Russia intensifies shadow war to undermine support for Ukraine

In May 2025, fires broke out at two properties linked to British Prime Minister Keir Starmer. Investigators later determined that the man who perpetrated these attacks, 22-year-old Ukrainian citizen Roman Lavrynovych, had been recruited and paid over messaging app Telegram by a Russian handler he never met. This month, the Financial Times reported that while Lavrynovych was convicted, the organizer remains in Russia and is linked to a pro-Kremlin group that the US has called a “state-sanctioned project.”

The arson attacks targeting the UK PM are just one recent example of Russia’s hybrid warfare that is currently underway across the West. This escalating shadow war being waged by the Kremlin includes attacks on undersea cables, sabotage operations, drone incursions, election interference, weaponized migration, and disinformation campaigns supercharged by artificial intelligence.

For years, Russia has used these tactics to divide Western societies and deter support for Ukraine, while remaining below the threshold that would trigger NATO collective security obligations and potentially warrant a military response. Western intelligence agencies are now sounding the alarm. In May, British spy chief Anne Keast-Butler warned that the UK and its allies occupy “a space between peace and war.” She accused Russia of “scaling up its daily hybrid activity against the UK and Europe, stretching from the seabed to cyberspace.”

Much of this is being done via proxies, with Russian operatives targeting and recruiting vulnerable young people online. According to a Financial Times report, teenagers across Europe are currently being drawn into sabotage, vandalism, and surveillance activities through messaging apps like Telegram. In many cases, they are lured by small payments and are unaware they are working for Russian intelligence.

As the world watches the Russian invasion of Ukraine unfold, UkraineAlert delivers the best Atlantic Council expert insight and analysis on Ukraine twice a week directly to your inbox.

Moscow’s hybrid war against the West is rooted in a long history of “active measures” utilized for over a century by Soviet and later Russian intelligence services. In recent years, these tactics have evolved considerably in terms of sophistication, scope, and intensity.

Since the full-scale invasion of Ukraine began in February 2022, Western officials have tied Russia to 191 acts of sabotage, arson, and disruption across the continent. This tally almost certainly understates reality, given how difficult such operations are to attribute. From 2023 to 2024, documented Russian attacks in Europe nearly tripled.

There is mounting evidence that European governments are beginning to take the threat more seriously. Polish officials have openly called out Moscow’s hybrid warfare tactics, stating that Russia is testing NATO without firing a shot. Poland has accused the Kremlin of probing the alliance’s defenses through cyberattacks, disinformation, drone incursions, and the deliberate weaponization of migration along its borders.

Britain has released a policy paper pledging to scale up cooperation with European partners on hybrid threats. Plans are also in place to develop deeper bilateral coordination with France, Germany, Poland, and Brussels. Meanwhile, Sweden is establishing a new civilian foreign intelligence agency dedicated to countering threats from abroad that is set to launch in January 2027.

Eurasia Center events

NATO is also stepping up efforts to mitigate Russia’s hybrid threats. The alliance has begun partnering with private firms such as cybersecurity companies and utilities providers in order to give member states the ability to better monitor Russian activity. Despite these measures, critics argue that much more still needs to be done in order to defend against Russia’s escalating hybrid hostilities.

Potential further steps would include expanding NATO exercises designed to counter AI-enabled hybrid warfare. There is also a case for building on initiatives like the NATO-Ukraine Joint Analysis, Training, and Education Center, which has demonstrated how allies can sharpen coordination, awareness, and speed of response. More broadly, the alliance should aim to shift from a reactive posture to a more active stance, beginning with a dedicated hub to coordinate joint responses to gray zone attacks.

Beyond policy solutions, Western policymakers and citizens alike must adopt a different mindset. Russian hybrid operations should no longer be viewed through a narrowly legalistic lens or dismissed as isolated incidents. They must be understood and addressed as part of a sustained, coordinated campaign by Moscow’s intelligence services to weaken democratic societies and erode Western support for Ukraine. Recognizing this means drawing clear red lines and imposing real consequences when the Kremlin crosses them.

Ultimately, the most effective deterrent against further Russian aggression is to counter the Kremlin in Ukraine. That means supplying Kyiv with the advanced weapons it needs to defend itself, tightening sanctions on Russia and its shadow fleet of tankers, and working with allies and partners to channel Moscow’s frozen assets toward Ukraine’s defense and reconstruction. Only by calling Russia out, enforcing red lines, and making Moscow pay for its shadow war can Western countries effectively deter the Kremlin and avoid further dangerous escalations.

Zahar Hryniv is a program assistant at the Atlantic Council’s Eurasia Center.

Further reading

The views expressed in UkraineAlert are solely those of the authors and do not necessarily reflect the views of the Atlantic Council, its staff, or its supporters.

The Eurasia Center’s mission is to enhance transatlantic cooperation in promoting stability, democratic values, and prosperity in Eurasia, from Eastern Europe and Turkey in the West to the Caucasus, Russia, and Central Asia in the East.

Image: REUTERS/Marina Lystseva