Russia’s Hybrid Cyber-Physical War in Europe Escalates, Threatening Critical Infrastructure and National Security
A growing threat is unfolding across Europe as Russia continues to employ its hybrid cyber-physical warfare strategy against nations supporting Ukraine. Recorded Future has identified a surge in psychological, cyber, and physical tactics aimed at degrading critical infrastructure, spreading fear among governments and populations, and testing enemy defenses.
The scope of these operations is broad and involves multiple countries. Recent attacks on Norway’s water and wastewater systems, for instance, have sparked concern about the potential for similar disruptions to occur elsewhere. In June, DomainTools observed that state actors tend to target such infrastructure primarily for psychological reasons, as even brief service interruptions can trigger disproportionate reactions from affected populations.
Recorded Future’s Insikt Group has offered several examples of its own in a new report. On the influence operations front, Russia has been caught impersonating national and pan-European media outlets to disseminate Kremlin propaganda. Last month, the CopyCop disinformation network reportedly masqueraded as localized news and fact-checking outlets across Europe, particularly in France and Norway, using AI-generated text and voice.
Other operations have aimed at keeping NATO members on their heels with a defensive posture. Russian drones have allegedly violated NATO airspace by flying near Estonia’s border, while Romanian authorities intercepted and destroyed a drone detected near Romania’s Neptun Deep offshore gas project in the Black Sea. “Authorities determined the incident was meant to threaten offshore energy infrastructure and test NATO maritime response protocols,” Recorded Future researchers noted.
Chelsea Cederbaum, a senior threat intelligence analyst at Recorded Future, warns that the key metric for evaluating a company’s risk of Russian targeting is its proximity to providing material support to Ukraine’s war effort. As such, logistics and dual-use firms outside of traditional critical infrastructure are particularly vulnerable. Companies manufacturing specialized components that could aid in repairing damage from Russian hybrid attacks – such as subsea cable repair equipment or industrial defense systems – also face a heightened risk.
The use of drones and explosives in attempted attacks on cargo infrastructure at German airports and coordinated cyberattacks against Norwegian public infrastructure further underscore the escalating nature of this threat. With Russia’s New Generation Warfare (NGW) framework still in its early stages, it is likely that these tactics will become increasingly sophisticated and coordinated over time.
As John Gallagher, vice president at Viakoo, notes, each component of Russia’s NGW operates independently, but there are signs that this might change in the future. “Russia has several components in place that could be highly coordinated to create a more impactful attack,” he warns. In order to mitigate this threat, companies must remain vigilant and address each threat vector separately with rapid remediation to slow the attack process.
Ultimately, Russia’s hybrid cyber-physical war in Europe poses significant challenges for governments, critical infrastructure operators, and private sector organizations alike. As the situation continues to unfold, it is crucial that all parties involved prioritize preparedness and adaptation to stay ahead of this evolving threat.
Source: Dark Reading — 2026-09-25