Russia Escalating Hybrid Attacks across Europe
Russia is escalating hybrid warfare across Europe—dubbed New Generation Warfare—combining influence operations, sabotage, cyber attacks, and airspace incursions against critical infrastructure. Russian NGW tactics target European critical infrastructure through five vectors: influence operations, airspace incursions, maritime violations, physical sabotage, and offensive cyber operations. Cyber activity emphasizes access-oriented attacks on firewalls, VPNs, and email services for intelligence collection rather than immediate disruption. Insikt Group assesses Russia will likely escalate into a full-scale NGW campaign within two years, exploiting perceived Western disunity before the 2028 US election.
Detection / Hunteropenrouter
Immediate Actions
- Enforce phishing-resistant MFA on internet-facing services
- Coordinate with national CERT and NCSC on incident response
- Verify insider threat and contractor vetting programs
- Establish rapid liaison channels with law enforcement
Key Takeaways
- 30 airspace violations tracked Sep 2025–Jan 2026 versus 23 from Mar 2022–Aug 2025.
- Physical sabotage operations increased four-fold between 2023 and 2024.
- Named influence campaigns include Doppelgänger, Operation Overload, Operation Undercut, and CopyCop.
- Leipzig drone carried military-grade hexogen explosives targeting cargo infrastructure supporting Ukraine logistics.
- Putin likely sees a window of opportunity before the 2028 US Presidential election.
Attack Chain
- Influence Operations: Disinformation campaigns impersonate media outlets to manipulate European public opinion
- Airspace Incursions: Drones and jets violate NATO airspace near strategic sites to test defenses
- Maritime Violations: Surface drones and vessels target undersea cables and energy infrastructure
- Physical Sabotage: Arson, bombings, and vandalism degrade critical infrastructure in NATO territory
- Cyber Operations: Access-oriented attacks on firewalls and VPNs; DDoS degrades government portals
Affected Systems
- European critical infrastructure facilities
- Internet-facing firewalls and VPN appliances
- Email services and web portals
- Undersea communications cables
- Logistics and transportation hubs
- Defense supply chain networks
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | Strategic hybrid warfare assessment; minimal endpoint artifacts described. |
| Network Visibility | Medium | DDoS and access-oriented operations against firewalls and VPNs visible on network logs. |
| Detection Difficulty | Hard | Spans physical and cyber domains; attribution requires geopolitical intelligence context. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Spike in access attempts against internet-facing firewalls and VPNs during politically significant events (T1190). | Firewall and VPN authentication logs | Initial Access | Medium — legitimate scanning or admin activity possible |
| DDoS traffic patterns targeting government portals or logistics infrastructure during political events (T1498). | Network flow data and DDoS protection alerts | Impact | Low — traffic spikes have clear volumetric patterns |
Required Log Sources
- Firewall authentication and access logs
- VPN connection logs
- DDoS protection alerts
- Network flow data
- Email gateway logs
- DNS resolution logs
Key Behavioral Indicators
- Coordinated access attempts on VPN infrastructure
- DDoS spikes during politically significant events
- Unusual reconnaissance of critical facility networks
- Multi-vector attacks combining cyber and physical timing
Control Gaps
- Physical security monitoring not integrated with cyber detection
- Influence operations monitoring outside SOC scope
- Undersea cable infrastructure monitoring gaps
- Insider threat vetting for contractor access insufficient
False Positive Assessment
Medium — hybrid warfare indicators span physical and cyber; distinguishing state activity from criminal activity requires geopolitical context.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Harden physical security at cable landing sites
- Deploy anti-drone countermeasures at critical facilities
- Map alternative sea routes for supply chain resilience
- Strengthen perimeter detection and access controls
User Protection
- Train staff to report suspicious drone or aerial activity
- Implement communication response protocols for influence ops
- Monitor Russia-nexus narratives targeting organization
Security Awareness
- Brief personnel on physical sabotage threat indicators
- Establish reporting procedures for suspicious activities near facilities
MITRE ATT&CK Mapping
Initial Access
Impact
Plain-Language Summary
Russia is waging a campaign of covert attacks across Europe that combines hacking, propaganda, physical sabotage, and military provocations. The targets are critical infrastructure like airports, energy facilities, and communications cables in NATO countries. European governments and companies should strengthen physical security, improve cyber defenses, and coordinate with national security agencies. Russia is expected to escalate these attacks over the next two years.