Russia’s campaign against Europe has steadily shifted from shaping opinion toward sabotage, drone incursions and destructive cyber operations. Facing a stalemate on the battlefield, Russia has escalated hybrid attacks aimed at stopping military and energy support from reaching Ukraine. What signposts should leaders look out for as Russia tests the West’s tolerance for its hybrid tactics?
Intel 471’s geopolitical analysis team tracked this shift against a turbulent backdrop in Q3 2026. Trade tensions continued to strain economic relationships, even among allies, as the race for AI supremacy intensified. Ongoing conflicts kept global energy supplies insecure. Governments across Europe increased defense spending while heading into winter with thinned energy reserves.
In its 2025 annual report, the team set out predictions for 2026. Three proved especially relevant in Q3:
- State-backed cyber capabilities will continue to be used as part of broader warfare tactics.
- AI will become more of a geopolitical issue.
- Authoritarian regimes will leverage their stable political positions to reject agreements they find unfavorable.
The team’s Q3 assessment connects developments usually reported separately, from battlefield attrition and Kremlin budgets to drone strikes, state-backed intrusions and hacktivist DDoS attacks, to show where Russia is heading and what it means for organizations in Europe.
Why Russia is escalating
Russia’s war in Ukraine has stalled, with no net territorial gains since March and its highest monthly casualties of 2026 in September. However, that has not changed its strategy. Drawing on Institute for the Study of War analysis, the team assesses that Moscow continues to expect to outlast Western support despite slow battlefield gains and is trying to force Ukraine’s capitulation or major concessions by spring 2027, which is why its winter seasonal campaign to degrade Ukraine’s energy infrastructure began several weeks earlier than in previous years.
Moscow still shows no interest in a negotiated settlement, as the team’s prediction on authoritarian regimes anticipated. September’s State Duma election results and Russia’s 2027 federal budget both signal that Putin is preparing for at least another year of war, and for a long-term confrontation, and possibly future conflict, with NATO.
As the war grinds on, it is increasingly clear that Russia is unlikely ever to win decisively on the battlefield. It is therefore stepping up pressure on Europe to test its resolve to support Ukraine over the long term. Growing U.S. isolationism also gives Moscow a further incentive to test NATO’s tolerance for increasingly aggressive hybrid attacks and normalize that behavior.
How the tactics have shifted
The campaign is mostly orchestrated by the GRU, Russia’s military intelligence service, using methods established before the full-scale invasion of Ukraine to block and delay European military and financial support. Limited pushback from European NATO members has emboldened Russia to raise the severity of its attacks.
The team expects this escalation to continue incrementally, with no limited ceasefire or meaningful diplomacy in the near term. Denmark’s Defence Intelligence Service has similarly warned that Russian hybrid attacks will become more frequent and damaging.
Q3’s most significant incidents show Russia clearly targeting Ukraine’s supply hubs, using the edges of the war zone to test NATO territory with plausible deniability. In one case, a Russian drone crossed Romanian and Bulgarian airspace undetected and exploded near the Trans-Balkan gas pipeline. Germany also stands out as a focal point for the full spectrum of hybrid activity, from drones to DDoS attacks.
Key Russian hybrid attacks in Europe, July–September 2026. Source: Intel 471.
The cyber domain
Cyber operations run alongside the physical campaign. In its 2025 annual report, the geopolitical analysis team assessed it was almost certain that Russian state-backed groups would step up targeting of NATO members aiding Ukraine and develop more effective social engineering.
In July, allied cybersecurity agencies attributed last winter’s attack on Poland’s energy grid to the FSB’s Centre 16, tracked as Ghost Blizzard. Centre 16, the Centre for Radio-Electronic Intelligence by Means of Communication aka TsRRSS, has an extensive history of drawing on its specialist SIGINT expertise to intercept foreign electronic communications and achieve technical penetration of targets.
In that attack, the group moved beyond prepositioning to attempted destructive wiper attacks. Allied agencies now warn it is scanning for poorly configured edge devices, such as routers, to reach critical infrastructure, a technique Chinese state-backed groups have long relied on. The team sees a risk that energy generation, backup facilities and cross-border interconnections that help stabilize Ukraine’s grid could be targeted this winter.
Russia is also using generative AI to support its cyber and information operations and its social engineering techniques are evolving. In addition to spear-phishing, some now use Half-Click exploits in webmail services, which compromise victims who simply open an email. Others use RedFlick, an infection chain that requires less interaction by victims than the widely used ClickFix technique.
The team expects to see expanded recruitment of proxy forces facilitated by in-country Russian assets as well as via underground forums and messaging applications. Russia’s intelligence and security agencies have an established history of coercing or coopting Russia-based cybercriminals into assisting with state-sponsored operations under protection-for-service arrangements.
Hacktivist campaigns continued, led by NoName057(16), long associated with Russian state-aligned actors. The group sustained DDoS campaigns throughout Q3, with most of its recorded attacks aimed at Estonia, France, Germany and Poland.
Who’s at risk in this landscape?
Escalation will almost certainly put commercial and public organizations at risk. No sector or industry is immune, but three have borne the brunt and will likely remain targets:
- Aerospace and defense faces drone attacks, sabotage by recruited assets and cyber espionage targeting intellectual property and resupply schedules, all aimed at disrupting military aid to Ukraine.
- Transportation and logistics faces arson at storage facilities, sabotage of rail cables and junction boxes, and DDoS attacks and intrusions against aviation, designed to degrade supply lines.
- Government faces espionage, DDoS, AI-assisted disinformation and interference with election infrastructure, intended to undermine confidence in democratic institutions.
Energy is the emerging fourth front. Beyond the cyber threat to grid infrastructure, Russia wants to choke off the fuel and grid components Europe sends to keep Ukraine’s power running, while European reserves are already depleted.
Two scenarios for the short to medium term
Intel 471’s geopolitical analysis team outlined two scenarios, each a course of action Russia could take.
Scenario 1: Calibrated escalation. Russia raises pressure in measured steps. It throttles supply chains into Ukraine, deepens Europe’s energy fragility over winter, bolsters Russia-friendly political parties, expands local recruitment and intimidates critics, possibly including assassination attempts. The aim is to normalize aggressive hybrid attacks, raise NATO’s tolerance for them and probe its response.
Scenario 2: Miscalculation. Russian hybrid escalation, or spillover from the war, prompts a limited NATO show of force or deployment. The Kremlin must then either escalate, risking an Article 5 response, or back down and lose strategic standing. Russian forces would mobilize on the western border and in Belarus, raising the chance of a limited incursion into a NATO country. The team has already observed shaping activity in the Baltics resembling what preceded the 2022 invasion of Ukraine.
Intel 471 anticipates the first scenario: continued incremental escalation, with no limited ceasefire or meaningful diplomacy in the near term. Russia almost certainly does not want direct military conflict with NATO. But its constant probing of NATO’s thresholds keeps the risk of a miscalculation, or an accident that causes casualties, extremely high.
The wider picture
Russia’s hybrid campaign is just one part of the team’s Q3 picture, which also examines how AI has become a geopolitical fault line: the U.S.-China race for supremacy, middle powers weighing their dependence on foreign hyperscalers, and the strain AI infrastructure puts on energy supplies. Intel 471 Geopolitical Intelligence on Verity471 helps organizations anticipate significant shifts in the geopolitical landscape, plan for them and mitigate the risks they bring. Using its SEMPLICE framework, the team tracks developments across eight categories, from economic and military to cyber and environmental, in Europe, Asia-Pacific, the Middle East and the Americas. Contact sales@intel471.com for a demo.
