Russia is significantly escalating its use of ‘New Generation Warfare’ (NGW) tactics across Europe, expanding beyond its traditional sphere of influence since the full-scale invasion of Ukraine in February 2022. This strategy, articulated by Valeriy Gerasimov, Chief of the General Staff of the Russian Armed Forces, in 2013, involves a complex toolkit of psychological, cyber, and physical tactics. These are designed to achieve strategic aims without resorting to conventional kinetic warfare, aiming instead to manipulate public opinion, collect intelligence, and degrade critical infrastructure, according to Recorded Future’s Insikt Group.
Analyzing Russia’s New Generation Warfare Tactics Across Europe
The escalation observed since 2022 encompasses diverse methods, targeting NATO member states and countries supporting Ukraine. Insikt Group assesses that while currently largely opportunistic, these actions lay the groundwork for a potentially full-scale NGW campaign, especially in the lead-up to the 2028 U.S. Presidential election.
Influence Operations: Detecting Russian Influence Operations
Russian influence operations are a cornerstone of NGW, consistently deployed to manipulate public opinion, particularly in key European states like the UK, France, Germany, and Poland. These operations often involve impersonating legitimate national and pan-European media outlets to disseminate Kremlin propaganda. Notable examples include campaigns like Doppelgänger, Operation Overload, Operation Undercut, and CopyCop. Security professionals tasked with detecting Russian influence operations should monitor for coordinated inauthentic behavior, media impersonation, and the propagation of divisive narratives aimed at undermining public trust and European unity.
Airspace and Territorial Waters Incursions
Since March 2022, suspected violations of NATO airspace by Russian drones or jets have increased, with 23 confirmed or suspected incidents between March 2022 and August 2025. Projections indicate a further rise to 30 violations between September 2025 and January 2026, reaching unprecedented levels. Countries most frequently targeted include Poland and Romania, but incursions have also occurred in Germany, the UK, Denmark, and Norway. Simultaneously, Russia is increasingly violating NATO territorial waters and targeting undersea cables to test resilience and gather intelligence. These actions serve to keep NATO in a reactive, defensive posture.
Physical Sabotage Against Critical Infrastructure
Russia-nexus individuals and entities are increasingly engaging in physical sabotage operations within NATO territory. These attacks target civilian or dual-use critical infrastructure that directly or indirectly supports European collective defense or material aid to Ukraine. The goal is to degrade essential services, propagate narratives of Western states’ inability to protect their populations, and hinder NATO’s collective response capabilities. This presents a direct and tangible threat to national security and economic stability across the continent.
Offensive Cyber Operations: Persistent Access and Intelligence
Russian offensive cyber operations against European targets predominantly focus on gaining and maintaining access. Attacks commonly target internet-facing firewalls, virtual private networks (VPNs), email services, and web portals. The primary intent behind these access-oriented operations is intelligence collection, establishing operational reach, and securing long-term access, rather than immediate, disruptive attacks. These activities are broad in scope, impacting multiple regions and sectors, and underscore the persistent threat to governmental and private sector networks.
Recommendations for Mitigating Russian Hybrid Threats
To counter Russia’s New Generation Warfare tactics across Europe, organizations and governments must adopt a multi-faceted defense strategy.
- Prioritize Critical Infrastructure Protection: Governments and private entities operating critical infrastructure (e.g., energy grids, telecommunications, transportation) must implement enhanced physical and cyber security measures. This includes regular vulnerability assessments, penetration testing, and incident response planning specifically tailored to sabotage scenarios.
- Enhance Threat Intelligence Sharing: Improve collaboration and information sharing between government agencies, industry partners, and international allies regarding observed NGW tactics, techniques, and procedures (TTPs). Shared intelligence helps anticipate and counter evolving threats.
- Strengthen Cyber Defenses: Focus on securing perimeter defenses, email systems, and VPNs, which are common initial access vectors for Russian cyber operations. Implement multi-factor authentication, network segmentation, and advanced endpoint detection and response (EDR) solutions. Regular patching and security awareness training are also vital.
- Counter Disinformation: Develop strategies to identify, expose, and counter Russian influence operations. This includes promoting media literacy, supporting independent journalism, and fostering public resilience against propaganda. Awareness of common disinformation tactics can help individuals and organizations avoid being unwitting conduits for foreign influence.
Effective defense against Russia’s NGW requires a holistic approach that integrates cyber, physical, and informational security to build collective resilience.
Related: BusySnake Infostealer Targets Critical Infrastructure: Armored Likho’s TTPs, Gunra Ransomware Exploits Fortinet Flaws and Bypasses MFA