Russia’s Rising Hybrid Warfare and Sabotage Against NATO’s Eastern Flank

Escalating Hybrid Operations Along NATO’s Eastern Flank

The Congressional Research Service report documents how proximity to Russia and Belarus exposes these six nations to severe cross-border tactics. One study cited in the report reveals that Russian hybrid attacks in Europe quadrupled between 2023 and 2024. Data gathered through an alternative review documented a minimum of 151 instances of alleged Russian activities spanning from February 2022 to March 2026.

Poland has emerged as a focal point for these hostile actions. Poland’s Internal Security Agency reported in April 2025 that authorities had detained 44 people connected to spying or sabotage on behalf of Russia or Belarus since the 2022 invasion. The apprehended individuals included Russian, Belarusian, Ukrainian, and Polish nationals linked to an arson attack on a Warsaw shopping center, surveillance of sensitive military sites, and plots targeting railways carrying supplies bound for Ukraine. Two separate attacks damaged Polish rail lines on November 16, 2025, prompting Prime Minister Donald Tusk to describe them as an unprecedented act of sabotage. Polish authorities suspect two Ukrainian citizens working for the FSB who subsequently fled into Belarus.

Ahead of Poland’s 2025 presidential election, officials accused Moscow of spreading online disinformation and conducting cyberattacks against critical infrastructure. In May, Deputy Prime Minister and Digital Affairs Minister Krzysztof Gawkowski asserted in a speech reported by Polish media that the GU had doubled its information and cyber activity targeting Poland compared to the previous year.

Baltic States Target of Disruption and Influence Campaigns

In the Baltic states, influence operations consistently seek to delegitimize regional governments. These campaigns portray the three countries as dysfunctional, depict NATO and the United States as imperial powers, and characterize Baltic governments as Russophobe regimes oppressing ethnic Russian populations.

Distributed denial-of-service (DDoS) attacks and disruptive cyber operations attributed to pro-Russian hacker groups regularly target critical infrastructure, public service websites, media outlets, and the financial and transport sectors. Authorities have also tied Russian security services to vandalism targeting monuments, memorials, and pro-Ukraine symbols. Following the March 2024 hammer assault on the residence of the late Russian dissident Alexei Navalny’s chief of staff in Vilnius, intelligence officials in Lithuania assessed that the operation was likely planned and executed by Russia.

Latvian intelligence warned that Russia was preparing military provocations against the Baltic countries or Poland to test Western alliance cohesion. A senior political source from a second NATO member corroborated these concerns, stating that intelligence indicated Vladimir Putin was planning actions against the Baltic states to test US support for smaller member nations as Russia struggles with its invasion of Ukraine.

Black Sea Incursions and Border Escalations in Romania and Bulgaria

Romania, which shares a border with Ukraine, has recorded 29 unauthorized incursions of Russian drones into its national airspace, alongside numerous instances of drone debris landing on its territory. Since 2022, Romanian defense authorities have tallied in excess of 100 offensive Russian operations directed at Ukrainian locations close to their shared border. A residential structure in Galaţi suffered a strike from a Russian Geran-2 drone in May 2026, resulting in injuries to two individuals. Over three days in July 2026, Romanian F-16 fighter jets intercepted and shot down drones that entered national airspace, at least one assessed to be of Russian origin, prompting Bucharest to summon the Russian ambassador and expel a Russian diplomat. Bulgaria has faced cyberattacks attributed to pro-Russian groups, and the congressional report notes potential vulnerabilities within its defence industry.