What is a war where sometimes bombs are tweets, sometimes soldiers are hackers, and from railways to undersea cables everywhere is the frontline? Europe calls it a crisis. NATO, meanwhile, calls it a problem with no clear red line. Over three years, Russia has perfected a blend of sabotage, cyberattacks, disinformation, and kinetic strikes that sits deliberately below the threshold of conventional war, daring the alliance to respond without triggering escalation.
From the sabotage of Poland’s key railway lines to the drone strikes that set a gas tanker ablaze near Romania’s border, this Moscow hybrid warfare campaign seems designed to unsettle, divide, and exhaust. Targets range from pipelines to political stability, and their perpetrators are more often than not deniable proxies. This is not Cold War Redux, but rather a fluid, protean conflict in which attribution is murky and deterrence is elusive.
The following listicle breaks down nine of the most striking elements of the Russian hybrid war in Europe, explaining how each of these tactics challenges NATO’s cohesion, tests legal boundaries, and begs the question: when does “enough” become enough?
1. Sabotage on Poland’s Lifeline to Ukraine
A section of the Warsaw–Lublin railway line, an important crossing point for Western aid into Ukraine, was blown up near Mika there was another act of damage in Puławy. Polish Prime Minister Donald Tusk said it was an “unprecedented act of sabotage” committed by two Ukrainians allegedly working at the behest of Russian intelligence who have since fled to Belarus. “Everything points to Russian sabotage,” said Poland’s security ministry. These attacks were forcing passenger trains to stop and disrupting logistics crucial for Ukraine’s defense.
This incident was by no means isolated: Poland has suffered at least 23 Russian drone incursions in recent months, underscoring its status as a frontline NATO state. The transport infrastructure strike represents part of a larger pattern that CSIS has identified: 27 percent of Russian sabotage activities since 2022 have targeted transportation, frequently around key nodes for Western military assistance.
2. Fire in Gas Carrier on Romania’s Border
The authorities evacuated an entire commune in Plauru, Romania, after a Russian drone strike set fire to the Turkish-flagged ORINDA tanker just meters away from EU and NATO territory. With 1.8 million gallons of liquefied petroleum gas on board, the vessel has been burning through the night Romanian officials warn that it “could explode at any time.”
“The attack threatens not only Ukraine but also our neighbors,” emphasized Ukraine’s Foreign Minister Andrii Sybiha, pointing to the risk of spillover into NATO territory. NATO declined public comment, but the incident demonstrated how deliberately Russia’s Danube strikes skirt the alliance’s borders, testing its will to respond.
3. Growing frequency of hybrid attacks
Sabotage operations by Russia in Europe have increased: incidents almost tripled from 2023 to 2024, after quadrupling the previous year according to CSIS data. Among the targets have been government facilities, industry, and critical infrastructure explosives and incendiaries have been used in 35% of the cases. Completing the toolkit are blunt instruments, electronic attacks, and even the weaponization of illegal migration.
This acceleration constitutes a strategic choice in Moscow to escalate the pressure on the NATO states without crossing the conventional war threshold. The ambiguity of these acts complicates attribution and delays decisive responses.
4. GRU’s Deniable Networks
Many of these operations are run by the Russia military intelligence service or GRU through groups like 29155, which poisoned Sergei Skripal, and 54654, which sets up the networks of illegal operatives under deep cover. These groups recruit locals, criminals and “disposable agents” using encrypted apps and online games.
Commercial vessels from what has become known as Russia’s “shadow fleet” have been used to cut undersea cables and conduct reconnaissance. This deniable infrastructure gives Moscow the capability to strike vital systems-pipelines, fiber-optic cables-while maintaining plausible deniability.
5. Undersea Cable Vulnerabilities
95 percent of data traffic between the US and Europe travels on Europe’s 16 transatlantic cables. Russian agencies including GUGI have mapped those routes, and even anchors dragged by commercial ships can sever them. Such damage could disrupt financial markets, military communications, and civilian Internet.
This is compounded by the use of non-specialised vessels, making sabotage harder to detect and attribute. NATO does have an undersea infrastructure coordination cell, charged with monitoring but the coverage is patchy.
6. Information Warfare as a Force Multiplier
Russian disinformation campaigns, from debates on migration to economic complaints, target social fissures in NATO states. The EU logged 505 incidents of foreign information manipulation, almost half aimed at Ukraine and others at France, Germany, and Moldova, in just one year. These operations use fake media sites, impersonation of institutions, and bot networks-73% of the channels are short-lived disposable accounts. They reduce the political will to support Ukraine and engage in the resistance against Russia through the building of mistrust and amplification of division.
7. Drone Intrusions and Kinetic Threats
Beyond surveillance, Russian drones have been used as one-way attack systems-kinetic bombs that do not return. NATO states have intercepted some, but others are penetrating airspace above Estonia and Poland. A strike on a Romanian tanker shows how critical assets can be hit without the use of troops. Although the technological capacity to counter the threat is improving, there are continuing gaps. “There’s not one solution that’ll stop a drone from coming in,” said one expert, citing the problems posed by defending against swarms or modified commercial UAVs.
8. Legal and Strategic Gray Zones
Hybrid attacks play on the reluctance of NATO to invoke Article 5 in cases of actions below the threshold of conventional war. As one Norwegian intelligence assessment phrased it, sabotage is often designed to make attribution “challenging to prove.” This legal ambiguity gives Moscow room for escalation without provoking a unified military response. This also forces NATO into reactive postures whereby, when the attribution is made, public momentum for action has waned.
9. Calls to Designate Russia a State
Sponsor of Terrorism The European Parliament called for the establishment of an EU legal framework that would designate Russia as a state sponsor of terrorism because of atrocities in Ukraine and hybrid attacks in Europe. This would establish far-reaching restrictions, from cutting diplomatic ties to the banning of Russian state-affiliated institutions. MEPs also want groups such as Wagner and the “Kadyrovites” added to the EU terrorist list. Though politically controversial, these moves are a means of raising the costs for Moscow’s hybrid warfare and closing loopholes in sanctions enforcement.
Russia’s hybrid war in Europe is not a series of isolated provocations it is part of a coherent strategy pursued to undermine NATO’s unity, exhaust its resources, and restructure the security architecture in favor of Moscow. Each tactic-from rail sabotage to deepfake propaganda-tests the thresholds and legal frameworks of the alliance. The choice for escalation or continued absorption by NATO will define the balance of power on the continent for years to come.
