cyber.hendryadrian.com
Security Report · recordedfuture.com

Recorded Future Warns Russia Is Escalating Hybrid Attacks Across Europe

· Original article ↗

Summary

Recorded Future assesses that Russia is escalating hybrid tactics across Europe, including cyber operations, influence campaigns, airspace incursions, and physical sabotage, and warns these could develop into a broader campaign.

Key points

  • Insikt Group says Russia has expanded its New Generation Warfare tactics across Europe since its 2022 full-scale invasion of Ukraine, and assesses escalation is likely over the next two years.
  • The report describes influence operations, suspected airspace violations, maritime activity, physical sabotage, and offensive cyber operations as components of the hybrid campaign.
  • Insikt Group tracked 30 suspected NATO airspace violations from September 2025 to January 2026, compared with 23 from March 2022 to August 2025.
  • The report says physical sabotage operations increased four-fold from 2023 to 2024, with 2025 activity consistent with 2024.
  • Russian cyber operations against European targets have focused on access-oriented activity, including attacks on firewalls, VPNs, email services, and web portals; a Russia-nexus campaign also took Norwegian government portals offline with DDoS attacks.
  • The assessment recommends measures including phishing-resistant MFA, stronger physical and anti-drone security, monitoring for influence narratives, and coordination with national security agencies.

Article Details

Publisher
Recorded Future
Scope
Russian hybrid warfare targeting European public and private entities, including influence operations, airspace and maritime violations, physical sabotage, and offensive cyber operations.
Key Statistics
  • Insikt Group tracked 30 suspected NATO airspace violations between September 2025 and January 2026, compared with 23 suspected or confirmed violations between March 2022 and August 2025.
  • The report states that physical sabotage operations increased four-fold between 2023 and 2024, with 2025 activity consistent with 2024.
Recommendations
  • Enforce phishing-resistant multi-factor authentication and coordinate with the national CERT and NCSC.
  • Expand insider threat and contractor vetting.
  • Implement physical security measures, including perimeter detection and anti-drone measures.
  • Establish joint civil-military air incident protocols, including aviation alerts.
  • Establish communication response protocols and monitor the information environment for Russia-nexus narratives.

People

Valeriy GerasimovChief of the General Staff of the Russian Armed Forces; quoted from a 2013 article in Military-Industrial Kurier describing the New Generation Warfare strategy.Vladimir PutinRussian President whom Insikt Group assesses is likely to escalate aggression across Europe over the next two years, potentially into a full-scale New Generation Warfare campaign.

Countries

DenmarkThe most commonly targeted countries have been Poland and Romania; however, violations have occurred outside of Russia’s historic sphere of influence, including in Germany, the UK, Denmark, and Norway.EstoniaGround air defenses went on high alert, and NATO F-16 jets stationed at Estonia’s Ämari Air Base were scrambled.Franceacross Europe, and particularly in states Moscow likely views as Kyiv’s core European supporters: the UK, France, Germany, and Poland.Germanyexplosive quadcopter struck the wing near the fuel tank of an Antonov An-124 cargo aircraft in Leipzig, Germany, in what we assess is the first instance in Europe of a sabotage drone carrying military-grade explosivesLatviaMost commonly targeted states between January 2018 and June 2025: Germany, Estonia, Latvia, Lithuania, PolandLithuaniaMost commonly targeted states between January 2018 and June 2025: Germany, Estonia, Latvia, Lithuania, PolandNorwayto impersonate localized news and fact-checking outlets across Europe — especially in France and Norway — using AI-generated text and voice clones.Polandin states Moscow likely views as Kyiv’s core European supporters: the UK, France, Germany, and Poland.RomaniaThe most commonly targeted countries have been Poland and Romania; however, violations have occurred outside of Russia’s historic sphere of influence, including in Germany, the UK, Denmark, and Norway.RussiaRussia Escalating Hybrid Attacks across EuropeUkraineSince Russia’s full-scale invasion of Ukraine in February 2022, Russia has escalated its use of hybrid, asymmetric warfare across Europe, far beyond the former Soviet Union, where Russia historically focused itsUnited Kingdomacross Europe, and particularly in states Moscow likely views as Kyiv’s core European supporters: the UK, France, Germany, and Poland.United StatesPutin likely sees fractured European unity and inconsistent US assistance to European collective defense efforts as offering him a finite window of opportunity prior to the 2028 US Presidential election, which could

Industries

AviationEnsure joint civil-military air incident protocols are in place, including aviation alertsDefenseEstonian Border Incursion (September 1, 2026): Estonian defense forces tracked multiple Russian drones near the Estonian border, including one that breached southeastern Estonian airspace.EnergyAuthorities determined the incident was meant to threaten offshore energy infrastructure and test NATO maritime response protocols.financePrivate Sector: Operational losses for telecommunications, finance, and other key sectors, should undersea cables be cutlogisticsThe Halle Airport is a key military and logistics hub for German military support for Ukraine.railMore frequent and aggressive operations, including arson, vandalism, use of bombs, and rail disruptionsTelecommunicationsPrivate Sector: Operational losses for telecommunications, finance, and other key sectors, should undersea cables be cutTransportationPrivate Sector: Elevated risk of disruption for key logistics, transport, rail, and aviation systems