Russia’s hybrid war on NATO’s Eastern Flank quietly escalates

What was left of the market hall at Marywilska street in Warsaw which was subject to a arson attack in May 2024. Photo: wikimedia.org

Mastering the hybrid warfare toolkit from 2014

What started with masked soldiers in Crimea and covert proxies in Donbas has evolved into a complex, multi-layered hybrid strategy employed by the Kremlin against the West. Over the past decade, the Kremlin has refined its Soviet-inherited playbook of active measures, combining coordinated campaigns of subversion, sabotage, cyberattacks and disinformation to weaken democratic institutions, undermine public trust, and fracture European and Euro-Atlantic unity. It has stepped up its funding of anti-establishment parties across the EU while deploying covert operatives and disinformation strategies to maximize its reach without triggering open confrontation.

Documented attacks increased fourfold between 2022 and 2023 and threefold in 2024 compared to 2023. In this regard, the Kremlin has increased both the range of targets, from critical infrastructure to transportation hubs, and the tactics used, including explosives and improvised tools. This evident escalation reflects the Kremlin’s shift towards more aggressive and adaptable hybrid disruption tactics, designed to remain just below the threshold of triggering a unified European response.

In early 2025, hybrid attacks have continued at pace, affecting multiple EU member states. In May alone, plots uncovered in Poland, the Baltic states and Romania underscored how the Kremlin continues to operate across NATO’s Eastern Flank. These hybrid incidents reflect a broader, decentralized strategy to undermine cohesion within both the EU and NATO.

Accelerating pace of hybrid attacks against NATO’s Eastern Flank since 2024

In particular, NATO’s Eastern Flank has come under an unprecedented wave of Russian hybrid attacks, with the Kremlin leveraging sabotage, disinformation and cyber instruments to undermine democratic institutions and disrupt critical infrastructure.

Poland, Ukraine’s leading supporter and a central hub for NATO logistics, has become a primary target of the Kremlin’s hybrid attacks against critical infrastructure. One striking example came in May 2025, when Polish authorities confirmed that Russian intelligence was behind the fire that destroyed the large shopping centre in Warsaw the previous year, damaging over 1,400 shops and service outlets. In response, Radoslaw Sikorski, the Polish foreign minister, announced the closure of the Russian consulate in Krakow and warned of further action if such attacks persist. In 2025, the trend has escalated, with Krzysztof Gawkowski, the Polish digital affairs minister, recently warning of an unprecedented attempt to interfere in the country’s presidential election that was scheduled for May 18th. Cyberattacks in Poland more than doubled compared to the previous year. These targeted incidents, which include hybrid attacks against water systems, as well as energy and government facilities, form part of a broader campaign to paralyse the functioning of EU member states, particularly those with a strong anti-Russian stance.

Poland has not been the only target on NATO’s Eastern Flank. Since 2024, numerous instances of Russian hybrid attacks have been recorded across the Baltic states and Romania. The Kremlin has directed these attacks against critical infrastructure, undersea cables and electoral systems, all while conducting well-coordinated disinformation campaigns.

In May 2025, Latvian authorities issued a warning about Russian agents gathering intelligence on critical infrastructure assets under the guise of tourists. In turn, in March 2025, Kremlin-linked agents conducted an arson attack on an IKEA store in Lithuania, along with the Russian sabotage of the Baltic Sea cable system, disrupting the country’s internet connectivity.

Since 2024, Estonia has seen a notable spike in cyberattacks against critical infrastructure. In particular, there has been an increase in satellite-based cyberattacks, which have disrupted the operations of airport infrastructure. Currently, the country is working actively to track the Kremlin’s “shadow fleet”, which has increased its activities over the last year and poses substantial security and environmental challenges to Estonia and the Baltic region.

At the same time, Romania is one of the recent stark examples of the Kremlin’s application of modern hybrid warfare tools. In December 2024, the country’s constitutional court annulled the 2024 presidential election after the country’s intelligence services confirmed Russian interference via fake social media accounts and cyberattacks on election systems. The Kremlin’s application of hybrid tools persisted into 2025, with evidence existing of pro-Russian hacker groups launching coordinated cyberattacks targeting the country’s foreign ministry, constitutional court, and presidential campaign websites to undermine the democratic process in the country.

Collectively, these incidents confirm that Russia is applying a coordinated hybrid warfare playbook across NATO’s Eastern Flank to paralyse democratic processes and undermine the resilience of its critical infrastructure.

A call to action to counter the Kremlin’s hybrid war

To respond effectively, the West must treat these operations as a direct assault on democratic resilience and economic stability. The Kremlin’s evolving, multi-layered strategy combines subversion, sabotage, cyberattacks and disinformation to undermine the West. Its actions across NATO’s Eastern Flank demonstrate a deliberate and well-coordinated approach that demands more than isolated national responses or reactive crisis management. While NATO (e.g., the Joint Intelligence and Security Division) and EU (e.g., the East StratCom Task Force) structures exist to counter hybrid threats, fragmented mandates and limited coordination continue to pose substantial challenges.

NATO and the EU should step up their efforts to counter Russian hybrid attacks, not just by undertaking resilience measures but also by exerting proactive, targeted pressure against Russia to raise the costs of continued attacks. This approach should include expanded sanctions targeting the Kremlin’s shadow fleet and key exports, as well as offensive cyber operations against critical Russian infrastructure. Additionally, strategic information campaigns targeted at the Russian population should also challenge the Kremlin’s narratives and undermine its domestic influence.

A western response should not remain purely defensive. It has to counter the Kremlin’s hybrid attacks that fall below the threshold of triggering a unified European response and incorporate offensive measures. This way, the West can ensure that the Kremlin is discouraged and, if necessary, respond with targeted retaliatory actions against its covert operations, particularly across the EU member states. Otherwise, the Kremlin will continue leveraging hybrid warfare tools to undermine democracies in the West.

Maksym Beznosiuk is a strategic policy expert and director of UAinFocus, an independent platform connecting Ukrainian and international experts around key issues in the country. His work spans EU–Ukraine cooperation, energy and raw materials policy, governance in conflict-affected regions, and the security-policy nexus. He holds an LL.M. in Global Environment and Climate Change Law from the University of Edinburgh, a Double Master’s in European Studies (Euroculture) from Uppsala and Jagiellonian universities, and Bachelor and Specialist degrees in International Law and International Relations from Kyiv National Taras Shevchenko University.

New Eastern Europe is a reader supported publication. Please support us and help us reach our goal of $10,000! We are nearly there. Donate by clicking on the button below.

arson, cyber attacks, Eastern flank, hybrid warfare, NATO, Russian interference, shadow fleet