A new report from The Soufan Center (TSC), titled Priming, Destabilizing, Coercing: Russian Hybrid Tactics in Europe 2022–2025, provides a stark picture of Russia’s evolving approach to hybrid warfare. Covering 255 documented incidents across France, Germany, the United Kingdom, Estonia, Moldova, and Georgia, the study traces patterns in Russian operations while highlighting strategies European countries can employ to resist interference. Based on a unique open-source incident database and 22 expert interviews with intelligence officials, government advisors, and academics, the report underscores how Moscow’s tactics are calibrated to exploit societal divides, test military thresholds, and impose asymmetric costs on its targets.
The researchers, including Nikkie Lyubarsky and Clara Broekaert of TSC, note that Russia has normalized a persistent operational tempo on European soil, making hybrid threats an almost daily reality. “Flooding the zone with low-cost operations forces democracies to choose between appearing weak or hysterical,” Lyubarsky explained. Broekaert adds that this strategy is cheap and scalable for Moscow while placing the burden of defense and resilience squarely on the targeted countries and their citizens. Importantly, the report highlights a shift toward physical probing and infrastructure sabotage, as information campaigns alone have failed to yield the Kremlin’s desired outcomes.
Across the six countries analyzed, Russia’s hybrid tactics were guided by two overarching objectives: first, to impose sustained costs on European states that support Ukraine or step outside Moscow’s sphere of influence; second, to exploit existing societal schisms, erode trust in institutions, and polarize populations. This cost asymmetry allowed Russia to operate with minimal direct investment while compelling targeted nations to expend disproportionate resources on defense, attribution, and mitigation. Operations did not require absolute success; Moscow only needed Europe to continue responding, stretching political, financial, and military bandwidth thin.
The report reveals context-dependent playbooks tailored to each country’s vulnerabilities. In France, Russia primarily targeted social and informational domains, exploiting pre-existing divisions among religious and ethnic communities. Incidents ranged from pig heads placed outside Parisian mosques to mock coffins draped in French flags beneath the Eiffel Tower, coinciding with the Paris Olympics, legislative elections, and European Parliament vote. Hybrid incidents in France surged 240 percent between 2022 and 2024, reflecting the Kremlin’s focus on events with high political and symbolic visibility.
Germany and the United Kingdom, by contrast, were treated as high-value military and logistical targets. Germany recorded 57 incidents, the highest in the dataset, with intelligence preparation the dominant tactic. Russian assets mapped weapons routes, monitored Ukrainian troops training on German soil, and probed critical infrastructure. In the UK, Russian vessels loitered near undersea cables, likely planting surveillance devices, while arson and territorial water incursions highlighted Moscow’s willingness to employ physical, attributable actions. Both nations demonstrate Moscow’s dual approach: plausible deniability via intermediaries combined with direct state action when necessary.
Estonia, a NATO member, faced near-continuous hybrid pressure, including disinformation targeting Russian speakers, undersea cable sabotage, and MiG-31 airspace incursions in 2025 that triggered NATO Article 4 consultations. Moldova, in contrast, experienced an intense information campaign exploiting clergy influence, vote-buying, and societal polarization, yet a pro-European parliamentary majority was successfully secured in 2025 through real-time attribution and legal interventions, illustrating the potential for resistance when operations are publicly countered. Georgia, benefiting from years of pre-established influence networks, saw 37 percent of incidents classified as coercive, often linked to the military domain, reflecting Russia’s ability to achieve strategic objectives without conventional warfare.
The study identifies two structural shifts in Russia’s tactics between 2022 and 2025. First, the outsourcing of operations to disposable intermediaries, often petty criminals or social media recruits, expanded sharply, increasing 254 percent between 2023 and 2024. This allowed Moscow to maintain operational reach following mass expulsions of Russian agents from Europe. Second, a physical escalation emerged in 2025, with more overt reconnaissance, drone activities, airspace violations, and infrastructure-targeted operations, especially in NATO states, signaling Moscow’s testing of European response thresholds.
Operational trends reveal distinct target profiles. France, Estonia, and Moldova were primarily hit in the social and informational domains, exploiting narratives, disinformation, and public unrest. Germany and the UK faced predominantly military and infrastructure-focused attacks, emphasizing intelligence preparation, undersea surveillance, and sabotage. Georgia’s operations were uniquely coercive, blending political influence and social manipulation, reflecting Russia’s entrenched presence on the ground. Across all six countries, hybrid campaigns were adaptive, continuously calibrated to each state’s geopolitical function and domestic vulnerabilities.
The choice of actors further underscores Russia’s strategic sophistication. In Germany, 75 percent of operations were carried out through intermediaries, maximizing deniability. The UK and Georgia, in contrast, experienced the highest rates of direct Russian state action, including naval transits, territorial incursions, and coercive administrative measures. Moldova’s hybrid landscape was dominated by sustained campaigns, while Germany’s was episodic, reflecting differing operational objectives and historical influence infrastructures.
Despite the scale of operations, the report emphasizes that impact is not solely determined by Russian capabilities or frequency of attacks. Societal resilience, institutional strength, and transparent attribution mechanisms largely shape outcomes. Estonia’s Russian-speaking population, for instance, has significantly reduced trust in Kremlin-controlled media since February 2022, blunting the effectiveness of disinformation campaigns. France, however, remains vulnerable due to pre-existing societal tensions that amplify the impact of hybrid incidents. Public attribution, therefore, is a double-edged tool: it can deter further action but also risk overreaction, panic, or propaganda victories for Moscow.
Effective countermeasures, according to TSC, require a two-pronged approach. European states must raise the cost of hybrid operations through coordinated attribution, intelligence sharing, and strategic deterrence while simultaneously reducing the surface area of impact by strengthening civil society, local governance, and judicial accountability. Strategic muteness, or avoiding overreaction to nuisance-level operations, is crucial to prevent playing into Russian narratives of Western hysteria. Only by threading this delicate balance can democracies mitigate the asymmetric advantage Russia derives from its hybrid campaigns.
The longitudinal analysis of 255 incidents across six European states reveals a methodical and adaptive Russian strategy. Intermediary individuals became the dominant actor type by 2024, particularly in operations targeting elections in France, Germany, and Moldova. Meanwhile, physical escalation in 2025 demonstrated Moscow’s readiness to shift from virtual influence to tangible probing when testing European defense mechanisms. The combination of low-cost, scalable operations with targeted physical measures reflects a sophisticated understanding of cost asymmetry: Moscow invests minimally while forcing European nations to absorb significant financial, political, and operational burdens.
The report concludes that hybrid warfare in Europe from 2022 to 2025 is characterized by its doctrinal coherence and adaptability. Russia calibrates its tactics to the vulnerabilities, geopolitical significance, and internal divisions of each target state, exploiting the intrinsic openness of democratic societies. Democracies’ tolerance for dissent and debate allows foreign actors to embed themselves within civil society, media, or public discourse. Attempts to mitigate interference risk appearing undemocratic, further amplifying Moscow’s strategic gains. Addressing this complex challenge requires coordinated action that simultaneously raises the cost of Russian operations while reinforcing the societal and institutional resilience that determines whether such operations land effectively.
