# ANALYSIS: Hybrid warfare: the new face of the Russian threat to NATO

> Hybrid warfare is not a Russian invention — but Russia has made it its preferred art form. It is a mode of conflict that unfolds in the space between peace and conventional war — hostile enough to destabilise, not overt enough to trigger a collective military response. Cyberattacks, infrastructure sabotage, influence operations, drone incursions, targeted assassinations, weapon

- Author: Maxime Marquette
- Publisher: MadMax (https://mad-max.co)
- Section: Analysis
- Published: 2026-06-28
- Canonical URL: https://mad-max.co/en/article/analyse-guerre-hybride-le-nouveau-visage-de-la-menace-russe-sur-l-otan

## Introduction: The war with no declaration

### Neither peace nor open war: the territory of hybrid conflict

**Hybrid warfare** is not a Russian invention — but **Russia** has made it its preferred art form. It is a mode of conflict that unfolds in the space between peace and conventional war — hostile enough to destabilise, not overt enough to trigger a collective military response. **Cyberattacks**, **infrastructure sabotage**, **influence operations**, **drone incursions**, **targeted assassinations**, **weaponised migration** — these are the tools of Russia's hybrid arsenal. And in **June 2026**, that arsenal is pointed squarely at **NATO's eastern flank**.

On **June 22, 2026**, Latvian intelligence made its assessment public: **Russia** is preparing **"hybrid military provocations"** against the Baltic states or **Poland**. A senior political figure from a second **NATO** country confirmed to **The Guardian** that their own intelligence service was picking up signals in the same direction. These converging warnings draw a troublingly clear picture: the next frontier of the Russia-West conflict will not be in **Ukraine** — it will be in Baltic capitals and along Polish roads.

### Why "hybrid" and not "conventional"

Latvian intelligence was explicit: **Russia** is incapable of a conventional war against **NATO** for **"three to five years, even if the war in Ukraine stopped today."** Its forces are bogged down in **Ukraine**, its personnel and equipment losses are considerable, its industrial base is running at full capacity to resupply the front — with no ability to build strategic reserves. This is not a power capable of opening a major conventional second front.

This is also why the hybrid domain is so strategically valuable to Russia right now: it allows Moscow to maintain pressure, test responses, and extract political costs from the West without triggering the unified military response that a conventional attack would demand. It is coercion at calibrated cost.

*There is something deeply unsettling about the logic of hybrid warfare. Precisely because it stays below the Article 5 trigger threshold, it creates a legal and political grey zone that paralyses responses. NATO was built to respond to a clear attack. It is not well equipped to respond to a series of ambiguous, deniable incidents, calculated to stay just below the threshold for collective retaliation.*

## The tools of Russian hybrid warfare: an inventory

### Cyberattacks: the silent weapon

Since **2014**, **Russia** has developed a sophisticated **cyber warfare** capability that allows it to strike without leaving an indisputable signature. The attacks against **Ukraine**'s **energy infrastructure** in **2015** and **2016**, the repeated disruptions of Latvian and Estonian government systems, the attempts to interfere in the electoral processes of numerous allied countries — all operations that bear the Russian hallmark but are difficult to attribute with enough legal certainty to trigger a formal response.

**Poland** has officially declared that **Russia** is already waging a **hybrid war** against NATO's eastern flank — killing people, launching drones, conducting cyberattacks, and orchestrating strikes against critical infrastructure. This is not a hypothesis — it is an operational assessment grounded in documented incidents. The sabotage of undersea communications cables in the **Baltic Sea**, GPS interference in Nordic airspace — all these elements sketch the outline of systematic harassment.

### Weaponising migration: the human weapon

**Belarus**, under **Lukashenko**'s direction, has systematised since **2021** the use of migration flows as a tool of hybrid pressure. Thousands of migrants from the **Middle East** and **Africa** have been funnelled toward the Lithuanian, Latvian, and Polish borders — creating a humanitarian and security crisis that has consumed forces and political resources the targeted states would have preferred to spend elsewhere. In **June 2026**, data shows that **707 border crossing attempts** were recorded on the Latvian border over 10 days — compared to just 9 on the Polish side — revealing active direction of these flows by **Minsk**.

This strategy is particularly insidious because it uses vulnerable human beings as shields and instruments. The targeted countries find themselves facing an insoluble dilemma: let the migrants through and lose control of their border, or push them back and face humanitarian criticism. **Russia** and **Belarus** exploit the democratic values of targeted countries against those countries themselves — one of the most cynical aspects of hybrid warfare.

*The weaponisation of migrants as a hybrid warfare tool is one of the most morally repugnant features of Russian strategy. These men, women, and children are not pawns — but that is exactly how Moscow and Minsk treat them. Europe must find a response that protects both its borders AND the human dignity of the people involved — not by choosing one over the other.*

## Drones and missiles: the capability demonstration

### The "accidental" incidents that are not accidents

Since the start of the war in **Ukraine**, several incidents involving **drones** and **missiles** in the airspace or on the territory of **NATO** member states have been documented. Russian **Shahed** drones have violated Polish and Romanian airspace during attacks on **Ukraine**. A Russian missile landed on Polish territory in **November 2022** — killing two people, before being attributed to a Ukrainian air-defence missile following an allied investigation.

These incidents create a permanent zone of tension. **NATO** must decide each time: was this incident accidental or deliberate? The answer either invokes or does not invoke **Article 5**. **Russia** has every interest in maintaining this ambiguity — testing limits without crossing the visible red line. This **"probing"** — sounding out reactions — is a deliberate strategy to map the alliance's tolerance thresholds.

### Surveillance drones: Moscow's eyes on the eastern flank

Data cited by The Guardian in **June 2026** reveals a **20% increase** since January in sightings of Russian reconnaissance drones entering **Ukraine** from **Belarus**. These drones serve to map Ukrainian defences — but their growing presence in border airspace also signals a systematic surveillance intention regarding the north-eastern flank. Every reconnaissance drone is strategic intelligence collected to prepare potential future operations.

By **2026**, **Russia**'s drone capabilities have evolved considerably — notably thanks to Iranian technology transfers and developments within Russia's own military-industrial complex. Modified **Shahed**-type drones are now guided by relay systems installed on Belarusian territory, allowing them to strike targets in western **Ukraine** with greater precision. This same technology could be used for deeper operations into **NATO** territory.

*What strikes me about this technological escalation in drones is that it fundamentally changes the geography of the threat. There is no longer any "strategic depth" for the Baltic states or Poland in a world where long-range drones can strike anywhere. The defence of Tallinn or Warsaw now begins thousands of kilometres away — or in cyberspace — not at the border.*

## Infrastructure sabotage: operations in depth

### Nord Stream 1 and 2: a precedent still unexplained

The sabotage of the **Nord Stream 1 and 2** pipelines in **September 2022** remains one of the most spectacular acts of infrastructure sabotage in recent history. Despite years of parallel investigations by **Germany**, **Sweden**, and **Denmark**, public attribution remains uncertain — a fact that speaks volumes about the difficulty of responding to hybrid acts, even major ones. This precedent demonstrates the feasibility of attacks against critical undersea infrastructure in the **Baltic Sea**.

Since then, several similar incidents have been documented in the region: interruptions to undersea communications cables, disruptions to civilian and military GPS systems, disturbances to power grids. The intelligence services of several allied countries — notably **Finland**, **Estonia**, and **Latvia** — have attributed some of these incidents to Russian or Belarusian operations. The **Baltic Sea** has become a zone of undersea and sublacustrine competition where the rules of conventional warfare do not clearly apply.

### Information warfare: fracturing societies from within

The **informational** component of Russian hybrid warfare is perhaps the most insidious. Systematic disinformation operations target the populations of the Baltic states, **Poland**, and other **NATO** members — amplifying social tensions, challenging official narratives on the war in **Ukraine**, sowing doubt about the reliability of the alliance. These operations use social media, disinformation websites disguised as legitimate news sources, and encrypted messaging channels.

In **Latvia**, where a significant portion of the population is Russian-speaking, these operations find particularly fertile ground. Latvia's Bureau for the Protection of the Constitution has identified Russian influence campaigns specifically targeting Russian-speaking communities to maintain a sense of belonging to a distinct Russian information space — a strategy designed to cultivate a potential **"fifth column"** in the event of a crisis.

*Information warfare may worry me even more than missiles and drones. A missile can be seen, tracked, intercepted. A disinformation narrative that takes root in the minds of a fraction of the population cannot be detected on a radar screen. And in a democracy, freedom of expression further complicates the response. That is the fundamental paradox of democracy facing hybrid warfare.*

## NATO's response: between adaptation and institutional inertia

### The Tallinn cyber excellence centre: a model to expand

**NATO** is not inactive in the face of hybrid threats. The **NATO Cooperative Cyber Defence Centre of Excellence** based in **Tallinn** (**CCDCOE**) is one of the most advanced actors in the world in the analysis of and response to cyber threats. Its analyses and exercises — notably the annual **Locked Shields** exercise — allow allies to develop common capabilities and improve their interoperability in the cyber domain.

But **NATO** still struggles to define precisely when a cyberattack constitutes an **Article 5** violation — and even more so to coordinate a collective response. The **cyber defence** policy adopted in **2014**, updated in **2016** and **2022**, still leaves attribution procedures and response protocols complex and subject to deliberation by **32 governments** with different sensitivities.

### The threshold question: where does Article 5 begin?

The fundamental challenge of hybrid response is one of **thresholds**. When does a series of isolated incidents — cyberattack, strayed drone, weaponised migrants, cable sabotage — cumulatively constitute aggression that triggers **Article 5**? **NATO** has begun developing a doctrine of **"resilience"** that does not rely solely on military retaliation but on the capacity to absorb and recover from hybrid aggressions.

Several countries have adopted the concept of **"total defence"** — **Estonia**, **Finland**, **Sweden** — which involves the whole of society in preparing for national resilience. These models, developed from an acute awareness of the Russian threat, offer valuable lessons for the entire alliance. But their widespread adoption takes time — time that the **eastern flank** cannot afford to waste.

*I genuinely believe that the Finnish or Estonian model of "total defence" is the model all of Europe should adopt. This is not militarism — it is democratic resilience. A society that prepares to resist disinformation, power outages, and cyberattacks is not a militarised society. It is a society that takes its own survival seriously.*

## The economic dimension of hybrid warfare: disrupting supply chains

### Destabilising an economy without firing a single shot

Russian hybrid warfare also targets the **supply chains** and **economic networks** of the countries it aims to destabilise. Coordinated disruptions of **Baltic Sea port logistics systems**, attacks against **payment systems**, attempts to destabilise **local financial markets** — all actions that can inflict significant economic costs without triggering a military response. In **Estonia** and **Latvia**, **economic resilience exercises** were conducted in **2025–2026** precisely to test the ability of national economies to function under hybrid pressure.

The energy dimension remains particularly sensitive. Despite the disconnection of the Baltic electricity grid from the Russian **BRELL** system — scheduled for **2025–2026** — the transition toward synchronisation with the European network temporarily creates a window of vulnerability. Intelligence services have identified Russian attempts to identify and map the new interconnections for potential future disruptions. **Latvia** and **Estonia** have strengthened the physical protection of their critical energy infrastructure in response to these documented threats.

### Transport networks and NATO's military logistics

**NATO**'s ability to rapidly reinforce its **eastern flank** in a crisis depends on transport networks — roads, bridges, railways, ports — which are natural targets for hybrid warfare. Sabotage operations against these infrastructures could significantly delay allied reinforcement in the critical days following a provocation. Latvian intelligence has identified Russian **reconnaissance activity** in areas housing strategic transport infrastructure.

**NATO** launched the **DIANA** programme (Defence Innovation Accelerator for the North Atlantic) to accelerate the development of dual-use technologies — civilian and military — that strengthen the resilience of critical infrastructure. Investments have also been made in **securing the rail networks** of **Rail Baltica** — the high-speed railway line under construction connecting the Baltic states to **Poland** and the rest of **Europe**. This line is both an economic connectivity asset and a military logistics priority.

*Hybrid warfare now strikes at something fundamental: a society's ability to function. Ports, power grids, railways, financial systems — all of it can become a silent weapon. Europe's defence is no longer played out solely in military headquarters but in the crisis management rooms of infrastructure companies and financial regulators. This reality has not yet fully penetrated the political consciousness of European democracies.*

## Cooperation with Ukraine: learning from those already at war

### Ukraine as a source of anti-hybrid doctrine

**Ukraine** has developed since **2014** a unique experience of large-scale hybrid warfare. Its capacity to identify, attribute, and counter Russian hybrid operations has become a strategic resource for all of **NATO**. Ukrainian cybersecurity services have demonstrated their resilience against state-level attacks, developing countermeasures and doctrines that the Baltic states and **Poland** are actively absorbing.

Cooperation between Ukrainian intelligence services and their Baltic and Polish counterparts has reached a level of integration rarely seen between formal allies. This intense, if informal, cooperation has allowed the real-time identification of several Russian hybrid operations before they produced their intended effects. The **Ankara summit** should formalise and expand this cooperation — creating permanent structures for intelligence-sharing on hybrid threats between **NATO** members and **Kyiv**.

### Lessons from Ukraine's counter-disinformation effort

The fight against **Russian disinformation** may be the domain where Ukrainian lessons are most valuable. **Ukraine** has developed rapid **fact-checking** mechanisms, networks of journalists trained to identify and dismantle Russian narratives, and partnerships with **digital platforms** for a faster response to coordinated disinformation campaigns. These mechanisms, built under the pressure of an existential war, have documented effectiveness.

The Baltic states have integrated some of these practices into their own **informational resilience** systems. **Estonia**, in particular, has an advanced counter-disinformation ecosystem, including **media literacy programmes** from primary school onwards and both governmental and civil **verification teams**. These models should be diffused across all **NATO** members — not by mandate, but out of obvious strategic self-interest.

*We often talk about weapons and soldiers when discussing the defence against hybrid warfare. We talk far less about media literacy, fact-checking, and the informational resilience of societies. Yet that is where a large part of this silent war is won or lost. A population that knows how to identify disinformation is a population that Moscow cannot manipulate as easily.*

## The legal dimension: when law becomes a weapon

### Russian lawfare against the Baltic states

Beyond physical and digital operations, **Russia** also uses **international legal instruments** as weapons in its hybrid war. Latvian intelligence has documented a plan to pursue legal action before the **International Court of Justice (ICJ)** against the Baltic states, accusing them of discriminating against Russian-speaking minorities. This strategy of **"lawfare"** — using international law as a destabilisation tool — aims to construct a narrative of legitimacy for a potential future action.

The Ukrainian precedent is instructive: before each escalation in **2014** and **2022**, **Russia** had developed narratives about **"protecting oppressed Russian-speaking populations."** These narratives, endlessly repeated in pro-Kremlin media and on social networks, had primed part of international opinion toward a certain moral ambiguity. The same strategy is now being deployed against the Baltic states — with legal arguments as the veneer of legitimacy for a future action.

### NATO's institutional response to Russian lawfare

**NATO** and the **European Union** have developed **"counter-lawfare"** capabilities — systematically refuting Russian legal narratives, documenting Russia's violations of international law, and building a robust legal case. But this response is asymmetric: **Russia** can spread unfounded accusations quickly and at mass scale, while the rigorous legal response takes time. In information warfare, speed often trumps precision.

The **International Criminal Court (ICC)** issued an arrest warrant for **Vladimir Putin** in **March 2023** for the deportation of Ukrainian children. This symbolically important act does not prevent **Moscow** from continuing its hybrid activities — but it builds a **legal corpus** documenting the violations and credibilising the image of a **Russia** that operates outside international law. This legal corpus will be invaluable in any future peace process or accountability proceedings.

## Conclusion: Hybrid warfare demands a hybrid response

### The need for an adapted doctrine

Russian hybrid warfare is not new — but its intensification toward **NATO's eastern flank** in the summer of **2026** represents a qualitative escalation. The Latvian warnings, the documented incidents, the strategic logic of **Putin**'s response to his difficulties in **Ukraine** — everything points toward increasing hybrid pressure in the months ahead. **NATO** must respond with an adapted doctrine — one that is not limited to conventional military retaliation but integrates cyber resilience, resistance to disinformation, critical infrastructure security, and total societal defence.

The **Ankara summit** will have to address hybrid warfare explicitly — not generically, but with concrete commitments on response capabilities, attribution thresholds, and solidarity mechanisms in the event of a hybrid incident. Without this, declarations of mutual support remain hollow words in the face of a threat that is very concrete indeed.

### Ukraine as the laboratory for hybrid response

Ukraine's experience facing Russian hybrid warfare — from **2014** through to its most sophisticated forms in **2026** — constitutes the most valuable laboratory **NATO** could have. **Ukraine** has developed cyber defence, counter-disinformation, drone warfare, and civilian population resilience capabilities that surpass allied Western capabilities in certain domains. Sharing these experiences, integrating Ukrainian lessons into **NATO**'s doctrine — this is a strategic imperative the **Ankara summit** must not miss.

*Hybrid warfare is the war of our time — diffuse, permanent, difficult to name and attribute. NATO was designed for the conventional warfare of the twentieth century. To survive the twenty-first, it must reinvent itself as much intellectually as militarily. Ankara can be the moment of that reinvention — if the allies have the courage to clearly name what they are facing.*

*I end this analysis with one certainty: hybrid warfare will not stop on its own. It will stop when its costs to Russia exceed its perceived benefits. Raising those costs — through resilience, counter-disinformation, cyber defence, and credible deterrence — is the only strategy that works over the long term. And that strategy begins with admitting it: we are already at war. Just not yet the kind we know.*

**By Maxime Marquette, columnist**

## Columnist's transparency note

### Editorial stance

I am not a journalist but a **columnist and analyst**. My expertise lies in observing and analysing the geopolitical, economic and strategic dynamics that shape our world. My work is to take political strategies apart, to understand global economic movements, to put the decisions of international actors in context and to offer analytical perspectives on the changes that are redefining our societies.

I do not claim the cold objectivity of traditional journalism, which stops at reporting facts. **I claim analytical clarity**, rigorous interpretation and a deep understanding of the complex issues that concern us all. My role is to give meaning to the facts, to place them in their historical and strategic context, and to offer a critical reading of events.

### Method and sources

This text keeps the basic distinction between **verified facts and interpretive analysis**. The rule never changes: a factual claim is published only when a verifiable source supports it, and the sources this article actually used are listed under **Sources**, never here.

**Primary source families** used by the publication, when the story has them: official statements from governments and international institutions, public statements by political leaders, reports from intergovernmental organisations, dispatches from recognised international news agencies.

**Secondary source families**: specialised publications, internationally recognised news media, analyses from established research institutions, reports from industry organisations.

When an article cites statistical, economic or geopolitical data, it comes from the institutions that produce it (intergovernmental organisations, central banks, national statistics offices), and the exact institution is named under **Sources**.

### Nature of the analysis

The analyses, interpretations and perspectives in the analytical sections of this article are a **critical, contextual synthesis** based on the information available, the trends observed and the expert comments cited in the sources consulted.

My role is to interpret these facts, to set them in the context of today's geopolitical and economic dynamics, and to give them a coherent meaning within the larger story of the changes shaping our time. These analyses reflect expertise built through continuous observation of international affairs and an understanding of the strategic mechanisms that drive global actors.

This article describes a documented state of affairs on its publication date, not a prediction: later developments may shift its outlook. No update is promised in advance; when an article is corrected or completed, the change is dated in the text.

## Sources

### Primary sources

- [Meduza — Latvia warns Russia planning hybrid attacks on Baltics and Poland — June 23, 2026](https://meduza.io/en/feature/2026/06/23/latvia-warns-that-russia-is-planning-hybrid-attacks-on-the-baltics-and-poland-but-says-full-scale-war-is-not-imminent)

- [The Guardian — Russia preparing provocation in Baltic states or Poland — June 26, 2026](https://www.theguardian.com/world/2026/jun/26/russia-provocation-baltic-states-poland)

- [Euromaidan Press — Polish FM warns: Putin's rhetoric is provocation announcement — June 24, 2026](https://euromaidanpress.com/2026/06/24/polish-fm-warns)

### Secondary sources

- [The Guardian — Ukraine bolsters northern defences amid Belarus fears — June 18, 2026](https://www.theguardian.com/world/2026/jun/18/ukraine-bolsters-its-northern-defences-amid-fears-belarus-is-being-dragged-into-war)

- [iSANS — Belarus Review June 15, 2026](https://isans.org/analysis/belarus-review/belarus-review-by-isans-june-15-2026.html)

- [Euromaidan Press — Lukashenka announces war preparations — May 13, 2026](https://euromaidanpress.com/2026/05/13/lukashenka-announces-war-preparations-ukrainian-official-calls-it-russian-information-agenda/)

- [VERTEX YouTube — NATO Allies Warn Russia May Target Baltics, Belarus Border — June 26, 2026](https://www.youtube.com/watch?v=q0kAd6mHJ1w)

- [Militarnyi — Zelensky: Russia deploys relay transmitters in Belarus — February 18, 2026](https://militarnyi.com/en/news/volodymyr-zelensky-russia-deploys-relay-transmitters-in-belarus-for-drone-strikes-on-northern-ukraine/)

---

Source: Maxime Marquette, MadMax. When citing, name the author and link https://mad-max.co/en/article/analyse-guerre-hybride-le-nouveau-visage-de-la-menace-russe-sur-l-otan