Planning for Russia’s escalating hybrid war

Russia is escalating hybrid warfare against Europe, shifting tactics toward sabotage, drone incursions, and cyber operations to prevent military and energy support from reaching Ukraine. This escalation occurs against a backdrop of strained economic relations, intensifying AI competition, and insecure global energy supplies. The shift in strategy stems from Moscow's expectation to outlast Western support and its goal to force concessions from Ukraine by 2027, evidenced by preparing for another year of conflict with NATO.
The campaign is orchestrated by the GRU using methods established before the invasion to delay support. Recent incidents include Russian drones crossing airspace and attacks on energy infrastructure, such as near the Trans-Balkan gas pipeline. Cyber operations are linked to physical campaigns, involving state-backed groups targeting critical infrastructure and employing evolving social engineering techniques like Half-Click exploits.
The risk is widespread, affecting commercial entities in aerospace and defense, transportation/logistics, and governments through espionage, disinformation, and interference with election systems. Energy infrastructure is an emerging target as Russia seeks to restrict European supply. Two escalation scenarios exist: calibrated escalation, where Russia incrementally raises pressure and normalizes aggressive tactics, or miscalculation, where a limited NATO response could trigger broader conflict risk.

* State-backed cyber capabilities will continue to be used in broader warfare tactics.
* AI will become more of a geopolitical issue.
* Authoritarian regimes will leverage stable political positions to reject unfavorable agreements.
* Russia's strategy aims to force Ukraine's capitulation or major concessions by spring 2027.
* The winter seasonal campaign to degrade Ukraine’s energy infrastructure began earlier than in previous years.
* Russian hybrid attacks are mostly orchestrated by the GRU.
* Incidents include a Russian drone crossing Romanian and Bulgarian airspace near the Trans-Balkan gas pipeline.
* Germany is a focal point for hybrid activity, including drone and DDoS attacks.
* State-backed groups have targeted NATO members aiding Ukraine and attempted destructive wiper attacks on energy grids.
* Cyber operations use techniques like Half-Click exploits and RedFlick infection chains.
* Hacktivist campaigns led by NoName057(16) sustained DDoS campaigns in Q3 2026 against Estonia, France, Germany, and Poland.
* Targets include aerospace/defense (IP disruption), transportation (sabotage of rail/aviation), government (disinformation, election interference), and energy infrastructure.
* Two scenarios are calibrated escalation or miscalculation leading to a potential NATO response.

The narrative highlights a fundamental tension: an adversary attempting to win a prolonged conflict through asymmetric hybrid means while the target is forced to test its commitment to long-term support. The shift described—from shaping opinion to direct sabotage—suggests a calculated response to battlefield stalemate, prioritizing systemic pressure over immediate kinetic success. The integration of cyber, AI, and energy threats reveals a strategic convergence where conventional warfare objectives are pursued through destabilizing the supporting systems of the adversary.
The pattern observed involves using plausible deniability (e.g., drone incursions near non-aligned borders) to probe thresholds without triggering an immediate Article 5 response, aiming for incremental erosion of resolve rather than direct confrontation. This plays into a cycle where aggression is normalized as NATO tolerance is tested, potentially driven by external factors like U.S. isolationism, which grants Russia an incentive to test boundaries further.
The emerging concern lies in the complexity introduced by AI and cyber warfare layered onto physical conflict. When state actors utilize sophisticated tools for social engineering and infrastructure targeting, the lines between kinetic events and information operations blur significantly. The risk is not just military loss but the systemic fragility of societal trust and critical infrastructure security. What is unstated is how resilience—in energy systems, democratic institutions, and collective will—is measured against this escalating, low-intensity pressure.
Bridge Questions: How does the perceived need for Russia to "outlast" Western support influence the calculus for responding to hybrid attacks? If calibrated escalation is the favored path, what specific internal political or security thresholds define a "miscalculation"? What mechanisms exist to build resilience when systemic threats span kinetic, informational, and energy domains simultaneously?