and economically integrated strategy than Russia's more kinetically visible European sabotage campaign. Beijing's approach weaves cyber espionage, economic leverage, and strategic dependency creation into a coherent long-term architecture explicitly aligned with the technological self-sufficiency objectives of successive Five-Year Plans, using its commercial and economic relationships - including expanding digital infrastructure partnerships that grant Chinese companies deep access to foreign digital infrastructure - as both intelligence collection vectors and instruments of strategic leverage that reduce Western cyber influence across the developing world even as they create new vectors for Chinese intelligence collection. This model prioritizes control over key technological and industrial sectors, critical infrastructure, and strategic material supply chains as instruments through which Beijing creates strategic dependencies and enhances its broader geopolitical influence, an approach NATO's own institutional assessments now explicitly identify as a hybrid and cyber threat to Alliance security in its own right, distinct from but complementary to Russia's more overtly disruptive campaign.

NATO and the European Union: The Reactive Institutional Response

Western institutional responses to this accelerating threat have expanded substantially but remain, by the assessment of numerous analysts, predominantly defensive and reactive rather than proactively deterrent. NATO created the position of Special Coordinator for Hybrid Threats in 2025, currently held by Assistant Secretary General for Cyber and Digital Transformation Jean Charles Ellermann-Kingombe, serving as the alliance's high-level focal point for coordinating its response across the full spectrum of hybrid threats. The alliance's Joint Intelligence and Security Division continuously gathers, shares, and assesses information to detect and attribute ongoing hybrid activity, complemented by the Critical Undersea Infrastructure Coordination Cell, the Baltic Sentry Mission, and the NorthSeal platform - institutional mechanisms specifically constructed in response to the pattern of undersea cable and pipeline sabotage that has characterized Baltic Sea tensions since 2022. The European Union has developed parallel mechanisms including its Hybrid Toolbox and the EUvsDisinfo project, alongside the January 2026 imposition of Foreign Information Manipulation and Interference sanctions against six Russian individuals - a response whose modest scale relative to the documented breadth of hybrid activity illustrates the persistent gap between the sophistication of the threat and the institutional capacity currently arrayed against it.

The United Kingdom and Grey Zone Intelligence Reform

The United Kingdom's intelligence establishment has undergone significant doctrinal reassessment in response to the hybrid threat's accelerating pace, with the Royal United Services Institute and other British strategic analysts explicitly concluding that the most immediate threat to UK national security in 2026 is unlikely to take the form of conventional military attack but rather the gradual erosion of national resilience through sustained sabotage, malign interference, and provocation, much of it directed or enabled by the Kremlin but executed through deniable proxies and private commercial intermediaries. This assessment has prompted a significant reorientation of British intelligence collection priorities toward partnerships with technology firms and the systematic fusion of open-source, technical, and human intelligence at a speed that traditional Cold War-era intelligence collection and reporting cycles, calibrated to slower-moving conventional threats, were never designed to match.

Military and Security Implications

The military implications of intelligence-driven hybrid warfare extend well beyond the immediate disruption that individual sabotage or cyber incidents inflict, touching the fundamental architecture of collective defense and deterrence that has underpinned Western security arrangements since the Cold War's end. The explicit strategic calculation underlying Russia's campaign - remaining consistently below the threshold that would trigger a NATO Article 5 collective defense response - represents a sophisticated exploitation of the very legal and political frameworks designed to prevent great power conflict, using the ambiguity and deniability inherent in hybrid operations to impose real strategic costs on adversaries while denying them the clear casus belli that conventional aggression would provide.

Dutch intelligence services, through their AIVD civilian and MIVD military intelligence agencies, have issued assessments of particular gravity in this context, concluding that while direct military confrontation between Russia and NATO remains unlikely in the near term, such confrontation is no longer unthinkable - a notable escalation in threat characterization reflecting the assessment that Russian armed forces are actively preparing for potential conflict with NATO while simultaneously using hybrid operations to test Western willingness to escalate in response to provocations calibrated specifically to probe the alliance's collective resolve without crossing its formal defense threshold. This dual-track posture - genuine military preparation combined with sustained sub-threshold pressure - represents a considerably more dangerous strategic configuration than either pure military buildup or pure hybrid harassment would represent independently.

The integration of artificial intelligence into hybrid warfare's cognitive and cyber dimensions has accelerated dramatically through 2025 and into 2026, with synthetic media deployed at scale to impersonate political leaders or incite civil violence, automated influence networks using AI-managed personas to drive online sentiment at a velocity and scale no human-operated influence campaign could achieve, and real-time psychological operations capable of delivering messages custom-tailored to individual cognitive and psychological profiles derived from data harvested across digital platforms. A single AI-generated deepfake video, distributed through social media and algorithmically amplified, can now reach millions of viewers within hours - a velocity of disinformation propagation that fundamentally outpaces the capacity of traditional fact-checking, journalistic verification, or governmental counter-messaging to intervene before substantial psychological and political damage has already been inflicted on the target population's trust in legitimate information sources.

The undersea infrastructure dimension of hybrid warfare has emerged as a particularly consequential domain, given the near-total dependence of global financial, military, and civilian communications systems on a limited number of undersea fiber-optic cables and energy pipelines whose physical vulnerability to sabotage the Nord Stream precedent and subsequent Baltic Sea incidents have made unmistakably clear. Taiwan's specific exposure to this vulnerability - given its heavy reliance on a limited number of undersea cables for internet connectivity and its documented incidents involving Chinese-linked vessels - illustrates how the same hybrid warfare toolkit refined against European targets by Russian intelligence services is being adapted and deployed by Chinese state-linked actors against the Indo-Pacific's most consequential potential flashpoint, with implications for Taiwan's resilience under any future blockade or invasion contingency that extend directly from its current undersea infrastructure vulnerability.

Economic and Trade Impact

The economic dimensions of intelligence-driven hybrid warfare operate through multiple simultaneous channels, from the direct costs of infrastructure sabotage and repair to the more diffuse but ultimately more consequential erosion of institutional trust, investment confidence, and social cohesion that sustained hybrid pressure inflicts on target economies over an extended timeline. Sabotage attacks on rail, energy, and financial market infrastructure - documented extensively across Poland, Germany, and other European states through 2025 and 2026 - impose direct repair and security costs while simultaneously generating the kind of disruption to logistics, energy supply, and financial market confidence that compounds across an economy far beyond the immediate physical damage inflicted at any single incident site.

China's economic dimension of hybrid warfare operates through a distinctly different but equally consequential mechanism, integrating cyber espionage targeting manufacturing and semiconductor companies with the broader architecture of economic coercion that has characterized Beijing's deployment of rare earth export controls and its construction of the Cross-Border Interbank Payment System as an alternative to the Western-dominated SWIFT financial messaging infrastructure. This integration of cyber access, economic leverage, and calibrated trade coercion into a coherent strategic toolkit reflects a considerably more patient and economically embedded model than Russia's more kinetically disruptive European campaign, one whose cumulative effect on Western technological and industrial competitiveness may prove more strategically consequential over the coming decade than any single sabotage incident, however dramatic its immediate visibility.

The commercial partnership dimension of hybrid economic warfare deserves particular analytical attention, given the documented pattern of Russian commercial arrangements granting Russian companies deep access to foreign digital infrastructure across developing world markets - arrangements that simultaneously provide Moscow with new vectors for intelligence collection while reducing Western cyber influence in regions increasingly contested between competing digital infrastructure ecosystems. This pattern mirrors, in a distinctly Russian variant, the broader concern that Western intelligence and security agencies have expressed regarding Chinese digital infrastructure investment through the Digital Silk Road initiative, illustrating how commercial telecommunications and digital infrastructure partnerships have become, across multiple great power competitors simultaneously, a primary vector through which hybrid intelligence collection and influence operations are conducted beneath the visible surface of ordinary commercial activity.

Diplomatic Positioning

The diplomatic architecture surrounding hybrid warfare response has expanded substantially through 2025 and 2026, even as its practical effectiveness remains constrained by the fundamental attribution and legal challenges inherent to gray zone conflict. NATO's cooperation with the European Union has intensified considerably, with particular focus on cyber defense coordination, resilience enhancement, strategic communications, improved situational awareness, and joint exercise programming - reflected in initiatives including Exercise Nighthawk 21, which brought together Special Operations Forces from thirteen NATO allies and partners to test collective capability against complex counter-terrorism and hybrid warfare scenarios. The alliance has similarly deepened cooperation with non-member partners including Bosnia and Herzegovina, Georgia, and the Republic of Moldova, alongside continued engagement with Ukraine through the NATO-Ukraine Platform on Countering Hybrid Warfare, originally established at the 2016 Warsaw Summit and substantially expanded in scope and urgency since.

A significant complicating factor in this diplomatic architecture has been the Trump administration's decision to end American participation in international cooperation frameworks specifically dedicated to detecting and exposing disinformation originating from Russia, China, and Iran - a policy shift that European analysts have characterized explicitly as a self-weakening step that undermines the kind of coordinated allied information-sharing and attribution capability that effective hybrid warfare deterrence fundamentally requires. This American retrenchment from multilateral disinformation-countering cooperation stands in notable tension with the broader pattern of expanded institutional response evident across NATO and EU frameworks, illustrating a genuine divergence in strategic approach among Western allies regarding how best to counter a threat that virtually every serious assessment agrees is intensifying rather than receding.

China's diplomatic posture regarding its own hybrid warfare activities has followed a pattern of consistent denial combined with confrontational rhetoric directed at Western characterizations of its cyber and economic coercion activities, even as NATO's own institutional assessments have grown increasingly explicit in identifying Beijing's malicious hybrid and cyber operations, alongside its confrontational rhetoric and disinformation, as activities that directly target Alliance members and harm collective security - a diplomatic characterization that reflects the broader Western institutional consensus that China's hybrid warfare posture, while operationally distinct from Russia's more kinetically visible European campaign, represents an equally serious and strategically coordinated challenge requiring sustained institutional attention and response.

Regional Fallout

In the Baltic states and Poland, the concentration of documented hybrid warfare incidents - including Estonian airspace violations, Polish airport drone intrusions, and the Warsaw-Lublin railway sabotage attack - reflects these states' frontline position along Russia's immediate periphery and their historical role as the primary testing ground for hybrid tactics that Moscow subsequently scales toward broader European application. The Belfer Center's projection that limited Russian incursions into the Baltic states could occur within three years if current hybrid escalation trends continue represents one of the more alarming near-term assessments emerging from the current wave of strategic analysis, reflecting genuine concern that sustained hybrid pressure, if not effectively countered, could eventually transition toward more overtly kinetic testing of NATO's collective defense resolve in precisely the frontline states where hybrid activity has already concentrated most intensively.

In Germany, the recorded 321 suspected hybrid incidents through the relevant reporting period, encompassing both drone airspace intrusions and disinformation campaigns targeting critical infrastructure, illustrate how thoroughly the hybrid threat has penetrated even Europe's largest and most institutionally robust economy, with direct implications for German domestic political stability given the parallel targeting of state elections through propaganda specifically engineered to exploit migration and energy security anxieties in service of amplifying pro-Kremlin populist political movements.

In Moldova and Romania, the deployment of the Matryoshka disinformation operation during the 2024-2025 electoral cycles illustrates the particular vulnerability of smaller, institutionally less robust European states to sustained AI-enhanced information operations specifically calibrated to exploit existing social and political fault lines - a vulnerability that Hungary's April 2026 elections have similarly tested, given the deliberate targeting of Hungarian electoral processes by propaganda networks exploiting the same migration and energy anxiety themes documented across the broader European campaign.

In the Indo-Pacific, Taiwan's undersea cable vulnerabilities and its broader energy and blockade susceptibility illustrate how the hybrid warfare toolkit refined against European targets is being adapted for application against the Indo-Pacific's most consequential potential flashpoint, with direct implications for how any future Taiwan Strait contingency might unfold given Taipei's documented infrastructure vulnerabilities to exactly the kind of sub-threshold sabotage and cyber pressure that Chinese state-linked actors have already demonstrated willingness and capability to deploy.

Global Strategic Consequences

The elevation of intelligence agencies to primary strategic instruments of great power competition carries consequences that extend well beyond the immediate tactical disruption that individual hybrid incidents inflict, touching the fundamental character of international order and the viability of the collective security architecture that has structured great power relations since 1945. When the principal instruments of confrontation between major powers become deniable, sub-threshold, and executed through proxies specifically designed to prevent clear attribution, the entire framework of deterrence theory - built around the assumption that clear aggression triggers clear, proportionate, and legitimately justified response - becomes progressively less capable of preventing escalation, precisely because the threshold for triggering that response has been deliberately and systematically evaded by design.

The institutional empowerment of intelligence services within authoritarian state decision-making structures, exemplified by the demonstrated influence of Russia's FSB, SVR, and GRU over strategic policy formulation, carries a further consequence whose significance extends beyond the hybrid warfare campaigns these agencies currently execute: the risk that agencies structurally incentivized to confirm rather than challenge leadership assumptions will, as the FSB's pre-invasion Ukraine assessments demonstrated, produce systematically distorted strategic analysis that increases rather than decreases the risk of catastrophic miscalculation. An intelligence apparatus empowered to shape policy rather than merely inform it, and rewarded institutionally for validating rather than contesting leadership preferences, represents a structural vulnerability within the adversary decision-making process whose consequences for crisis stability and escalation control remain difficult to fully model but whose historical precedent, in the Ukraine case specifically, offers little reassurance.

For the broader architecture of democratic governance globally, the demonstrated effectiveness of AI-enhanced disinformation and covert influence operations in exploiting political polarization, migration anxiety, and institutional distrust represents a genuinely novel and rapidly evolving challenge whose long-term implications for democratic resilience remain incompletely understood even by the intelligence and security professionals most directly engaged in countering it. The framework advanced by analysts including Anne Applebaum, characterizing this dynamic as part of a broader transnational system of kleptocratic power that hollows out institutions, monetizes coercion, and spreads political emptiness across borders, captures the civilizational stakes that many strategic analysts now attach to what might otherwise be dismissed as a collection of discrete tactical incidents rather than a coherent and deliberately engineered assault on the institutional foundations of democratic governance itself.

Risk Matrix

• Risk Level: Critical - Sustained Russian hybrid pressure across the Baltic states escalates, consistent with the Belfer Center's three-year projection, into limited kinetic incursion or territorial probing that tests NATO's collective defense resolve at precisely the frontline states where hybrid activity has already concentrated most intensively, creating a genuine crisis scenario for which alliance decision-making processes remain inadequately prepared given the ambiguity that hybrid escalation deliberately cultivates.
• Risk Level: High - AI-enhanced disinformation campaigns, building on the demonstrated effectiveness of the Matryoshka operation and comparable initiatives, successfully influence a pivotal European election outcome in a manner that installs or empowers a government explicitly hostile to continued Ukraine support or broader EU-NATO cohesion, achieving through information warfare an outcome that direct military coercion could not accomplish.
• Risk Level: High - A sabotage incident targeting critical undersea infrastructure - cables, pipelines, or comparable systems - in the Baltic Sea, North Sea, or waters surrounding Taiwan produces consequences severe enough to trigger a substantial and immediate escalatory response, testing whether NATO's Critical Undersea Infrastructure Coordination Cell and comparable mechanisms possess the attribution and response capability that current institutional frameworks assume but have not yet been decisively tested to confirm.
• Risk Level: High - The persistent gap between Western institutional response mechanisms, which remain predominantly defensive and reactive by the assessment of multiple analysts, and the accelerating pace and sophistication of Russian and Chinese hybrid operations continues to widen, allowing adversary hybrid capability to outpace allied countermeasure development at a rate that erodes cumulative resilience faster than institutional reform can address.
• Risk Level: Medium - American withdrawal from multilateral disinformation-countering cooperation frameworks, as reflected in the Trump administration's policy shift, materially degrades the collective allied attribution and information-sharing capability that effective hybrid warfare deterrence requires, creating exploitable gaps that Russian and Chinese intelligence services demonstrate increasing sophistication in identifying and targeting.
• Risk Level: Medium - China's more patient, economically integrated hybrid warfare model, centered on digital infrastructure partnerships and calibrated economic coercion, achieves cumulative strategic effects on Western technological competitiveness and critical mineral supply chain security that prove more consequential over the coming decade than the more visible but individually less strategically decisive incidents characterizing Russia's European sabotage campaign.
• Risk Level: Medium - Institutional intelligence failures analogous to the FSB's pre-invasion Ukraine assessment recur within Russia's or another authoritarian state's decision-making apparatus, producing a strategic miscalculation whose consequences extend beyond the hybrid warfare domain into genuine kinetic escalation that neither the acting state nor its adversaries had accurately anticipated.
• Risk Level: Low (near-term) - A comprehensive, internationally coordinated framework for attributing and imposing meaningful, consistently enforced consequences on state-sponsored hybrid warfare activity is established within the coming two years. The fundamental attribution and deniability challenges inherent to hybrid operations, combined with documented divergence in allied strategic approach, make this outcome achievable only over a considerably longer institutional development timeline.

Scenario Analysis

Scenario One: Continued Sub-Threshold Escalation Without Kinetic Breakthrough (Most Probable, 2-3 Year Horizon)

The most probable near-term trajectory sees Russian and Chinese hybrid warfare activity continue its documented acceleration - further sabotage incidents, expanded AI-enhanced disinformation operations, continued cyber targeting of critical infrastructure and strategic industries - while both powers maintain careful calibration to avoid crossing the threshold that would trigger a decisive NATO collective defense response or comparable Indo-Pacific alliance activation. Western institutional response continues its current pattern of incremental expansion - additional sanctions, expanded coordination mechanisms, enhanced attribution capability - without achieving the kind of decisive deterrent effect that would meaningfully reduce the pace or intensity of adversary hybrid activity. This scenario represents a continuation and gradual intensification of the current strategic equilibrium rather than a decisive breakthrough in either direction, with cumulative institutional and societal costs across targeted democracies continuing to mount steadily rather than through any single dramatic escalatory event.

Scenario Two: Miscalculation-Driven Crisis Escalation (Moderate Probability, Higher Consequence)

A sabotage incident, cyber operation, or disinformation campaign produces consequences more severe than either the executing intelligence service or its political leadership anticipated - casualties from infrastructure sabotage, a disinformation campaign that triggers genuine civil unrest, or an undersea cable incident with cascading economic effects - creating a crisis whose severity forces Western governments to respond in a manner that crosses the threshold hybrid warfare is specifically designed to avoid triggering. This scenario reflects the genuine miscalculation risk inherent to a strategic approach that depends on precise calibration below an often ambiguous and contested threshold, and that Dutch intelligence assessments have specifically flagged as a growing concern given documented evidence of increased Russian risk tolerance since 2024.

Scenario Three: Institutional Deterrence Breakthrough Through Coordinated Allied Response (Lower Probability, Stabilizing)

A significant hybrid warfare incident, sufficiently severe and clearly attributable, catalyzes a genuinely coordinated allied response - encompassing not merely additional sanctions but substantive economic, diplomatic, and covert countermeasures specifically calibrated to impose costs on the executing intelligence services and their leadership at a scale sufficient to alter Moscow's or Beijing's cost-benefit calculation regarding continued hybrid escalation. This scenario would require the kind of rapid, decisive action that current analysis identifies as essential to proving Western deterrent threats are not hollow, alongside the cross-domain intelligence fusion and systems thinking capability that RUSI and comparable institutions have identified as prerequisites for effective grey zone deterrence but that current allied intelligence architecture has not yet fully developed.

Intelligence Forecast (6-24 Months)

The six-to-twelve-month horizon will be shaped substantially by the continued trajectory of Russian hybrid activity across the Baltic states and Poland, with particular attention warranted toward whether the pattern of airspace violations, infrastructure sabotage, and disinformation targeting documented through 2025 and early 2026 continues its accelerating trend or shows signs of the kind of calibrated moderation that might indicate Moscow's assessment that current activity levels have approached the threshold of triggering a more decisive allied response. NATO's Special Coordinator for Hybrid Threats and the alliance's Joint Intelligence and Security Division will provide important indicators of institutional response maturation, particularly regarding whether attribution and consequence-imposition mechanisms develop sufficient speed and credibility to meaningfully affect adversary calculation.

The trajectory of AI-enhanced disinformation operations through the remainder of 2026's European electoral calendar, building on the documented Matryoshka campaign and the Hungarian and German electoral targeting already observed, will provide critical evidence regarding whether these operations achieve measurable electoral influence or whether improved allied resilience and public awareness meaningfully constrains their effectiveness. The Policy Genome research initiative's continued documentation of LLM grooming techniques will be an important indicator of whether adversary information operations are successfully corrupting the broader AI information ecosystem at a scale that extends disinformation influence beyond traditional social media vectors into the AI systems increasingly mediating public information consumption.

The twelve-to-twenty-four-month horizon will be significantly shaped by whether the documented divergence in allied strategic approach - reflected specifically in the Trump administration's withdrawal from multilateral disinformation-countering cooperation - narrows or widens, with direct implications for the collective attribution and information-sharing capability that effective hybrid warfare deterrence requires. Continued monitoring of Taiwan's undersea cable security and broader critical infrastructure resilience will provide important indicators of whether Chinese hybrid warfare capability, currently less kinetically visible than Russia's European campaign, is being deployed with increasing intensity as a component of broader pressure regarding the island's political status, particularly in the context of the broader Indo-Pacific security dynamics that the Taiwan Strait's assessed 2027 contingency window continues to shape.

Final Strategic Takeaway

The transformation of intelligence agencies from instruments that inform statecraft into instruments that execute it represents one of the most consequential and least understood developments in contemporary great power competition. Russia's SVR, GRU, and FSB have grown institutionally powerful enough to shape rather than merely serve Kremlin strategy, deploying sabotage, cyber operations, and AI-enhanced disinformation as the primary tools through which Moscow contests Western resolve and cohesion without crossing the threshold that would trigger the collective military response its conventional capabilities, degraded by the Ukraine war's ongoing demands, are less prepared to withstand. China's more patient and economically embedded hybrid model, centered on the Ministry of State Security's integration of cyber espionage with calibrated economic coercion, pursues comparable strategic objectives through a distinctly different operational architecture, one whose cumulative effects on Western technological competitiveness may prove no less consequential for being less immediately visible than Moscow's sabotage campaign.

What both models share, and what defines the fundamental strategic challenge that Western democracies now confront, is the deliberate exploitation of the gap between the sophistication of gray zone conflict and the institutional and legal frameworks that democratic societies have historically relied upon to detect, attribute, and respond to hostile state action. NATO's Special Coordinator for Hybrid Threats, the European Union's Hybrid Toolbox, and the growing constellation of allied coordination mechanisms represent genuine institutional progress, but the documented acceleration of hybrid incidents through 2025 and into 2026 - activity already exceeding entire previous years' totals within a matter of months - suggests that current Western response remains fundamentally reactive, calibrated to document and occasionally sanction rather than to genuinely deter continued escalation.

The deepest lesson embedded in the FSB's catastrophically flawed pre-invasion Ukraine assessment deserves particular emphasis as this report concludes: intelligence agencies empowered to shape rather than inform strategic decision-making carry within their institutional structure a systematic risk of confirming rather than challenging the assumptions of the leadership they serve, a dynamic that increases rather than decreases the probability of the kind of catastrophic miscalculation that hybrid warfare's careful calibration is specifically designed to avoid triggering, but that remains an ever-present risk precisely because the intelligence services now driving this form of conflict have demonstrated, in the most consequential possible instance, that their analytical judgment cannot be assumed to be reliable even by the leadership that depends upon it. The shadow war being waged across Europe's railways, airspace, and information ecosystems, and across the Indo-Pacific's undersea cables and semiconductor supply chains, is not a peripheral phenomenon accompanying more conventional great power competition. For the intelligence agencies now directing it, it has become the primary theater of that competition itself.

War used to announce itself with declarations and divisions crossing borders. The shadow war announces itself with a severed cable, a derailed train, a deepfake that spreads faster than the truth that follows it - and by the time anyone can prove who did it, the damage the ambiguity was designed to inflict has already been done.

Frequently Asked Questions

What is hybrid warfare and how does it differ from conventional conflict?

Hybrid warfare is a coordinated blend of military and non-military instruments - cyberattacks, disinformation, sabotage, economic coercion, and covert influence operations - applied across physical and digital domains to achieve strategic objectives while deliberately remaining below the threshold that would trigger a conventional military or collective defense response. Unlike conventional warfare, it prioritizes ambiguity and deniability over decisive engagement.

Which Russian intelligence agencies drive hybrid warfare activity?

Three services coordinate Russia's hybrid campaign: the SVR, its foreign intelligence service under Sergei Naryshkin; the GRU, its military intelligence directorate specializing in sabotage and special operations; and the FSB, its federal security service under Alexander Bortnikov, which combines domestic security with expanding foreign operations. All three have grown institutionally powerful enough to significantly shape rather than merely inform Kremlin strategy.

How much has hybrid warfare activity increased in Europe recently?

Substantially. Data compiled by Dragonfly found suspected Russian hybrid activity in European states during 2025 had, by early October, already surpassed the entire total for 2024. Research from ICCT and GLOBSEC documented a fourfold increase in sabotage and vandalism operations, with over 150 suspected incidents across the EU and NATO by early 2026, including 321 incidents in Germany alone.

What role does artificial intelligence play in modern disinformation campaigns?

AI has dramatically accelerated hybrid warfare's cognitive dimension through synthetic media impersonating leaders, automated influence networks using AI-managed personas, real-time psychological operations tailored to individual profiles, and a technique called LLM grooming that corrupts AI outputs to spread disinformation through ostensibly neutral systems. Operations such as Matryoshka have deployed these tools extensively in Moldova and Romania.

How is China's hybrid warfare approach different from Russia's?

China's model, centered on the Ministry of State Security, is generally more patient and economically integrated, combining cyber espionage targeting semiconductor and manufacturing firms with economic coercion tools including rare earth export controls and alternative financial infrastructure, rather than the more visible sabotage and disinformation campaign that characterizes Russia's approach across Europe.

How are NATO and the EU responding to the hybrid threat?

NATO created a Special Coordinator for Hybrid Threats position in 2025, operates a Joint Intelligence and Security Division, and has launched mechanisms including the Critical Undersea Infrastructure Coordination Cell and Baltic Sentry Mission. The EU maintains a Hybrid Toolbox and the EUvsDisinfo project and imposed sanctions on six Russian individuals in January 2026, though analysts widely characterize the collective response as still predominantly defensive and reactive.