ANALYSIS: Hybrid warfare: the new face of the Russian threat to NATO

ANALYSIS: Hybrid warfare: the new face of the Russian threat to NATO

Introduction: The war with no declaration

Neither peace nor open war: the territory of hybrid conflict

Hybrid warfare is not a Russian invention — but Russia has made it its preferred art form. It is a mode of conflict that unfolds in the space between peace and conventional war — hostile enough to destabilise, not overt enough to trigger a collective military response. Cyberattacks, infrastructure sabotage, influence operations, drone incursions, targeted assassinations, weaponised migration — these are the tools of Russia's hybrid arsenal. And in June 2026, that arsenal is pointed squarely at NATO's eastern flank.

On June 22, 2026, Latvian intelligence made its assessment public: Russia is preparing "hybrid military provocations" against the Baltic states or Poland. A senior political figure from a second NATO country confirmed to The Guardian that their own intelligence service was picking up signals in the same direction. These converging warnings draw a troublingly clear picture: the next frontier of the Russia-West conflict will not be in Ukraine — it will be in Baltic capitals and along Polish roads.

Why "hybrid" and not "conventional"

Latvian intelligence was explicit: Russia is incapable of a conventional war against NATO for "three to five years, even if the war in Ukraine stopped today." Its forces are bogged down in Ukraine, its personnel and equipment losses are considerable, its industrial base is running at full capacity to resupply the front — with no ability to build strategic reserves. This is not a power capable of opening a major conventional second front.

This is also why the hybrid domain is so strategically valuable to Russia right now: it allows Moscow to maintain pressure, test responses, and extract political costs from the West without triggering the unified military response that a conventional attack would demand. It is coercion at calibrated cost.

The tools of Russian hybrid warfare: an inventory

Cyberattacks: the silent weapon

Since 2014, Russia has developed a sophisticated cyber warfare capability that allows it to strike without leaving an indisputable signature. The attacks against Ukraine's energy infrastructure in 2015 and 2016, the repeated disruptions of Latvian and Estonian government systems, the attempts to interfere in the electoral processes of numerous allied countries — all operations that bear the Russian hallmark but are difficult to attribute with enough legal certainty to trigger a formal response.

Poland has officially declared that Russia is already waging a hybrid war against NATO's eastern flank — killing people, launching drones, conducting cyberattacks, and orchestrating strikes against critical infrastructure. This is not a hypothesis — it is an operational assessment grounded in documented incidents. The sabotage of undersea communications cables in the Baltic Sea, GPS interference in Nordic airspace — all these elements sketch the outline of systematic harassment.

Weaponising migration: the human weapon

Belarus, under Lukashenko's direction, has systematised since 2021 the use of migration flows as a tool of hybrid pressure. Thousands of migrants from the Middle East and Africa have been funnelled toward the Lithuanian, Latvian, and Polish borders — creating a humanitarian and security crisis that has consumed forces and political resources the targeted states would have preferred to spend elsewhere. In June 2026, data shows that 707 border crossing attempts were recorded on the Latvian border over 10 days — compared to just 9 on the Polish side — revealing active direction of these flows by Minsk.

This strategy is particularly insidious because it uses vulnerable human beings as shields and instruments. The targeted countries find themselves facing an insoluble dilemma: let the migrants through and lose control of their border, or push them back and face humanitarian criticism. Russia and Belarus exploit the democratic values of targeted countries against those countries themselves — one of the most cynical aspects of hybrid warfare.

Drones and missiles: the capability demonstration

The "accidental" incidents that are not accidents

Since the start of the war in Ukraine, several incidents involving drones and missiles in the airspace or on the territory of NATO member states have been documented. Russian Shahed drones have violated Polish and Romanian airspace during attacks on Ukraine. A Russian missile landed on Polish territory in November 2022 — killing two people, before being attributed to a Ukrainian air-defence missile following an allied investigation.

These incidents create a permanent zone of tension. NATO must decide each time: was this incident accidental or deliberate? The answer either invokes or does not invoke Article 5. Russia has every interest in maintaining this ambiguity — testing limits without crossing the visible red line. This "probing" — sounding out reactions — is a deliberate strategy to map the alliance's tolerance thresholds.

Surveillance drones: Moscow's eyes on the eastern flank

Data cited by The Guardian in June 2026 reveals a 20% increase since January in sightings of Russian reconnaissance drones entering Ukraine from Belarus. These drones serve to map Ukrainian defences — but their growing presence in border airspace also signals a systematic surveillance intention regarding the north-eastern flank. Every reconnaissance drone is strategic intelligence collected to prepare potential future operations.

By 2026, Russia's drone capabilities have evolved considerably — notably thanks to Iranian technology transfers and developments within Russia's own military-industrial complex. Modified Shahed-type drones are now guided by relay systems installed on Belarusian territory, allowing them to strike targets in western Ukraine with greater precision. This same technology could be used for deeper operations into NATO territory.

Infrastructure sabotage: operations in depth

Nord Stream 1 and 2: a precedent still unexplained

The sabotage of the Nord Stream 1 and 2 pipelines in September 2022 remains one of the most spectacular acts of infrastructure sabotage in recent history. Despite years of parallel investigations by Germany, Sweden, and Denmark, public attribution remains uncertain — a fact that speaks volumes about the difficulty of responding to hybrid acts, even major ones. This precedent demonstrates the feasibility of attacks against critical undersea infrastructure in the Baltic Sea.

Since then, several similar incidents have been documented in the region: interruptions to undersea communications cables, disruptions to civilian and military GPS systems, disturbances to power grids. The intelligence services of several allied countries — notably Finland, Estonia, and Latvia — have attributed some of these incidents to Russian or Belarusian operations. The Baltic Sea has become a zone of undersea and sublacustrine competition where the rules of conventional warfare do not clearly apply.

Information warfare: fracturing societies from within

The informational component of Russian hybrid warfare is perhaps the most insidious. Systematic disinformation operations target the populations of the Baltic states, Poland, and other NATO members — amplifying social tensions, challenging official narratives on the war in Ukraine, sowing doubt about the reliability of the alliance. These operations use social media, disinformation websites disguised as legitimate news sources, and encrypted messaging channels.

In Latvia, where a significant portion of the population is Russian-speaking, these operations find particularly fertile ground. Latvia's Bureau for the Protection of the Constitution has identified Russian influence campaigns specifically targeting Russian-speaking communities to maintain a sense of belonging to a distinct Russian information space — a strategy designed to cultivate a potential "fifth column" in the event of a crisis.

NATO's response: between adaptation and institutional inertia

The Tallinn cyber excellence centre: a model to expand

NATO is not inactive in the face of hybrid threats. The NATO Cooperative Cyber Defence Centre of Excellence based in Tallinn (CCDCOE) is one of the most advanced actors in the world in the analysis of and response to cyber threats. Its analyses and exercises — notably the annual Locked Shields exercise — allow allies to develop common capabilities and improve their interoperability in the cyber domain.

But NATO still struggles to define precisely when a cyberattack constitutes an Article 5 violation — and even more so to coordinate a collective response. The cyber defence policy adopted in 2014, updated in 2016 and 2022, still leaves attribution procedures and response protocols complex and subject to deliberation by 32 governments with different sensitivities.

The threshold question: where does Article 5 begin?

The fundamental challenge of hybrid response is one of thresholds. When does a series of isolated incidents — cyberattack, strayed drone, weaponised migrants, cable sabotage — cumulatively constitute aggression that triggers Article 5? NATO has begun developing a doctrine of "resilience" that does not rely solely on military retaliation but on the capacity to absorb and recover from hybrid aggressions.

Several countries have adopted the concept of "total defence" — Estonia, Finland, Sweden — which involves the whole of society in preparing for national resilience. These models, developed from an acute awareness of the Russian threat, offer valuable lessons for the entire alliance. But their widespread adoption takes time — time that the eastern flank cannot afford to waste.

The economic dimension of hybrid warfare: disrupting supply chains

Destabilising an economy without firing a single shot

Russian hybrid warfare also targets the supply chains and economic networks of the countries it aims to destabilise. Coordinated disruptions of Baltic Sea port logistics systems, attacks against payment systems, attempts to destabilise local financial markets — all actions that can inflict significant economic costs without triggering a military response. In Estonia and Latvia, economic resilience exercises were conducted in 2025–2026 precisely to test the ability of national economies to function under hybrid pressure.

The energy dimension remains particularly sensitive. Despite the disconnection of the Baltic electricity grid from the Russian BRELL system — scheduled for 2025–2026 — the transition toward synchronisation with the European network temporarily creates a window of vulnerability. Intelligence services have identified Russian attempts to identify and map the new interconnections for potential future disruptions. Latvia and Estonia have strengthened the physical protection of their critical energy infrastructure in response to these documented threats.

Transport networks and NATO's military logistics

NATO's ability to rapidly reinforce its eastern flank in a crisis depends on transport networks — roads, bridges, railways, ports — which are natural targets for hybrid warfare. Sabotage operations against these infrastructures could significantly delay allied reinforcement in the critical days following a provocation. Latvian intelligence has identified Russian reconnaissance activity in areas housing strategic transport infrastructure.

NATO launched the DIANA programme (Defence Innovation Accelerator for the North Atlantic) to accelerate the development of dual-use technologies — civilian and military — that strengthen the resilience of critical infrastructure. Investments have also been made in securing the rail networks of Rail Baltica — the high-speed railway line under construction connecting the Baltic states to Poland and the rest of Europe. This line is both an economic connectivity asset and a military logistics priority.

Cooperation with Ukraine: learning from those already at war

Ukraine as a source of anti-hybrid doctrine

Ukraine has developed since 2014 a unique experience of large-scale hybrid warfare. Its capacity to identify, attribute, and counter Russian hybrid operations has become a strategic resource for all of NATO. Ukrainian cybersecurity services have demonstrated their resilience against state-level attacks, developing countermeasures and doctrines that the Baltic states and Poland are actively absorbing.

Cooperation between Ukrainian intelligence services and their Baltic and Polish counterparts has reached a level of integration rarely seen between formal allies. This intense, if informal, cooperation has allowed the real-time identification of several Russian hybrid operations before they produced their intended effects. The Ankara summit should formalise and expand this cooperation — creating permanent structures for intelligence-sharing on hybrid threats between NATO members and Kyiv.

Lessons from Ukraine's counter-disinformation effort

The fight against Russian disinformation may be the domain where Ukrainian lessons are most valuable. Ukraine has developed rapid fact-checking mechanisms, networks of journalists trained to identify and dismantle Russian narratives, and partnerships with digital platforms for a faster response to coordinated disinformation campaigns. These mechanisms, built under the pressure of an existential war, have documented effectiveness.

The Baltic states have integrated some of these practices into their own informational resilience systems. Estonia, in particular, has an advanced counter-disinformation ecosystem, including media literacy programmes from primary school onwards and both governmental and civil verification teams. These models should be diffused across all NATO members — not by mandate, but out of obvious strategic self-interest.

The legal dimension: when law becomes a weapon

Russian lawfare against the Baltic states

Beyond physical and digital operations, Russia also uses international legal instruments as weapons in its hybrid war. Latvian intelligence has documented a plan to pursue legal action before the International Court of Justice (ICJ) against the Baltic states, accusing them of discriminating against Russian-speaking minorities. This strategy of "lawfare" — using international law as a destabilisation tool — aims to construct a narrative of legitimacy for a potential future action.

The Ukrainian precedent is instructive: before each escalation in 2014 and 2022, Russia had developed narratives about "protecting oppressed Russian-speaking populations." These narratives, endlessly repeated in pro-Kremlin media and on social networks, had primed part of international opinion toward a certain moral ambiguity. The same strategy is now being deployed against the Baltic states — with legal arguments as the veneer of legitimacy for a future action.

NATO's institutional response to Russian lawfare

NATO and the European Union have developed "counter-lawfare" capabilities — systematically refuting Russian legal narratives, documenting Russia's violations of international law, and building a robust legal case. But this response is asymmetric: Russia can spread unfounded accusations quickly and at mass scale, while the rigorous legal response takes time. In information warfare, speed often trumps precision.

The International Criminal Court (ICC) issued an arrest warrant for Vladimir Putin in March 2023 for the deportation of Ukrainian children. This symbolically important act does not prevent Moscow from continuing its hybrid activities — but it builds a legal corpus documenting the violations and credibilising the image of a Russia that operates outside international law. This legal corpus will be invaluable in any future peace process or accountability proceedings.

Conclusion: Hybrid warfare demands a hybrid response

The need for an adapted doctrine

Russian hybrid warfare is not new — but its intensification toward NATO's eastern flank in the summer of 2026 represents a qualitative escalation. The Latvian warnings, the documented incidents, the strategic logic of Putin's response to his difficulties in Ukraine — everything points toward increasing hybrid pressure in the months ahead. NATO must respond with an adapted doctrine — one that is not limited to conventional military retaliation but integrates cyber resilience, resistance to disinformation, critical infrastructure security, and total societal defence.

The Ankara summit will have to address hybrid warfare explicitly — not generically, but with concrete commitments on response capabilities, attribution thresholds, and solidarity mechanisms in the event of a hybrid incident. Without this, declarations of mutual support remain hollow words in the face of a threat that is very concrete indeed.

Ukraine as the laboratory for hybrid response

Ukraine's experience facing Russian hybrid warfare — from 2014 through to its most sophisticated forms in 2026 — constitutes the most valuable laboratory NATO could have. Ukraine has developed cyber defence, counter-disinformation, drone warfare, and civilian population resilience capabilities that surpass allied Western capabilities in certain domains. Sharing these experiences, integrating Ukrainian lessons into NATO's doctrine — this is a strategic imperative the Ankara summit must not miss.

By Maxime Marquette, columnist

Columnist's transparency note

My biases and convictions

I consider Russian hybrid warfare a real and documented threat, not a Western narrative construct designed to justify increased military spending. This conviction shapes my analysis. I acknowledge that some incidents may have explanations other than those provided by Western intelligence services — analytical transparency requires noting this.

I recognise that intelligence services — including Western ones — sometimes overstate threats for institutional reasons, or that public assessments reflect policy priorities rather than purely objective analysis. I have tried to triangulate across multiple independent sources to reduce this risk, while acknowledging I cannot eliminate it.

My sources

My analysis draws on public reports from Latvian and Polish intelligence services, ISW reports, investigations by Meduza and The Guardian, and public documentation of hybrid incidents in the region. All my sources are dated from the May–June 2026 period, except where historical facts are noted separately.

All my sources are publicly available and date from the May–June 2026 period, with the exception of historical context which draws on well-established public knowledge of events from 2014 onward. I have not relied on anonymous sources or unverified accounts.

Sources

Primary sources

Meduza — Latvia warns Russia planning hybrid attacks on Baltics and Poland — June 23, 2026

The Guardian — Russia preparing provocation in Baltic states or Poland — June 26, 2026

Euromaidan Press — Polish FM warns: Putin's rhetoric is provocation announcement — June 24, 2026

Secondary sources

The Guardian — Ukraine bolsters northern defences amid Belarus fears — June 18, 2026

iSANS — Belarus Review June 15, 2026

Euromaidan Press — Lukashenka announces war preparations — May 13, 2026

VERTEX YouTube — NATO Allies Warn Russia May Target Baltics, Belarus Border — June 26, 2026

Militarnyi — Zelensky: Russia deploys relay transmitters in Belarus — February 18, 2026