By Xhabir Deralla
Amid the thick fog of hybrid and conventional warfare—where frontlines are blurred and casualties pile up by the minute, forming a grim picture of the world in the third millennium—understanding what is truly happening has never been more difficult. In an era of astonishing technologies and unprecedented speed in the spread of media content, obvious and well-documented facts nevertheless become subjects of debate, while history itself is constantly distorted or rewritten. For years, countless warnings about Russia’s hybrid war against Europe were ignored and dismissed. Only recently have European leaders begun to act and to speak clearly and directly. Late? Certainly. Too late? Let us hope not. But at least the threat is finally being recognized and acknowledged. And that is, at the very least, a beginning.
Alarm Raised: Europe Finally Acknowledges It Is Under Attack
In an interview on August 31 with German public broadcaster ZDF, Chancellor Friedrich Merz delivered one of the clearest warnings yet about the dangers posed by the Kremlin. He stressed that peace cannot come at the expense of Ukraine’s sovereignty, while also warning of Russian attempts to destabilize Germany through hybrid operations and sabotage.
“Germany is already in conflict with Russia,” the Chancellor warned.
Merz’s statement is part of a series of messages from Western European leaders who increasingly speak with clarity and without diplomatic gloves. It is an alarming reminder of a reality that, truth be told, has long been documented by some analysts and civil society organizations across Europe, including CIVIL. Meanwhile, the mainstream in politics, business, academia, media, and civil society contented itself with the illusion of a status quo—an illusion that, in essence, was crafted by the Kremlin.
Russia’s war does not end at Ukraine’s borders. Hybrid warfare—an amalgam of conventional force and covert, unconventional tactics—has become a permanent feature of the Kremlin’s strategy to weaken European cohesion, disrupt critical infrastructure, undermine trust in democratic institutions, and influence political processes, all without crossing the threshold of open war.
The Arsenal of Russian Hybrid Threats
Russian hybrid operations include sabotage, arson, cyberattacks, electromagnetic interference, disinformation, and espionage. Between 2014 and 2024, researchers and security structures documented hundreds of serious incidents across Europe, not counting influence operations.
As the prestigious British think tank RUSI warned in an analysis published in July 2025, Moscow even has the potential to launch disruptive operations using solar geoengineering technologies—pushing the boundaries of destabilization into the climate sphere.
Since 2022, Germany has been the target of a series of sabotage acts: arson at the Diehl factory producing Iris-T air defense systems; an explosive device that caused a fire at the DHL hub in Leipzig; destruction of parked military trucks in Erfurt; as well as sabotage aboard German navy ships, including damaged cables and contaminated water systems.
Poland, meanwhile, has been hit by fires at shopping centers, warehouses, and even an IKEA facility—operations linked by investigators to Russian intelligence services.
In the United Kingdom, a DHL warehouse in Birmingham was struck by an incendiary parcel attack carried out by operatives of Russia’s Main Intelligence Directorate (GRU – Главное разведывательное управление).
France and Estonia reported similar incidents, accompanied by disinformation campaigns designed to sow fear and mistrust.
The Digital Battlefield
Battles have also flared up on the digital battlefield. According to the Center for Strategic and International Studies (CSIS), the number of cyber sabotage incidents and espionage attempts tripled between 2023 and 2024. A central role in this digital war is played by a large number of well-organized and networked groups sponsored or directed by Russia.
Examples of their subversive actions are numerous and intensified significantly after the start of Russia’s full-scale aggression against Ukraine. Their operations are linked to attempts to influence political events, such as the hacking during the 2016 U.S. presidential elections, repeated intrusions into the German Bundestag, and ongoing targeting of political parties and foundations through phishing and malicious software.
It is difficult to obtain precise data on the number, scope, and capacities of the groups active in the cyber war against Europe. What is known is that the Kremlin’s digital echelons and pro-Russian structures in this domain are most often sponsored by the Russian state, but also by pro-Russian politicians and businessmen in Western countries. Some are even voluntary pro-Russian hacktivist groups motivated by ideology. These actors operate with varying degrees of coordination and autonomy, but together they strengthen Russia’s capacities for cyber warfare and espionage.
Brief Overview of Russian Digital Echelons
Fancy Bear (also known as APT28 or Sofacy) is a Russian cyber-espionage group that works closely with and enjoys high trust from the GRU (Russian military intelligence). Active since at least 2004, the group specializes in highly targeted phishing attacks, malware installations, and espionage operations against entities in aerospace, defense, energy, government institutions, media, and dissident communities worldwide.
APT29 (also known as Cozy Bear or Midnight Blizzard) is attributed to Russia’s SVR (Foreign Intelligence Service), a group formed in 2008 or earlier. Known for its technical sophistication and subtlety, the group frequently targets Western governments, diplomatic networks, research institutions, and think tanks. It carries out advanced operations—stealing user credentials, conducting watering hole attacks, and deploying deceptive methods to evade detection—demonstrating persistent espionage capabilities.
Sandworm (APT44, also known as Seashell Blizzard) emerged between 2004–2007 and operates under GRU Unit 74455. It has been responsible for some of the most destructive cyberattacks, including the power grid blackout in Ukraine in 2015, the NotPetya malware epidemic in 2017, interference in the French elections in 2017, and disruption of the 2018 Winter Olympics. Sandworm employs zero-day exploits, spear-phishing, and custom malware for cyber warfare and espionage.
Berserk Bear (also known as Energetic Bear or Dragonfly) is an advanced persistent threat group aligned with Russia’s FSB. It specializes in cyber-espionage targeting critical infrastructure—particularly water and energy—in Western countries, including the U.S. and Germany. Their campaigns often involve deep, stealthy infiltrations of networks, focusing on intelligence collection and potential future sabotage—operations in the style of “Chekhov’s Gun,” designed primarily for psychological effect rather than immediate physical disruption.
NoName057(16) emerged in March 2022 as a loosely organized pro-Russian hacktivist collective responsible for DDoS attacks against Ukrainian and Western governments, media, and companies, including the NATO Summit in The Hague in July 2025. Activities were coordinated through Telegram and GitHub, with distribution of the DDoSIA tool and claims of responsibility for attacks on high-profile targets ranging from news portals to transport systems across Europe and North America. In mid-July 2025, a coordinated international crackdown—Operation Eastwood—involving 19 countries under Europol and Eurojust leadership disrupted the group’s infrastructure, taking down over 100 servers, carrying out 24 searches, issuing 7 international arrest warrants, making 2 arrests, and warning more than 1,000 supporters of potential legal consequences.
Killnet, formed around March 2022, is a well-known pro-Russian hacktivist group infamous for destructive DDoS and DoS campaigns targeting governments and companies supporting Ukraine. The group repeatedly attacked Western infrastructure during high-profile events such as NATO summits. Although it publicly denies direct links to the Kremlin, cybersecurity experts view it as part of the broader Russian cyber-proxy network. After a period of inactivity, Killnet resurfaced with new leadership and tactics. Its founder—known by the alias “Killmilk”—was exposed as Nikolay Serafimov, a 30-year-old with prior convictions for drug trafficking.
Cyber Army of Russia Reborn (CARR) emerged as a rebranded pro-Russian hacktivist group conducting DDoS attacks, website defacements, and data theft against NATO member states and Western infrastructure. Often mentioned alongside Killnet and XakNet in coordinated operations, CARR functions as part of Moscow’s broader strategy of deploying semi-autonomous hacktivist groups to amplify cyber threats.
CyberBerkut, founded around 2014, is a pro-Russian hacktivist group known for high-visibility DDoS attacks and propaganda operations targeting Ukrainian state agencies, Western corporations, and NATO-related websites. Operating as a virtual association of internet vigilantes, it has ties to the GRU despite claiming activist motives, ostensibly to “resist neo-fascism in Ukraine.” Although considered still active, no recent operations have been attributed to the group.
The Ecosystem of Digital Warfare
The ecosystem of digital warfare developed by the Kremlin is complex and multilayered. It intertwines different categories of actors—from ideologically motivated hacktivists, through criminal groups operating under pressure or in agreement with the state, to private military companies that increasingly offer digital and cyber services. Though seemingly diverse, they all share one common feature: supporting Moscow’s strategy by forming a network of tools and people that enables covert yet destructive action.
Patriotic Hackers – individuals or ad-hoc collectives who initiate cyber operations in line with Russia’s military-propaganda narratives—often motivated by ideology rather than under direct state control. Although formally unorganized, many conduct hacktivism aligned with the Kremlin’s interests.
State-Controlled Cybercriminals – this group includes independent hackers and cybercriminals who are coerced or incentivized by agencies such as the FSB to carry out offensive operations. They operate in the gray zone between crime and state service, sometimes continuing independent criminal activities freely as a reward for participating in cyberattacks organized or commissioned by Russian state agencies.
Private Military Contractors (PMCs) – such as the Wagner Group and other paramilitary formations, increasingly provide cyber and digital services, as well as SIGINT, alongside their traditional military roles. Though formally private, many operate under Kremlin direction, offering plausible deniability for cyberwarfare operations abroad.
Escalation of Digital Disruption Across Europe
Tactics of blocking and spoofing GPS signals are an important component of Russia’s hybrid warfare strategy, aimed at disrupting both civilian communications and transportation as well as military operations across Europe.
Since the start of Russia’s full-scale invasion of Ukraine in 2022, there has been a dramatic increase in incidents of digital disruption, blocking, and spoofing, particularly in Eastern Europe. These operations threaten aviation, maritime navigation, and drone operations.
According to Euronews, in June 2025 alone Lithuania reported over 1,000 cases of digital disruption—22 times more than in the same period the previous year. Estonia recorded an 85% increase in GPS interference affecting flights. Poland reported 2,732 cases in January 2025.
One of the most notable incidents of this type of hybrid military operation involved the plane of European Commission President Ursula von der Leyen, which lost GPS navigation while approaching Plovdiv Airport in Bulgaria. The aircraft had to rely on traditional navigation methods for a safe landing. Although not officially confirmed, it is also known that in 2023, North Macedonia’s Foreign Minister Bujar Osmani—while serving as OSCE Chairperson-in-Office—was targeted by similar GPS jamming.
Russia invests heavily in upgrading its electronic warfare (EW) systems. This type of weaponry today can be decisive—both on the battlefield and in hybrid warfare operations. Key EW systems in the Russian military arsenal include:
Borisoglebsk-2: a multifunctional EW system mounted on nine MT-LBu armored vehicles adapted for varied terrain. Its purpose is to jam tactical communications and navigation signals, including GPS. The system controls four types of jamming stations from a single command post.
R-330Zh Zhitel: a truck-mounted (Ural or KamAZ) jamming system designed to disrupt GPS navigation signals, satellite communications (Inmarsat, Iridium), and GSM communication. Covering a frequency range of 100 MHz to 2 GHz, it is used to protect command posts from precision-guided munitions and has a range of up to 30 km for GPS jamming.
Krasukha-2 / Krasukha-4: mobile EW systems designed to jam radar systems, including AWACS aircraft and satellites. Krasukha-2 operates in the S-band with an effective range of around 250 km, while Krasukha-4 works in the X-, Ku-, and Ka-bands, disrupting radar and low-Earth orbit satellites at ranges up to 300 km.
RB-341V Leer-3: a mobile electronic reconnaissance and jamming system installed on Tigr-M or KamAZ platforms, integrated with Orlan-10 UAVs. It disrupts GSM networks within a radius of about 6 km, can locate users, send fake SMS messages, and spoof network nodes, providing SIGINT and psychological influence in real time.
Between Technological Advantage and Systemic Weaknesses
At present, Russia holds a proven advantage on the ground in land-based electronic warfare capabilities. However, European and NATO countries are responding by investing in airborne electronic warfare platforms, AI-driven systems, and mobile innovations.
Russia’s strategy is often undermined by poor command decisions, disrupted supply chains, and poorly trained soldiers—factors that contribute to catastrophic losses and low effectiveness. The image of soldiers fighting with shovels is not just metaphorical (as seen in Bakhmut and other urban battlefields in Ukraine); it is an indicator of both severe human losses and systemic failure.
All of this is just a small fragment of the massive operations continuously carried out by Russian state services and pro-Russian entities against Europe.
Hybrid warfare is designed not only to cause disruption but also to exhaust societies politically, economically, and psychologically. Its goal is to fracture alliances, undermine trust in democratic institutions, and create divisions along ethnic, cultural, or ideological lines. Recognizing and exposing the strategies and tactics, their origins, and objectives is essential to protect democracy, stability, and the security of states.
(to be continued)
CIVIL Today | Editorial Note: The author is currently working on a book about Russia’s hybrid war, scheduled for release in 2026. Part of the research and editing was carried out with the assistance of artificial intelligence (ChatGPT by OpenAI). The author assumes full responsibility for the content.
