By Jabir Deralla
and the CIVIL Hybrid Threats Monitoring Team

In the final week of December 2025, as Europe turns inward for the holidays and diplomacy turns outward in renewed attempts to end Russia’s war against Ukraine, something else has been quietly accelerating across the continent and its periphery. Networks amplifying pro-Kremlin narratives have intensified their activity, pushing once-familiar messages with new urgency and new emotional charge.

Ukraine is long portrayed as weak, corrupt, or ruled by “Nazis.” The European Union and NATO are framed as collapsing, divided, hypocritical, or morally exhausted. Russia is recast, once again, as the misunderstood victim. None of this is new. What is new is the timing, the coordination, and the way these messages are increasingly woven into language of mobilisation, identity, and existential threat — and then carefully localised across national narratives and languages throughout the continent.

This is no longer only about persuasion. It is about preparation.

Across Telegram, especially within ecosystems associated with the @InfoDefense brand and its wider network, the recycling of classic Kremlin narratives has taken on a sharper tone. The war is not merely justified; it is aestheticised and normalised. Western institutions are not just criticised; they are delegitimised. And societies are not just confused; they are urged to “defend,” “protect,” and “resist.”

The shift matters because it marks a transition from influence to activation. From shaping opinion to shaping readiness.

Nowhere is this more visible than in the Western Balkans. In Serbia in particular, but also in North Macedonia and neighbouring countries, pro-Russian geopolitical narratives are being fused with local identity politics — nationalism, historical grievance, and civilisational framing. These messages rarely stay confined to fringe channels. They migrate quickly into mainstream digital media, into television debates, into opinion pages, and even into news agency reporting, often in softened or disguised form. In this sense, the Western Balkans once again emerge as both a testing ground and a demonstration case for the effectiveness of Russia’s hybrid operations of influence. This effectiveness is enabled by local political and economic power structures, and only weakly countered by civil society, independent media, and critical intellectuals.

Diaspora communities further amplify this circulation, redistributing narratives through podcasts, social platforms, and informal networks that transcend borders — influencing not only their countries of origin, but also the societies in which they are embedded. In many Western democracies across Europe and beyond, including Canada, the United States, and Australia, Balkan diaspora communities have become significant actors within public discourse and information ecosystems.

What begins as disinformation becomes conversation. What begins as manipulation becomes atmosphere.

Once narratives have entered the social bloodstream, they become available for political use. A similar dynamic is unfolding across Western Europe, where far-right parties and media increasingly echo narratives that align closely with Kremlin strategic goals. Opposition to NATO and the EU, rejection of liberal democracy, and calls for “realism,” “peace,” or “compromise” – meaning acceptance of Russian demands – converge into a single rhetorical field. This convergence does not always require coordination. Ideological compatibility is enough.

Different actors, same effect.

What gives these patterns their real significance is not their content alone, but their function. Hybrid warfare does not begin with tanks. It begins with meaning. It works by eroding trust, normalising conflict, and blurring the boundary between truth and threat. It aims to destabilise societies from within, below the threshold of open war, through a blend of information operations, cyber disruption, covert action, and proxy actors.

The narrative components now circulating with increasing intensity — mobilisation language, institutional distrust, identity triggers — are precisely those required for hybrid tactics to function. They lower social resilience. They justify exceptional measures. They make instability feel natural and resistance feel futile.

When people are convinced that collapse is inevitable, enemies are everywhere, and institutions are illegitimate, almost any action can be framed as necessary.

That is the danger.

So far, no large-scale, openly attributable physical hybrid operation has been confirmed. But the margins are active. Recruitment attempts via Telegram for low-level tasks such as reconnaissance or sabotage have been documented. Cyber operations are ongoing. Drone and airspace intrusions have become routine in several European countries, including around critical infrastructure and airports. A recent pro-Russian cyberattack targeting French postal systems is one example of how disruption is shifting toward low-visibility, plausibly deniable forms.

Governments are responding. Poland’s deployment of anti-drone fortifications is one visible sign. But defence always lags behind adaptation.

The most exposed zones are those where strategic sensitivity meets internal vulnerability: Germany, Central and Eastern Europe, the Western Balkans, the Baltic States, Moldova, and Romania. These are regions where geopolitical pressure intersects with political polarisation, institutional strain, and proximity to conflict. They are ideal testing grounds for hybrid tactics.

In the coming days and weeks, we should expect continued probing and gradual escalation. More drone incidents near borders and critical infrastructure. More cyber disruption targeting services and logistics. More narrative pressure, more emotional framing, more calls for “defence” and “protection.” Actions designed not to conquer territory, but to exhaust institutions, confuse publics, and normalise instability.

What we are witnessing is not yet escalation.

It is the phase before escalation.

Narratives are accelerating. Emotional triggers are intensifying. Extremist and foreign influence ecosystems are converging. Operational signals are appearing at the margins. The buffer against escalation is shrinking.

In hybrid conflict, the decisive battles are often fought before anyone realises they have begun.

And they are fought in the space between perception and reality.

Read more

Pro-Russian cyberattack on France’s national postal service — AP News (5 days ago)
A pro-Russian hacking group claimed a major cyberattack on La Poste, France’s postal service, disrupting services during a peak period. French authorities view it in the context of Russia’s broader hybrid warfare campaign aimed at destabilising European support for Ukraine. (AP News)

Drone and Balloon Incursions Delayed Travel at Major European Hubs, Stirring Hybrid Warfare Fears
Drone and balloon incursions are forcing sudden shutdowns at major European airports from Copenhagen and Oslo to Munich and Vilnius, disrupting tens of thousands of journeys and highlighting growing security gaps across the region’s airspace. (TheTraveler.org)

EU extends sanctions against Russia and notes rising tensions — The Guardian (6 days ago)
The EU Council extended economic sanctions against Russia in reaction to ongoing aggression in Ukraine, indicating persistent political conflict and rising anti-Ukrainian sentiment in some member states — partly fuelled by disinformation and historic grievances. (The Guardian)

French military intelligence flags increased drone overflights — Le Monde
France’s Military Intelligence chief noted a rise in suspicious drone overflights testing defence systems, illustrating hybrid threat concerns for European countries’ airspace security. (Le Monde.fr)

EU officials warning
Reports that EU officials are warning of persistent, coordinated Russian hybrid threats and outlining counter-response tools, reinforcing the narrative that hybrid influence continues despite sanctions pressure. (Kyiv Post)

Contextual and Supporting Referential Sources

Hybrid threat environment & Western Balkans focus: Civil Today’s Early Warning report plus Hybrid CoE documentation shows strategic targeting of the region. (CIVIL Today)

EU institutional and political context: The EU sanctions narrative and Kyiv Post reports provide policy context and show growing debate about hybrid threats. (The Guardian)

Narrative spread & platforms: Research on Telegram, disinformation datasets, and hybrid warfare syntheses support how narratives become socialised and are exploited regionally. (arXiv)

EUISS / EU Hybrid Threats Briefs
The European Union Institute for Security Studies’ hybrid threats content highlights long-standing concerns about hybrid operations in the Western Balkans and beyond, underscoring the strategic importance of this region in Russia’s broader hybrid playbook. (iss.europa.eu)

European Centre of Excellence on Hybrid Threats (Hybrid CoE)
Hybrid threat conference and simulation exercises in Tirana underscore how hybrid actors, including state and non-state actors, are influencing the Western Balkans and why such regions remain strategic focus areas for hybrid influence and counter-measures. (hybridcoe.fi)

This analysis was prepared by Jabir Deralla (pen name of Xhabir M. Deralla) in cooperation with the CIVIL Hybrid Threats Monitoring Team, with analytical support from AI tools (OpenAI / ChatGPT).

This analysis was produced within the framework of the Democracy Navigator project implemented by CIVIL – Center for Freedom, with the support of the German Federal Foreign Office. The views expressed are those of the author and do not necessarily reflect the views of the Federal Foreign Office or any other partners.