Russia Is Already Waging an Undeclared War on Europe. Here’s How to Stop Its Hybrid Strategy

The bad news: Russia has long been waging a war against Europe that Europe is still inclined to ignore. The good news: Russia is waging this war at full capacity, and yet, thanks to a fairly robust historical immunity, Europe can still afford to ignore it. Without a proactive response, however, Europe may suffer far graver consequences.

Recent events can hardly be put down any longer to Europe’s accidental proximity to the war in Ukraine. On September 15, the US Department of Justice indicted five members of a network that, according to investigators, worked for the Russian intelligence services, recruited operatives for surveillance and contract killings in the United States and Europe, and prepared attacks on civilian and military infrastructure in countries that support Ukraine.

Over the past week, a Russian warship fired flares near a Danish military helicopter, a NATO fighter jet shot down a Russian drone over Lithuania, Russia struck a Ukrainian passenger train near the Polish border, and Poland recovered a Russian military drone from the Baltic Sea. EU High Representative Kaja Kallas drew these events, all within 48 hours, into a single picture, calling them calculated attempts to weaken Europe’s resolve and stressing that they were no accident.

European Commission President Ursula von der Leyen, pressing for new security measures after the Russian operation at Leipzig airport, described it as an attack using military-grade materials carried out by Russian operatives on European soil—an attack on the entire European Union that reaches beyond any single member state. Her conclusion: hybrid threats to Europe are becoming less and less hybrid, and less and less merely threats. She placed cyberattacks, sabotage, arson and drone incursions in the same category.

The fog of hybrid war

For a Europe that thinks in terms of international law, accepting that Russia is already at war with it does not come easily. Whether something is perceived as war depends on whether events have crossed a certain threshold.

The UN Charter does not define war as such, but it sets several thresholds for an international response. It prohibits states from the threat or use of force against another state; the Security Council may determine the existence of a threat to the peace, a breach of the peace, or an act of aggression; and an armed attack gives a state the right of individual or collective self-defense. The Definition of Aggression adopted by the General Assembly in 1974 covers invasion, bombardment, blockade, an attack on the armed forces of another state, allowing one’s territory to be used by another state for an attack on a third state, and the sending of armed bands whose acts are grave enough to amount to an armed attack.

The UN’s thresholds for recognizing a state of war are high, and under the UN Charter the ultimate arbiter of whether a war is under way, and of what is to be done about it, is the UN Security Council. In other words, quite apart from the high threshold for defining war as such, Russia, as a permanent member of that body, has no difficulty blocking both the legal consequences of its own aggression and any collective response from the international system.

The Geneva Conventions, which set out the modern body of the laws and customs of war, take the opposite approach to the threshold of war. There, it is deliberately set low. The laws and customs of war apply in the event of a declared war or any other armed conflict between states, even if one of them does not recognize a state of war. The actual use of armed force by one state against another is sufficient. A separate trigger is the total or partial occupation of another state’s territory, even if it meets with no armed resistance.

Establishing that an armed conflict exists within a state requires armed violence of sufficient intensity involving an organized non-state armed party. Internal disturbances, isolated acts of terrorism, or sporadic violence do not in themselves amount to an armed conflict. There must be a party to the war with its own command structure, control over part of the territory, and the capacity to conduct sustained and concerted military operations.

The Geneva Conventions deliberately stripped states of the right to decide whether a war has begun. As soon as the parties to a conflict begin acting under the laws and customs of war, whether they observe them or violate them, the war is already under way. In complex situations, an important reference point for whether the laws of war already apply is the position of the International Committee of the Red Cross (ICRC), which holds a special mandate with respect to the application of the Geneva Conventions and their Additional Protocols. In 2014, it determined that the laws and customs of war had to be applied in eastern Ukraine, without characterizing the nature of the armed conflict. In 2022, the ICRC declared that the laws and customs of war applied between Russia and Ukraine, citing Additional Protocol I to the Geneva Conventions, which governs international armed conflicts.

On the war Russia is waging against Europe, the ICRC is silent. That is largely because the Russians keep a close watch on the triggers for an international response to armed attack. Russian tradecraft here is far more elaborate than would be needed merely to breach the UN Charter covertly: for that, it is enough for Russia, as a permanent member of the Security Council, to substitute the “spirit of Anchorage” for the spirit of the UN.

Hence, neither NATO nor the EU calls what Russia is doing a war in the legal sense. These actions are described as hybrid warfare, but hybrid warfare has no definition in international law—any more than political, economic or any other “war” qualified by an adjective. Accordingly, no dedicated mechanisms for an individual or collective response to it have been created. For security institutions to respond adequately, a threshold equivalent to the outbreak of hostilities or to evident preparations for them has to be crossed. What is meant is tangible destructive consequences greater than, say, those of information operations and terrorism. Europe, where two world wars began and were largely fought, remains attentive to the criteria that distinguish war from peace—perhaps with those criteria skewed too far toward a major war waged with every kind of weapon.

This may be why European leaders, who understand full well what Russia is doing to Europe, avoid calling it a war.

When Russia creeps up, it is already at war

The Russians did not invent hybrid warfare. They stole an American concept, just as they once stole the atomic bomb, turned it inside out and made it an instrument of blackmail and aggression, pouring into it resources that any other country, except perhaps North Korea and Iran, would have put to better use.

The concept of hybrid warfare grew out of a practical problem the US military confronted at the end of the 20^th century: a modern army has to fight in societies where the state does not control everything. There, formal institutions coexist with clans, kinship networks, religious authorities, local rules and armed groups. What looks like chaos from the outside may have an order of its own within. In the early 2000s, US Marine Corps officers described this reality as a hybrid society, one in which war, too, inevitably takes a hybrid form.

The laws and customs of war do not disappear in such settings, but state control and responsibility become blurred. It is this property of the environment that makes war hybrid.

Russian practice turned this inside out, finding in it a tool for easy attack. Russia concluded that to use the instruments of hybrid warfare, which are cheaper than those of classical war, it simply had to drag a potential victim—one that, under normal circumstances, it would not dare attack—down to the level of a hybrid society, with dysfunctional political and economic institutions and blurred borders. That is what Russia does when it wages hybrid war: it turns the countries it deals with into prey that can be seized without military force and without setting off the triggers of international response that would be dangerous for Russia. Military force and the threat of it are important instruments of Russia’s hybrid war, but by design, combat operations are not essential to seizing the victim, and in Russian plans they are not the main phase of aggression in terms of either time or resources.

If Russian aggression in the classical sense of the previous world wars has not yet occurred, that does not mean Russia is not waging war. (That this war is already under way was argued by Mykhailo Honchar in ZN.UA more than a year ago, in his article Zero Hour: Russia’s War against Europe—editor’s note.) More often, it means that individual instruments have worked at different times and failed to create the conditions for the terminal phase of Russian aggression. The most convenient target is a country in which weak institutions, economic trouble, polarization and Russian networks of influence have already accumulated by the right moment. If this succeeds, the open phase of Russian aggression is meant to be perceived as destiny ordained by history as written by Medinsky, while the Russian operation itself is lost in a chain of seemingly inevitable events. Open aggression, should it come, is already the terminal phase of Russia’s war, and perhaps not the main one in terms of the resources and time invested.

In Ukraine, Russia’s hybrid strategy has ended in fiasco. The attempt to seize Ukraine quickly after a long period of hybrid preparation led to a protracted war of an entirely different kind from the one Russia wanted. Russia is prepared to spend a long time digesting a victim already ravaged by hybrid means, but it is not prepared to embark on a long classical war. When it attacked Ukraine, Russia did not want a protracted hot war. That is why it is now urging the world to embrace the “spirit of Anchorage,” which is supposed to persuade Ukraine to accept absorption by Russia and thereby bring the hot phase of the war to an end.

Yet the fiasco in Ukraine has not led Russia to abandon the concept itself: with a characteristically Russian faith in luck, it is still banking on some victim country eventually “ripening,” one whose seized resources would repay the cost of hybrid instruments. Russia attacked Ukraine in 2014 and pressed on with the attack in 2022 not because something happened in those years or because Ukraine somehow posed a threat, but because Russia believed that Ukraine, under hybrid influence, had “ripened” into a convenient victim. And if Russia is now edging toward an armed attack on Europe, it is not because Europe poses a threat to Russia but because Russia believes that Europe is ripening into a victim and that circumstances favorable to a Russian attack may take shape.

Little has probably changed in Russia’s strategy toward Europe since 2022, except that, in the wake of its hybrid war fiasco in Ukraine, Russia’s hybrid instruments against Europe have become more forceful and closer to the instruments of classical war. This creates a situation that Europeans find easier to understand, with less of the fog of hybrid war.

Europe’s limited preparedness

NATO’s Strategic Concept, adopted in Madrid in 2022, identified Russia as the most significant and direct threat to Allies’ security for the first time after a long period of partnership, and stated that hybrid operations could reach the level of an armed attack. In Vilnius in 2023, the Allies named political institutions, critical infrastructure, societies, democratic systems, and economies as the targets of Russian operations. In Washington in 2024, the Alliance reaffirmed that Article 5 could be invoked in response to a hybrid operation. In Ankara in 2026, NATO continued to rank hybrid threats alongside the other drivers of the new security environment.

But military tools evolve more slowly than the political understanding of the threat. NATO is overhauling its defense plans and building up high-readiness forces, air and missile defense, long-range capabilities, logistics, stockpiles and defense production—that is, above all, capabilities for a situation in which an attack is already evident. For other situations, there is no comprehensive mechanism for a collective response. The political definition of what may count as an attack has already changed, but no new instruments of collective response have been created.

In March 2026, the Council of the EU described Russia’s actions as sustained, coordinated, and long-term hybrid campaigns against the Union, its member states and partners. Where the EU is better prepared is precisely in detecting a hybrid campaign and breaking it down into its separate strands. The 2022 Strategic Compass provided for the creation of the EU Hybrid Toolbox, which brings together diplomatic, sanctions, information, cyber and other response instruments. The Hybrid Fusion Cell, set up as early as 2016 within the EU’s intelligence center, INTCEN, collects and analyzes information from member states, EU institutions and partners, not least in order to uncover links between incidents that at first appear isolated. Since 2024, the EU has been able to deploy Hybrid Rapid Response Teams. The mechanism was first used in Moldova in 2025.

Yet the EU mostly detects, coordinates, assists and imposes sanctions. Policing, counterintelligence, border protection and the use of force remain largely in the hands of member states, while military deterrence is NATO's business. The EU is therefore now better at seeing a hybrid campaign as a whole than at stopping it through centralized action.

The European Centre of Excellence for Countering Hybrid Threats (Hybrid CoE) in Helsinki is a separate, autonomous international expert organization, established in 2017 with the participation of EU and NATO states. It conducts research, training and joint exercises and helps the EU and NATO develop a shared understanding of hybrid threats, but it is not an operational body of either.

At the national level, operational capabilities are broader: the police, counterintelligence, border guards and armed forces can investigate, detain, expel, intercept and use force. But it is precisely here that a hybrid campaign breaks down into separate cases—the sabotage at Vrbětice, the assassination attempt in Salisbury, migration pressure, incendiary parcels, airspace violations by drones and missiles. States therefore respond more quickly to a specific episode, while the EU and NATO are better at seeing the connections between episodes. Hence, the main challenge is to bring these two levels together before individual attacks produce a cumulative effect.

The center of gravity of hybrid war

The center of gravity is a key concept of war. In hybrid war, the main kinetic effect may be built in as early as the stage of preparing for the kinetic phase, when international, and often national, means of response are simply absent. Understanding where this center of gravity lies and what it looks like makes it possible to use resources optimally. An effective strike at the center of gravity robs the enemy’s strategy of its coherence and sets the enemy on the road to defeat.

What, then, is the center of gravity of Russia’s hybrid war, the point toward which Europe’s main efforts should be directed? It is the synchronization of the most damaging manifestations of the hybrid instruments Russia employs against its potential victims.

Russia can wait for years for the moment when, in a given country, cold weather and high energy prices coincide with a decisive election, all the while manipulating energy supplies to international markets, buying up fringe political parties and preparing waves of terrorist attacks and flows of refugees well in advance. When the other elements converge, Russia also has faster levers of influence up its sleeve—information operations, cyberattacks, snap military exercises, anonymous drones and civilian barges with strike potential.

Russia can now, as before, kill a person, set fire to a warehouse, bribe a politician, send a poisoned parcel to a government agency and run an information operation. Russia has done so and will go on doing so for as long as its current regime survives. But without synchronization with economic processes, elections and military maneuvers, none of this allows Russia to achieve the kinetic effect of hybrid war, an effect that would equal in its impact the kind of military aggression to which NATO might ultimately respond.

An effective response to Russian hybrid aggression therefore requires establishing what exactly Russia is preparing now, what timing it is preparing its actions for and in what broader context of events a given action is meant to materialize. The military part of the response is to “cut off” Russia’s use of weapons at moments when political, social and economic tensions peak in a particular European country or region. NATO is capable of doing this, given proper threat assessment and coordination of instruments. This matters, and in many cases it can make it possible to weather a Russian hybrid attack without kinetic consequences. But it makes no sense to expect the Alliance to respond to the entire spectrum of Russian hybrid instruments.

The main gap in the response to Russia’s hybrid actions lies within the EU’s remit. The response must keep Russia’s actions apart, in separate, isolated domains with no possibility of synchronization. Energy problems must remain energy problems, political problems political and legal problems legal. Russia needs them synchronized. Europe needs the ability to desynchronize them.

Russia is already using the full range of hybrid pressure tools it can afford. The only thing that could radically boost Russia’s capabilities is the special circumstance of these instruments being used simultaneously in one place. Preventing such circumstances from arising is the cheapest way to deter Russia.

Europe probably already has a good grasp of the nature of Russia’s war against it and harbors no illusions about whether the Russians want one: they do, but only a war they can win with impunity. That limits Russia’s scope for escalation. The difficulty is that a mechanism for repelling Russian hybrid aggression must be put in place simultaneously within NATO, the EU and national governments. Europe is working on it, but seemingly more slowly than Russia is modernizing its instruments of hybrid attack.