Russia’s Hybrid Warfare and Sabotage: A Threat to Europe or an Overblown Scare?
Expert, political, and public debate regarding the real Russian threat to Euro-Atlantic civilization has been heated and ongoing since Russia’s annexation of Crimea in 2014 and the invasion of the Donbas region of Ukraine by Russian troops in 2022. Russian war rhetoric further reinforces these narratives and, using all means of so-called psychological warfare, purposefully escalates the situation.
However, views on the Russian threat vary widely. In general, it can be said that the security expert community is more or less in agreement regarding the real threat emanating from the Kremlin, but political and public discourse is highly polarized and largely divided. Society is divided—though not always into groups of equal size—and is logically fragmented, as there is no majority political consensus on issues of national security and defense.
Is the Czech Republic a safe haven?
The assertion that the Czech Republic has long been considered one of the safest countries in the world may be perceived as a cliché. The majority of society takes this fact for granted. However, the current global situation is so dynamic that it is disrupting the existing order and bringing new, often unexpected security challenges. Reports portraying the Czech Republic as a safe haven in a stormy sea often lead a large portion of the Czech public to believe that while Russia is indeed a hostile power, these threats do not directly concern us, and that all conflicts and hostile activities are taking place far beyond our borders. In other words, there is a prevailing notion that the enemy is still at the gates, while the fact that it has long since been inside is completely overlooked. Russia has been waging a strategic campaign to influence Western civilization for more than three decades. What began as Soviet “active measures”—i.e., disinformation, front organizations, agent recruitment, or ideological subversion—evolved in the 1990s and the first decade of the new millennium into a sophisticated modern doctrine combining corruption, cultural penetration, energy coercion, and information manipulation. Examples of this include new modern threats such as hybrid conflicts (i.e., a combination of propaganda, cyberattacks, economic pressure, or sabotage) aimed at eroding citizens’ trust in the state, its institutions, and the media. With the help of various non-state actors—who, however, work in alignment with Kremlin interests—Russia is waging a systematic cyberwar against us with the ultimate goal of paralyzing the state without firing a single shot. Similarly, artificial intelligence capabilities have begun to be exploited for even more targeted, personalized, faster, and, above all, cheaper manipulation of public opinion.
The purpose of this brief reflection is to describe a few selected real-world phenomena that have long been part of our everyday lives. The examples chosen are hostile actions that did not receive much media attention in the Czech Republic. Long before the start of its aggression in Ukraine, Russia has been systematically testing various targets through cyberattacks directed against a wide range of locations in the Euro-Atlantic area:
- Since 2017, Moscow has carried out a series of cyberattacks using the NotPetya malware. In February 2018, the United States designated NotPetya as the most destructive and costly attack in history. Although the Czech Republic was only marginally affected by this attack, it impacted more than 100 countries worldwide and caused total damages exceeding $10 billion.
- In September and October 2022, Norwegian security forces detected unknown drones flying over more than ten Norwegian oil and gas infrastructure facilities in the North Sea. The Norwegian intelligence service PST explicitly stated that the purpose of the flights was Russian sabotage or mapping of energy infrastructure. Several Russian nationals were detained, including Andrei Yakunin, the son of a close associate of Putin.
- In October 2023, an anchor chain dragged across the Balticconnector gas pipeline on the seabed of the Baltic Sea, causing the shutdown of the only gas interconnector between Finland and Estonia and damaging the Estlink-1 data cable. The ship that caused this damage sailed straight to a Russian port, and the pipeline was out of service for 7 months.
- In November 2024, two similar incidents occurred, this time damaging undersea cables between Finland and Germany and a cable between Lithuania and Sweden.
- In December 2024, a tanker that was part of Russia’s shadow fleet dragged its anchor 100 kilometers along the seabed, severing the main Estlink-2 power cable between Finland and Estonia. The Finnish grid temporarily lost 65% of its interconnection capacity with Estonia.
- In the spring of 2025, hackers gained remote access to the control systems of a hydroelectric power plant in Norway and opened the spillway gate for four hours. Norway attributed the attack to pro-Russian hackers and stated that its purpose was to instill fear and unrest among the population.
- Here is another example, this time from Sweden: in April 2026, the Swedish government publicly attributed a cyberattack on a thermal power plant in western Sweden to a group linked to Russian intelligence services.
Russian acts of sabotage on European soil
These incidents are no coincidence. They follow a pattern—and that pattern has its own logic. Prior to 2022, Russia used its trained intelligence officers for operations abroad. These operations were meticulously planned and relatively rare in number. The Russian terrorist attack in Vrbětice and the GRU’s actions targeting its former collaborators (e.g., the Skripal case) also fit into this pattern. With the expulsion of a large number of Russian intelligence officers operating in the EU under diplomatic cover, the Kremlin and its security structures had to adapt to the new situation. Russian intelligence services devised a new operational model for carrying out sabotage operations in various European countries. Recruitment operations are conducted through various social media platforms, primarily via Telegram channels. The recruited individual (usually someone struggling with personal problems) is given a specific task—such as photographing a building, setting a warehouse on fire, or delivering a package. The person is unaware of the full scope of the operation and is paid either in cryptocurrency or in cash. Typically, they have no idea they are working for Moscow. The International Center for Counter-Terrorism and GLOBSEC published a report in 2025 and 2026 analyzing a total of 151 sabotage incidents and identified 172 individuals involved in them between February 2022 and February 2026. Approximately 95% of them had no demonstrable ties to Russian intelligence services. They were repeat offenders, economically desperate migrants, and minors recruited via TikTok or Telegram. Sabotage operations in Europe quadrupled in 2024 compared to 2023.
The primary criterion for selecting targets of Russian sabotage is, above all, their connection to support for Ukraine. Under this model, there is no clear distinction between military and commercial targets. The main objective is to sow fear and panic, overwhelm the security forces of the country where the sabotage is taking place, and generate public pressure on governments to end their support for Ukraine. After 2022, Russian intelligence services “dusted off” the sabotage doctrines of the Soviet KGB, from which they drew significant inspiration. It is important to note that the Soviet Union never actually put these doctrines into practice; this has only happened under Vladimir Putin’s current administration. And an entirely different matter is the use of sabotage operations not only to spread fear and influence public opinion, but to destroy a country’s critical and military infrastructure in the event of a direct military conflict with Russia.
