ANALYSIS: Hybrid warfare: the new face of the Russian threat to NATO

Neither peace nor open war: the territory of hybrid conflict

Hybrid warfare is not a Russian invention — but Russia has made it its preferred art form. It is a mode of conflict that unfolds in the space between peace and conventional war — hostile enough to destabilise, not overt enough to trigger a collective military response. Cyberattacks, infrastructure sabotage, influence operations, drone incursions, targeted assassinations, weaponised migration — these are the tools of Russia's hybrid arsenal. And in June 2026, that arsenal is pointed squarely at NATO's eastern flank.

On June 22, 2026, Latvian intelligence made its assessment public: Russia is preparing "hybrid military provocations" against the Baltic states or Poland. A senior political figure from a second NATO country confirmed to The Guardian that their own intelligence service was picking up signals in the same direction. These converging warnings draw a troublingly clear picture: the next frontier of the Russia-West conflict will not be in Ukraine — it will be in Baltic capitals and along Polish roads.

Why "hybrid" and not "conventional"

Latvian intelligence was explicit: Russia is incapable of a conventional war against NATO for "three to five years, even if the war in Ukraine stopped today." Its forces are bogged down in Ukraine, its personnel and equipment losses are considerable, its industrial base is running at full capacity to resupply the front — with no ability to build strategic reserves. This is not a power capable of opening a major conventional second front.

This is also why the hybrid domain is so strategically valuable to Russia right now: it allows Moscow to maintain pressure, test responses, and extract political costs from the West without triggering the unified military response that a conventional attack would demand. It is coercion at calibrated cost.

There is something deeply unsettling about the logic of hybrid warfare. Precisely because it stays below the Article 5 trigger threshold, it creates a legal and political grey zone that paralyses responses. NATO was built to respond to a clear attack. It is not well equipped to respond to a series of ambiguous, deniable incidents, calculated to stay just below the threshold for collective retaliation.

Cyberattacks: the silent weapon

Since 2014, Russia has developed a sophisticated cyber warfare capability that allows it to strike without leaving an indisputable signature. The attacks against Ukraine's energy infrastructure in 2015 and 2016, the repeated disruptions of Latvian and Estonian government systems, the attempts to interfere in the electoral processes of numerous allied countries — all operations that bear the Russian hallmark but are difficult to attribute with enough legal certainty to trigger a formal response.

Poland has officially declared that Russia is already waging a hybrid war against NATO's eastern flank — killing people, launching drones, conducting cyberattacks, and orchestrating strikes against critical infrastructure. This is not a hypothesis — it is an operational assessment grounded in documented incidents. The sabotage of undersea communications cables in the Baltic Sea, GPS interference in Nordic airspace — all these elements sketch the outline of systematic harassment.

Weaponising migration: the human weapon

Belarus, under Lukashenko's direction, has systematised since 2021 the use of migration flows as a tool of hybrid pressure. Thousands of migrants from the Middle East and Africa have been funnelled toward the Lithuanian, Latvian, and Polish borders — creating a humanitarian and security crisis that has consumed forces and political resources the targeted states would have preferred to spend elsewhere. In June 2026, data shows that 707 border crossing attempts were recorded on the Latvian border over 10 days — compared to just 9 on the Polish side — revealing active direction of these flows by Minsk.

This strategy is particularly insidious because it uses vulnerable human beings as shields and instruments. The targeted countries find themselves facing an insoluble dilemma: let the migrants through and lose control of their border, or push them back and face humanitarian criticism. Russia and Belarus exploit the democratic values of targeted countries against those countries themselves — one of the most cynical aspects of hybrid warfare.

The weaponisation of migrants as a hybrid warfare tool is one of the most morally repugnant features of Russian strategy. These men, women, and children are not pawns — but that is exactly how Moscow and Minsk treat them. Europe must find a response that protects both its borders AND the human dignity of the people involved — not by choosing one over the other.

The "accidental" incidents that are not accidents

Since the start of the war in Ukraine, several incidents involving drones and missiles in the airspace or on the territory of NATO member states have been documented. Russian Shahed drones have violated Polish and Romanian airspace during attacks on Ukraine. A Russian missile landed on Polish territory in November 2022 — killing two people, before being attributed to a Ukrainian air-defence missile following an allied investigation.

These incidents create a permanent zone of tension. NATO must decide each time: was this incident accidental or deliberate? The answer either invokes or does not invoke Article 5. Russia has every interest in maintaining this ambiguity — testing limits without crossing the visible red line. This "probing" — sounding out reactions — is a deliberate strategy to map the alliance's tolerance thresholds.

Surveillance drones: Moscow's eyes on the eastern flank

Data cited by The Guardian in June 2026 reveals a 20% increase since January in sightings of Russian reconnaissance drones entering Ukraine from Belarus. These drones serve to map Ukrainian defences — but their growing presence in border airspace also signals a systematic surveillance intention regarding the north-eastern flank. Every reconnaissance drone is strategic intelligence collected to prepare potential future operations.

By 2026, Russia's drone capabilities have evolved considerably — notably thanks to Iranian technology transfers and developments within Russia's own military-industrial complex. Modified Shahed-type drones are now guided by relay systems installed on Belarusian territory, allowing them to strike targets in western Ukraine with greater precision. This same technology could be used for deeper operations into NATO territory.

What strikes me about this technological escalation in drones is that it fundamentally changes the geography of the threat. There is no longer any "strategic depth" for the Baltic states or Poland in a world where long-range drones can strike anywhere. The defence of Tallinn or Warsaw now begins thousands of kilometres away — or in cyberspace — not at the border.

Nord Stream 1 and 2: a precedent still unexplained

The sabotage of the Nord Stream 1 and 2 pipelines in September 2022 remains one of the most spectacular acts of infrastructure sabotage in recent history. Despite years of parallel investigations by Germany, Sweden, and Denmark, public attribution remains uncertain — a fact that speaks volumes about the difficulty of responding to hybrid acts, even major ones. This precedent demonstrates the feasibility of attacks against critical undersea infrastructure in the Baltic Sea.

Since then, several similar incidents have been documented in the region: interruptions to undersea communications cables, disruptions to civilian and military GPS systems, disturbances to power grids. The intelligence services of several allied countries — notably Finland, Estonia, and Latvia — have attributed some of these incidents to Russian or Belarusian operations. The Baltic Sea has become a zone of undersea and sublacustrine competition where the rules of conventional warfare do not clearly apply.

Information warfare: fracturing societies from within

The informational component of Russian hybrid warfare is perhaps the most insidious. Systematic disinformation operations target the populations of the Baltic states, Poland, and other NATO members — amplifying social tensions, challenging official narratives on the war in Ukraine, sowing doubt about the reliability of the alliance. These operations use social media, disinformation websites disguised as legitimate news sources, and encrypted messaging channels.

In Latvia, where a significant portion of the population is Russian-speaking, these operations find particularly fertile ground. Latvia's Bureau for the Protection of the Constitution has identified Russian influence campaigns specifically targeting Russian-speaking communities to maintain a sense of belonging to a distinct Russian information space — a strategy designed to cultivate a potential "fifth column" in the event of a crisis.

Information warfare may worry me even more than missiles and drones. A missile can be seen, tracked, intercepted. A disinformation narrative that takes root in the minds of a fraction of the population cannot be detected on a radar screen. And in a democracy, freedom of expression further complicates the response. That is the fundamental paradox of democracy facing hybrid warfare.

The Tallinn cyber excellence centre: a model to expand

NATO is not inactive in the face of hybrid threats. The NATO Cooperative Cyber Defence Centre of Excellence based in Tallinn (CCDCOE) is one of the most advanced actors in the world in the analysis of and response to cyber threats. Its analyses and exercises — notably the annual Locked Shields exercise — allow allies to develop common capabilities and improve their interoperability in the cyber domain.

But NATO still struggles to define precisely when a cyberattack constitutes an Article 5 violation — and even more so to coordinate a collective response. The cyber defence policy adopted in 2014, updated in 2016 and 2022, still leaves attribution procedures and response protocols complex and subject to deliberation by 32 governments with different sensitivities.

The threshold question: where does Article 5 begin?

The fundamental challenge of hybrid response is one of thresholds. When does a series of isolated incidents — cyberattack, strayed drone, weaponised migrants, cable sabotage — cumulatively constitute aggression that triggers Article 5? NATO has begun developing a doctrine of "resilience" that does not rely solely on military retaliation but on the capacity to absorb and recover from hybrid aggressions.

Several countries have adopted the concept of "total defence" — Estonia, Finland, Sweden — which involves the whole of society in preparing for national resilience. These models, developed from an acute awareness of the Russian threat, offer valuable lessons for the entire alliance. But their widespread adoption takes time — time that the eastern flank cannot afford to waste.

I genuinely believe that the Finnish or Estonian model of "total defence" is the model all of Europe should adopt. This is not militarism — it is democratic resilience. A society that prepares to resist disinformation, power outages, and cyberattacks is not a militarised society. It is a society that takes its own survival seriously.

Destabilising an economy without firing a single shot

Russian hybrid warfare also targets the supply chains and economic networks of the countries it aims to destabilise. Coordinated disruptions of Baltic Sea port logistics systems, attacks against payment systems, attempts to destabilise local financial markets — all actions that can inflict significant economic costs without triggering a military response. In Estonia and Latvia, economic resilience exercises were conducted in 2025–2026 precisely to test the ability of national economies to function under hybrid pressure.

The energy dimension remains particularly sensitive. Despite the disconnection of the Baltic electricity grid from the Russian BRELL system — scheduled for 2025–2026 — the transition toward synchronisation with the European network temporarily creates a window of vulnerability. Intelligence services have identified Russian attempts to identify and map the new interconnections for potential future disruptions. Latvia and Estonia have strengthened the physical protection of their critical energy infrastructure in response to these documented threats.

Transport networks and NATO's military logistics

NATO's ability to rapidly reinforce its eastern flank in a crisis depends on transport networks — roads, bridges, railways, ports — which are natural targets for hybrid warfare. Sabotage operations against these infrastructures could significantly delay allied reinforcement in the critical days following a provocation. Latvian intelligence has identified Russian reconnaissance activity in areas housing strategic transport infrastructure.

NATO launched the DIANA programme (Defence Innovation Accelerator for the North Atlantic) to accelerate the development of dual-use technologies — civilian and military — that strengthen the resilience of critical infrastructure. Investments have also been made in securing the rail networks of Rail Baltica — the high-speed railway line under construction connecting the Baltic states to Poland and the rest of Europe. This line is both an economic connectivity asset and a military logistics priority.

Hybrid warfare now strikes at something fundamental: a society's ability to function. Ports, power grids, railways, financial systems — all of it can become a silent weapon. Europe's defence is no longer played out solely in military headquarters but in the crisis management rooms of infrastructure companies and financial regulators. This reality has not yet fully penetrated the political consciousness of European democracies.

Ukraine as a source of anti-hybrid doctrine

Ukraine has developed since 2014 a unique experience of large-scale hybrid warfare. Its capacity to identify, attribute, and counter Russian hybrid operations has become a strategic resource for all of NATO. Ukrainian cybersecurity services have demonstrated their resilience against state-level attacks, developing countermeasures and doctrines that the Baltic states and Poland are actively absorbing.

Cooperation between Ukrainian intelligence services and their Baltic and Polish counterparts has reached a level of integration rarely seen between formal allies. This intense, if informal, cooperation has allowed the real-time identification of several Russian hybrid operations before they produced their intended effects. The Ankara summit should formalise and expand this cooperation — creating permanent structures for intelligence-sharing on hybrid threats between NATO members and Kyiv.

Lessons from Ukraine's counter-disinformation effort

The fight against Russian disinformation may be the domain where Ukrainian lessons are most valuable. Ukraine has developed rapid fact-checking mechanisms, networks of journalists trained to identify and dismantle Russian narratives, and partnerships with digital platforms for a faster response to coordinated disinformation campaigns. These mechanisms, built under the pressure of an existential war, have documented effectiveness.

The Baltic states have integrated some of these practices into their own informational resilience systems. Estonia, in particular, has an advanced counter-disinformation ecosystem, including media literacy programmes from primary school onwards and both governmental and civil verification teams. These models should be diffused across all NATO members — not by mandate, but out of obvious strategic self-interest.

We often talk about weapons and soldiers when discussing the defence against hybrid warfare. We talk far less about media literacy, fact-checking, and the informational resilience of societies. Yet that is where a large part of this silent war is won or lost. A population that knows how to identify disinformation is a population that Moscow cannot manipulate as easily.

Russian lawfare against the Baltic states

Beyond physical and digital operations, Russia also uses international legal instruments as weapons in its hybrid war. Latvian intelligence has documented a plan to pursue legal action before the International Court of Justice (ICJ) against the Baltic states, accusing them of discriminating against Russian-speaking minorities. This strategy of "lawfare" — using international law as a destabilisation tool — aims to construct a narrative of legitimacy for a potential future action.

The Ukrainian precedent is instructive: before each escalation in 2014 and 2022, Russia had developed narratives about "protecting oppressed Russian-speaking populations." These narratives, endlessly repeated in pro-Kremlin media and on social networks, had primed part of international opinion toward a certain moral ambiguity. The same strategy is now being deployed against the Baltic states — with legal arguments as the veneer of legitimacy for a future action.

NATO's institutional response to Russian lawfare

NATO and the European Union have developed "counter-lawfare" capabilities — systematically refuting Russian legal narratives, documenting Russia's violations of international law, and building a robust legal case. But this response is asymmetric: Russia can spread unfounded accusations quickly and at mass scale, while the rigorous legal response takes time. In information warfare, speed often trumps precision.

The International Criminal Court (ICC) issued an arrest warrant for Vladimir Putin in March 2023 for the deportation of Ukrainian children. This symbolically important act does not prevent Moscow from continuing its hybrid activities — but it builds a legal corpus documenting the violations and credibilising the image of a Russia that operates outside international law. This legal corpus will be invaluable in any future peace process or accountability proceedings.

The need for an adapted doctrine

Russian hybrid warfare is not new — but its intensification toward NATO's eastern flank in the summer of 2026 represents a qualitative escalation. The Latvian warnings, the documented incidents, the strategic logic of Putin's response to his difficulties in Ukraine — everything points toward increasing hybrid pressure in the months ahead. NATO must respond with an adapted doctrine — one that is not limited to conventional military retaliation but integrates cyber resilience, resistance to disinformation, critical infrastructure security, and total societal defence.

The Ankara summit will have to address hybrid warfare explicitly — not generically, but with concrete commitments on response capabilities, attribution thresholds, and solidarity mechanisms in the event of a hybrid incident. Without this, declarations of mutual support remain hollow words in the face of a threat that is very concrete indeed.

Ukraine as the laboratory for hybrid response

Ukraine's experience facing Russian hybrid warfare — from 2014 through to its most sophisticated forms in 2026 — constitutes the most valuable laboratory NATO could have. Ukraine has developed cyber defence, counter-disinformation, drone warfare, and civilian population resilience capabilities that surpass allied Western capabilities in certain domains. Sharing these experiences, integrating Ukrainian lessons into NATO's doctrine — this is a strategic imperative the Ankara summit must not miss.

Hybrid warfare is the war of our time — diffuse, permanent, difficult to name and attribute. NATO was designed for the conventional warfare of the twentieth century. To survive the twenty-first, it must reinvent itself as much intellectually as militarily. Ankara can be the moment of that reinvention — if the allies have the courage to clearly name what they are facing.

I end this analysis with one certainty: hybrid warfare will not stop on its own. It will stop when its costs to Russia exceed its perceived benefits. Raising those costs — through resilience, counter-disinformation, cyber defence, and credible deterrence — is the only strategy that works over the long term. And that strategy begins with admitting it: we are already at war. Just not yet the kind we know.

By Maxime Marquette, columnist

Editorial stance

I am not a journalist but a columnist and analyst. My expertise lies in observing and analysing the geopolitical, economic and strategic dynamics that shape our world. My work is to take political strategies apart, to understand global economic movements, to put the decisions of international actors in context and to offer analytical perspectives on the changes that are redefining our societies.

I do not claim the cold objectivity of traditional journalism, which stops at reporting facts. I claim analytical clarity, rigorous interpretation and a deep understanding of the complex issues that concern us all. My role is to give meaning to the facts, to place them in their historical and strategic context, and to offer a critical reading of events.

Method and sources

This text keeps the basic distinction between verified facts and interpretive analysis. The rule never changes: a factual claim is published only when a verifiable source supports it, and the sources this article actually used are listed under Sources, never here.

Primary source families used by the publication, when the story has them: official statements from governments and international institutions, public statements by political leaders, reports from intergovernmental organisations, dispatches from recognised international news agencies.

Secondary source families: specialised publications, internationally recognised news media, analyses from established research institutions, reports from industry organisations.

When an article cites statistical, economic or geopolitical data, it comes from the institutions that produce it (intergovernmental organisations, central banks, national statistics offices), and the exact institution is named under Sources.

Nature of the analysis

The analyses, interpretations and perspectives in the analytical sections of this article are a critical, contextual synthesis based on the information available, the trends observed and the expert comments cited in the sources consulted.

My role is to interpret these facts, to set them in the context of today's geopolitical and economic dynamics, and to give them a coherent meaning within the larger story of the changes shaping our time. These analyses reflect expertise built through continuous observation of international affairs and an understanding of the strategic mechanisms that drive global actors.

This article describes a documented state of affairs on its publication date, not a prediction: later developments may shift its outlook. No update is promised in advance; when an article is corrected or completed, the change is dated in the text.