# COLUMN: Russian Hybrid Warfare — 50,000 Digital Signals and a Europe That Won't Strike Back

> On June 17, 2026, the AsymIntel European strategic autonomy monitor published an analysis that deserves to be read as an alarm. The European External Action Service (EEAS) documented a sustained and escalating pattern of Russian hybrid activities against European Union member states. These activities include: cyberattacks, sabotage, disruption of critical infrastructure, and in

- Author: Maxime Marquette
- Publisher: MadMax (https://mad-max.co)
- Section: Column
- Published: 2026-06-29
- Canonical URL: https://mad-max.co/en/article/chronique-la-guerre-hybride-russe-50-000-signaux-numeriques-et-une-europe-qui-ne

## Key takeaways

- The EEAS documented an escalating pattern of Russian hybrid activity (cyberattacks, sabotage, infrastructure disruption, information manipulation), and the ECFR processed close to 50,000 digital signals to document the campaign.
- AsymIntel rates Europe's dependence on Russian hybrid operations high on attack-surface gap and persistence, and finds no operationalized European offensive response.
- The Council extended restrictive measures against 47 individuals and 15 entities until October 9, 2026, which the column presents as a symbolic response.
- The column says Russian information warfare aims to create doubt rather than persuade, and that AI-driven manipulation outpaces EU regulation such as the DSA.
- AsymIntel gives the EU a strategic autonomy score of 0.42 out of 1, and the column says the expected 2026 European Security Strategy is a key test.

## Introduction: The EEAS documents, the ECFR quantifies, Europe watches

### A sustained and escalating pattern

On **June 17, 2026**, the **AsymIntel** European strategic autonomy monitor published an analysis that deserves to be read as an alarm. The **European External Action Service (EEAS)** documented a **sustained and escalating pattern** of Russian hybrid activities against **European Union** member states. These activities include: cyberattacks, sabotage, disruption of critical infrastructure, and **information manipulation**. Not an isolated crisis. Not a one-off incident. A **sustained pattern** — that is the word used, and it matters.

In parallel, the **European Council on Foreign Relations (ECFR)** documented a **pattern of physical-digital hybrid attacks** with concrete examples: **drone incursions into Polish and Danish airspace**, disruptions at **Munich** airport, and **coordinated online activity** designed to confuse the public and erode trust in authorities. The **ECFR** processed **close to 50,000 digital signals** across major and niche digital platforms to document this campaign. Fifty thousand signals. This is not artisanal work — it is an industrial operation.

### What the numbers reveal

The **AsymIntel** report assigns Europe's dependence on Russian hybrid operations a **high** risk rating. The physical-digital attack surface gap: **high**. The persistence of Russian hybrid operations: **high**. And the operationalized European offensive response: **none**. That contrast is what I want to dig into in this column. Not the threat — it is documented, analyzed, quantified. But the absence of a proportional response.

The **European Council** extended its **restrictive measures** against Russian hybrid threats until **October 9, 2026**, covering **47 individuals** and **15 entities**. This is an institutional signal of recognition of a persistent threat. But targeted sanctions against **47 individuals** against an information and sabotage machine generating **50,000 digital signals** per analysis period — that disproportion says everything.

*50,000 digital signals documented. 47 individuals sanctioned. I am not a mathematician, but the ratio between those two numbers is a fairly precise measure of the gap between threat and response. Europe recognizes. It sanctions. But it does not strike back — and that is precisely what Putin calculated.*

## Information warfare — its specific mode of operation

### Confuse to paralyze, not to convince

The goal of Russian information warfare is not to convince Europeans that **Putin** is right. That would be too ambitious and too difficult to measure. The goal is more modest and more perverse: **confuse the public and erode trust in authorities**. No need to convince. Just create doubt. Doubt about **NATO**'s intentions. Doubt about the truthfulness of war reporting. Doubt about the motivations of governments supporting **Ukraine**. This diffuse doubt is the fertile ground in which disinformation does its most effective work.

The **ECFR** documents that this campaign operates on two simultaneous levels: physical (drones, sabotage, infrastructure disruptions) and digital (coordinated disinformation, narrative amplification, algorithmic manipulation). The synchronization between these two levels is the key to its effectiveness: a physical disruption creates the event, coordinated digital activity amplifies the informational chaos around that event. Together, they produce a destabilization effect that exceeds the sum of its parts.

### Digital platforms as a battlefield

**AsymIntel** notes that **AI-driven manipulation of the informational environment** has been documented at scale across the **50,000 digital signals** analyzed. **AI** enables disinformation content to be produced at unprecedented volume and speed, narratives to be tailored to specific audiences in each country, and platform moderation mechanisms to be circumvented. This is an industrialization of propaganda that traditional counter-disinformation tools are not yet equipped to counter effectively.

The **EU**'s response in this domain — the **Digital Services Act (DSA)**, moderation transparency obligations, systemic risk reporting requirements — creates a legal framework but not yet an active counter-capability. **Europe** can **identify** priorities and **fund** them. It cannot yet **compel** member states to transform their informational defenses, align their counter-disinformation policies, or close specific capability gaps. That is the central **enforcement gap**.

*Russian AI produces disinformation at assembly-line speed. Europe responds with regulations that take years to come into force. That temporal mismatch is not trivial — it is a strategic asymmetry that Moscow deliberately and effectively exploits.*

## Physical sabotage — drones in sovereign airspace

### Incursions that test the limits

The **drone incursions into Polish and Danish airspace** documented by the **ECFR** are not navigation accidents. They are deliberate tests of **NATO** and member state responses to sovereign airspace violations conducted by state actors using instruments that provide plausible deniability. The militarily attributable but officially unattributed drone — it is the perfect vector for a policy of gradual escalation without triggering Article 5.

The disruptions at **Munich** airport follow the same logic: strike civilian connectivity nodes, create economic and logistical costs, test resilience and response capability. These are not military attacks. They are aggression operations below the threshold of military response — precisely where international law and **NATO** doctrine are most ambiguous.

### The absence of an offensive response and its consequences

**AsymIntel** is explicit: there is **"no operationalized European offensive response"** to Russian hybrid operations. This void is not only a capability problem — it is a signal to **Moscow**. A signal that hybrid operations can continue without triggering an asymmetric European response in the same domains. This de facto impunity encourages escalation rather than deterring it.

Several response approaches are available: counter-disinformation operations, targeted cyberoffensives against Russian propaganda infrastructure, disruption of identified influence networks, or simply a clear public attribution policy that names Russian operations and those responsible. These tools exist. Some member states use them bilaterally. But a coordinated, systematic European response is still absent — and that gap is one the expected **European Security Strategy** summit must close.

*Europe can identify the threat, document it, sanction it symbolically. What it does not yet do is make those who conduct it pay a concrete price. As long as waging hybrid war against Europe carries no real cost for Moscow, that war will continue. It is that simple.*

## The European Security Strategy — an existential test

### The institutional moment of truth

The **European Security Strategy (ESS)** expected in **2026** is identified by **AsymIntel** as **"the definitive institutional test"** of whether the **EU** can consolidate its fragmented defensive architecture into a coherent strategic posture. The **EU**'s composite strategic autonomy score in the report is **0.42 out of 1** — below average. The trajectory: deteriorating.

The weakest pillars are **sovereignty coverage**, **dependency reduction**, and **capability building**. **Europe** scores relatively better on alliance coherence and institutional capabilities. In plain language: it is good at meetings and declarations, less good at decisions that actually transform its military and informational capabilities. That is a brutal but accurate diagnosis.

### What official documents alone cannot accomplish

The **EU Strategic Compass**, the **European Defence White Paper 2030**, the **EU Cybersecurity Strategy** — these documents exist and establish real priorities. But **AsymIntel** highlights that the **proliferation of strategic documents without consolidation** is high. The **EU** can identify and fund priorities, but it cannot compel member states to transform their defense industries, align procurement decisions, or close specific capability gaps. The **execution gap** is the central challenge.

To be fair: this is the same constraint as any supranational organization functioning by unanimous consent. **NATO reform** took decades. Building an autonomous European defense and hybrid counter-interference capability will also take time. But the Russian threat does not take a break while **Europe** builds its institutions.

*The EU counts meetings, documents, budget commitments. Moscow counts successful operations, disrupted infrastructure, manipulated algorithms. These two ways of measuring progress are not compatible. Europe will have to adopt Moscow's metric — or lose this war too.*

## The American context — when the protector gradually withdraws

### The US National Defense Strategy 2026

The **AsymIntel** report notes that the **US National Defense Strategy 2026** confirms that American support to **Europe** will remain critical but become more limited. It describes this shift as a **"confirmed structural withdrawal rather than a temporary negotiating posture."** In other words: this is not **Trump** improvising. This is American policy structurally evolving toward an Indo-Pacific reorientation.

This reality transforms the European security equation. **Europe** was protected for decades by an American umbrella so comprehensive it never had to develop credible autonomous defense capability. That umbrella is shrinking. Dependence on American support is rated as **"high and shifting."** This is not a reason to panic — it is a reason to accelerate investment in Europe's own capabilities.

### Technological dependency — AI and informational sovereignty

**AsymIntel** highlights the absence of a European sovereign technological response to **AI**-driven manipulation of the informational environment. **Europe** depends on American digital platforms — whose moderation policies and algorithmic architectures are decided in **San Francisco**, not in **Brussels**. Against a Russian hybrid campaign that operates precisely through these platforms, this technological dependency is a strategic vulnerability.

Addressing this vulnerability requires not only stronger platform regulation (the **DSA** is a start), but also the development of European capabilities in **AI** analysis and countermeasures in the informational domain. This is a long-term, costly investment whose results will not be visible within an electoral cycle. All the more reason to start now.

*Europe is sovereign over its laws but not over its algorithms. Moscow knows this perfectly — and operates exactly in that space. Digital sovereignty is not just an industrial policy slogan. It is a condition of democratic defense. And Europe is still very far from having truly built it.*

## What Ukraine brings to this equation — resilience as a model

### Kyiv as a laboratory for hybrid resilience

**Ukraine** has been the global laboratory for Russian hybrid warfare since **2014**. Disinformation, cyberattacks, opinion manipulation, clandestine operations — **Ukraine** has endured every technique that **Russia** is now deploying more broadly across **Europe**. Ukrainians have developed remarkable informational resilience: an **active civil society**, **robust independent media**, **fact-checking centers**, and a culture of constructive skepticism toward unverified sources.

**Europe** has everything to learn from the Ukrainian experience. **Ukrainian counter-disinformation services**, the practices of **Ukrainian journalists** managing information during crises, the protocols of **Ukrainian authorities** to prevent algorithmic panic — all of this represents a body of practical knowledge that European institutions should systematically integrate into their own resilience frameworks.

### The NATO Hybrid Centre and coordination with Kyiv

The **NATO Strategic Communications Centre of Excellence** and the **NATO Hybrid Centre** are already working with Ukrainian partners on these questions. But the depth of coordination remains insufficient relative to the threat. Ukraine's experience is not only useful for understanding the current war — it is the best available warning for preparing the hybrid wars of tomorrow.

Ukraine's future membership in the **EU** would bring with it this unique experience. A Ukrainian member state would perhaps be the most competent actor in the **Union** in the domain of hybrid resilience — turning its national tragedy into a collective strategic resource. That is one more argument for accelerating integration, not slowing it down.

*Ukraine has been fighting Russia's hybrid war for twelve years. Europe is only just starting to understand what it is facing. The best thing Brussels could do is genuinely listen to Kyiv — not as a country to be protected, but as a country that knows ten times more about the threat than any European capital.*

## Council restrictive measures and their limited reach

### 47 individuals, 15 entities — a symbolic response to an industrial machine

The **European Council** extended its **restrictive measures** against Russian hybrid threats until **October 9, 2026**. These measures target **47 individuals** and **15 entities**. They include **travel bans** and **asset freezes**. They signal institutional recognition of a persistent threat — that is their primary value. Their operational value is far more limited. The individuals planning cyberattacks or disinformation operations against **Europe** mostly have neither travel to **Europe** planned nor assets there to freeze.

The gap between the threat — **50,000 digital signals**, drone incursions, airport disruptions, sabotage operations — and the response — **47 names on a blacklist** — is a measure of the distance between recognition and action. That gap must be closed with active response capabilities, not only sanctions lists.

### The coordinated response mechanisms that are missing

What is missing in **Europe** is a coordinated response mechanism to Russian hybrid operations that simultaneously engages multiple dimensions: **cyber**, **informational**, **physical**, and **diplomatic**. Member states act individually. EU agencies — **ENISA**, **Europol**, **EUvsDisinfo** — partially coordinate. But there is no single body with the mandate, resources, and authority to orchestrate a coherent operational response to a hybrid attack in real time.

The **NATO Hybrid Centre** partially fills this role for Alliance members. But coordination between this center and **EU** structures remains underdeveloped. And **Ukraine** — which has the deepest experience of any nation in the Northern Hemisphere facing Russian hybrid warfare — is still not integrated as a full partner in these structures.

*Europe has sanctions lists, specialized agencies, strategic documents. It does not yet have an operational command room capable of responding in real time to a coordinated hybrid attack. Russia does. And that is a considerable strategic advantage that Europe must stop ignoring.*

## The necessary investments — figures and priorities

### Funding informational resilience at European scale

Countering Russian disinformation and hybrid operations requires investments that are not yet at the scale of the threat. The budget of **EUvsDisinfo** — the **EU**'s main tool for tracking and countering Russian disinformation — is minuscule compared to the resources **Russia** invests in its influence operations. **Digital literacy** initiatives in European educational systems are fragmented. Research on algorithmic manipulation techniques is underfunded.

The **EU Strategic Compass** mentions these priorities. The **Defence White Paper 2030** repeats them. What is needed now is a concrete investment plan with amounts, timelines, and evaluation mechanisms. Not another document. A budget. A schedule. Measurable results. That is what European publics can support and understand — and what the threat demands.

### Training journalists and protecting democratic actors

European journalists who cover Russian disinformation, informational security researchers, social media monitoring experts — all are essential actors in hybrid defense. They need training, resources, legal protection, and access to platform data. **DSA** regulations open some access — but implementation delays and platform resistance continue to slow this work.

**Press freedom**, **source protection**, media independence — these are not merely abstract democratic values. They are components of informational resilience against hybrid warfare. A fragmented, underfunded, or politically captured media landscape is a strategic vulnerability that **Russia** exploits with precision.

*We talk about digital defense, cyber strategy, informational resilience. But the first line of defense against disinformation is independent, well-funded, and protected journalism. Across Europe, that journalism is in crisis in many countries. Putin did not create that crisis — but he exploits it.*

## Conclusion: The urgency of a European hybrid response doctrine

### What is missing — a counter-interference architecture

The diagnosis is clear, the gaps identified, the risks quantified. What is missing is a **European hybrid response architecture** that is as offensive as it is defensive, coordinated across member states, resourced adequately, and decoupled from electoral cycles to endure over time. This architecture does not yet exist. It is referenced in strategic documents. It is not yet operationalized.

The **2026 European Security Strategy** is the opportunity to change that. If it includes binding execution mechanisms, coordinated offensive response capabilities, and an informational sovereignty architecture funded at the level of actual needs — it will be a turning point. If it is yet another document that identifies priorities without enforcing them, it will be yet another disappointment.

### Time works against passivity

Every additional month without a European offensive response is another month in which **Russia** consolidates its techniques, refines its methods, and ensures that the cost of its hybrid operations remains zero. This is not a war that pauses during institutional deliberations. It is a war that intensifies precisely because the adversary perceives deliberation itself as an exploitable weakness.

**Ukraine** did not have the luxury of deliberating indefinitely. It responded, adapted, resisted. **Europe** still has time to make that choice before being forced to make it under more advanced crisis conditions. This **June 17, 2026** brief is a warning. The question is how many additional warnings will be needed before the response matches the threat.

*How many warnings? That is the question I have been asking since 2014. Since the annexation of Crimea, since the Donbas ignited, since the first cyberattacks on Ukraine, since the first drone incursions. Europe receives these warnings. It files them. It is only just beginning to act on them. Time is running out.*

**By Maxime Marquette, columnist**

## Columnist's transparency note

### Editorial stance

I am not a journalist but a **columnist and analyst**. My expertise lies in observing and analysing the geopolitical, economic and strategic dynamics that shape our world. My work is to take political strategies apart, to understand global economic movements, to put the decisions of international actors in context and to offer analytical perspectives on the changes that are redefining our societies.

I do not claim the cold objectivity of traditional journalism, which stops at reporting facts. **I claim analytical clarity**, rigorous interpretation and a deep understanding of the complex issues that concern us all. My role is to give meaning to the facts, to place them in their historical and strategic context, and to offer a critical reading of events.

### Method and sources

This text keeps the basic distinction between **verified facts and interpretive analysis**. The rule never changes: a factual claim is published only when a verifiable source supports it, and the sources this article actually used are listed under **Sources**, never here.

**Primary source families** used by the publication, when the story has them: official statements from governments and international institutions, public statements by political leaders, reports from intergovernmental organisations, dispatches from recognised international news agencies.

**Secondary source families**: specialised publications, internationally recognised news media, analyses from established research institutions, reports from industry organisations.

When an article cites statistical, economic or geopolitical data, it comes from the institutions that produce it (intergovernmental organisations, central banks, national statistics offices), and the exact institution is named under **Sources**.

### Nature of the analysis

The analyses, interpretations and perspectives in the analytical sections of this article are a **critical, contextual synthesis** based on the information available, the trends observed and the expert comments cited in the sources consulted.

My role is to interpret these facts, to set them in the context of today's geopolitical and economic dynamics, and to give them a coherent meaning within the larger story of the changes shaping our time. These analyses reflect expertise built through continuous observation of international affairs and an understanding of the strategic mechanisms that drive global actors.

This article describes a documented state of affairs on its publication date, not a prediction: later developments may shift its outlook. No update is promised in advance; when an article is corrected or completed, the change is dated in the text.

## Sources

### Primary sources

- [AsymIntel — European strategic autonomy weekly brief — June 17, 2026](https://asym-intel.info/monitors/european-strategic-autonomy/2026-06-17-weekly-brief/)

- [Euronews — Kubilius: Europe must prepare for more attacks — June 23, 2026](https://www.euronews.com/my-europe/2026/06/23/kubilius-europe-should-prepare-for-more-attacks-following-suspected-targeted-killing-in-po)

### Secondary sources

- Foreign Policy — Russian hybrid warfare in Europe — June 2026

- Kyiv Independent — Russian hybrid operations against European infrastructure — 2026

- [Euromaidanpress — Russian information warfare: ECFR analysis — June 2026](https://euromaidanpress.com/2026/06/russia-information-warfare-europe-ecfr/)

- [The Guardian — Coverage of Russian hybrid operations in Europe — 2026](https://www.theguardian.com/international)

---

Source: Maxime Marquette, MadMax. When citing, name the author and link https://mad-max.co/en/article/chronique-la-guerre-hybride-russe-50-000-signaux-numeriques-et-une-europe-qui-ne