The Hybrid Threat Imperative: Deterring Russia Before it is Too Late

While Russia's hybrid tactics are not new, their scale and sophistication in the digital age present unprecedented challenges.

By Eitvydas Bajarūnas

Executive Summary

• Hybrid warfare is not episodic, but a permanent feature of Russia’s strategy, rooted in Soviet “active measures” and enhanced by modern tools like artificial intelligence–enabled information manipulation and cyber operations. It exploits the seams of open societies — disinformation, cyber, sabotage, coercion — below the war threshold. 

• Defensive measures such as cybersecurity and critical infrastructure protection mitigate damage but do not deter Russia, which exploits ambiguity and inaction in the gray zone.  

• Western responses must go beyond resilience, imposing credible costs — through sanctions, cyber countermeasures, diplomatic expulsions, and legal actions — that outweigh the benefits Russia gains from hybrid operations. Resilience alone will not stop hybrid warfare; allies should pair deterrence-by-denial with deterrence-by-punishment. 

• Deterrence principles must address clear credibility, capability, and communication, and all these measures must remain grounded in the rule of law to ensure legitimacy, allied unity, and stability. 

• Practical countermeasures to Russian hybrid threats should include public attribution and naming-and-shaming, enhanced NATO and European Union (EU) intelligence sharing, stronger maritime and infrastructure security, targeted sanctions against Russian elites and networks, expulsions of intelligence-linked diplomats, and dismantling of disinformation networks.  

• A coordinated NATO-EU approach is essential, aligning the EU’s economic and legal levers with NATO’s military and cyber capabilities to prevent Russia from exploiting divisions.  

• Instead of warning Russia of the possible ramifications of its actions, allies should be proactive by imposing timely, coordinated costs to make hybrid aggression a losing bet for the Kremlin. 

  
  

Introduction

The discussion of Russian hybrid threats presents an apt analogy to something perhaps better understood by the public. Much like a hybrid vehicle, which seamlessly switches between gasoline and electricity without being noticed, hybrid warfare blends tools of statecraft and conflict: Information manipulation campaigns segue into cyberattacks, which give way to political influence operations, economic pressure, or covert sabotage. The combination is designed to be adaptive, continuous, and hard to attribute, keeping the target off-balance. Consider the drone incursion over Poland in September 2025: On the surface, it might look like a mere violation of airspace — a technical glitch or a navigation error. But when viewed through the hybrid lens, it reveals a layered strategy: unmanned aircraft, possible cyber interference with radar, information operations spun across social media, and diplomatic ambiguity — all synchronized to unsettle perception, undercut sovereignty, and sow confusion.  Such multidimensional threats have become a defining feature of modern conflict, blurring the line between conventional warfare and overt or covert non-military tactics. These threats exploit systemic vulnerabilities to erode political stability and societal trust — without triggering open war. Nowhere are these challenges more pressing than in the Baltic Sea region, where historical tensions with Russia heighten the need for effective defenses.

Hybrid threats, often associated with gray-zone tactics, asymmetric warfare, or irregular methods, are deeply rooted in Soviet-style “active measures”. They are aimed at destabilizing societies through cyberattacks, disinformation, military provocations, and covert operations, all while staying below the threshold of open conflict. As historian Mark Galeotti has described it, hybrid warfare is “the weaponization of everything.”

While hybrid tactics are not new, their scale and sophistication in the digital age present unprecedented challenges. A single deepfake video, distributed through social media and propelled algorithmically, can now reach millions within hours — undermining public trust faster than any Cold War printed leaflet drop. In the Baltic States, this has meant constant vigilance against Russia’s evolving playbook: from coordinated cyberattacks on government networks to disinformation campaigns aimed at eroding support for NATO deployments. As a harbinger of things to come, in 2007, Estonia endured one of the first major state-backed cyber onslaughts, crippling banks, media, and government services for weeks. 

Russia, often aligned with like-minded regimes such as China, Iran, and North Korea, has refined its hybrid playbook to undermine Western unity and project power (aforementioned hostile actors are increasingly learning from each other). 

The turning point in global awareness of Russia’s hybrid strategy came with its 2014 annexation of Crimea and intervention in eastern Ukraine. By seizing Ukraine’s territory employing unmarked soldiers and avoiding formal war, Russia exposed Ukraine’s and the West’s unpreparedness and forced a reassessment of what conflict looks like in the 21st century. NATO, the European Union (EU), and other partners have since made strides in building resilience and deterrence frameworks — but the threat landscape keeps evolving. 

Countries with firsthand experience — like the Baltic States, as well as Poland, Finland, and others — have taken the lead in countering hybrid threats. Others have lagged. This disparity underscores the need for a more unified and strategic response. The stakes have grown. Hybrid operations are no longer isolated or regional. Increasingly, they are coordinated across a growing axis of authoritarian powers — Russia, China, Iran, and North Korea — each contributing tools, tactics, or technology to weaken democratic resilience from within. As Russia fights a conventional war in Ukraine and is engaged in other conflicts worldwide — such as in Africa — it also uses hybrid tactics as leverage against the broader Western alliance. Authoritarian regimes may differ in ideology or geography, but they share a strategic interest: to exploit democratic openness, fracture alliances, and erode public trust in institutions. Russia tests NATO’s eastern flank with disinformation, sabotage operations, and even drone incursions; China spreads influence through digital platforms and critical infrastructure; Iran wages proxy information warfare across Europe; and North Korea targets Western cyber infrastructure. The convergence of these actors demands that democracies do more than just share intelligence or issue joint statements (both of which are crucially important). They must also build interoperable resilience: aligning legal frameworks, coordinating strategic communications, and investing jointly in counter-hybrid capabilities. 

In short, defending against hybrid threats is not only about national security; it is also about protecting the integrity of democratic governance itself. If democracies fail to coordinate, their adversaries will continue to exploit the seams between them. Indeed, for too long, Western democracies have relied on limited diplomatic responses and passive, albeit essential, resilience building. That wavering has only emboldened Moscow to act further. The West must now shift from warnings to action, demonstrating that hybrid aggression comes at a high cost. 

A useful analogy helps make the case. Imagine living in a once-peaceful neighborhood where a neighbor begins harassing others, including your family members. Initially, residents try to reason and de-escalate. When that fails, they organize, gather evidence, and enforce consequences. Only then does the behavior stop. So it is with hybrid threats: Only a firm, credible response — clearly communicated — will alter adversaries’ cost-benefit calculations. 

Lithuania’s experience illustrates this point. From Soviet occupation in the 1940s to modern political and economic coercion, Moscow has repeatedly tested Western resolve. Inaction has only encouraged further aggression. 

This report outlines why countering hybrid threats is strategically vital. It examines current threat vectors, evaluates the effectiveness of Western responses, and proposes next steps — particularly in advancing deterrence-by-punishment — to strengthen transatlantic security.

Strategic Rationale: Why Hybrid Threats Must be a Priority

Why, then, do hybrid threats continue to demand strategic attention? 

First, it is essential to understand that the confrontation between Russia and the West is not a short-term crisis. It reflects deep-rooted geopolitical and ideological tensions. Despite current US-led diplomatic efforts, Russia’s ambitions remain unchanged, and underestimating them could lead to greater escalation. From Russia’s perspective, Russia is at war with the West (more on that below). 

Before Russia’s full-scale invasion of Ukraine in 2022, many thought the war would remain limited. That assumption proved wrong. As Russia faces military setbacks, it increasingly relies on hybrid tactics to destabilize Ukraine and the West. 

Second, Russia’s hybrid operations are an extension of its broader ambition to reclaim influence over Eastern Europe and dismantle the post-Cold War international order. It seeks to undermine NATO and EU cohesion through hybrid and conventional means. 

Russia’s economy and society have been reshaped for prolonged conflict. Despite losses, the country continues hybrid operations to keep pressure on Ukraine and the West. War efforts are generally supported by a majority of Russian inhabitants.

Third, even a potential US- and Europe-backed ceasefire in Ukraine would not end Russia’s wide-ranging hybrid warfare farther afield. Sabotage, cyber operations, and influence campaigns would continue. 

Fourth, advancements in technology, particularly artificial intelligence (AI), make a major difference from the Cold War period to our day’s hybrid threats. AI tools enable deepfakes, automated hacking, and large-scale information manipulation, raising the scale and speed of hybrid operations. 

Fifth, hybrid operations represent a special threat because they erode trust within democracies. Disinformation, electoral interference, and societal polarization undermine unity and resilience. In Germany, intelligence agencies have warned of Russian efforts to influence far-right political movements, and in France, leaks targeted President Emmanuel Macron during elections in 2018.

Moreover, hybrid threats extend to other areas, like the economy. Cyberattacks targeting financial institutions, such as the 2017 NotPetya ransomware attack, caused massive damage worldwide, despite initially targeting Ukraine.

Finally, Moscow advances where the West is forced to retreat for its own internal reasons. This is the key rule to remember. Russia’s hybrid warfare strategy targets real vulnerabilities within Western societies, such as political polarization, social inequalities, Soviet nostalgia, and mistrust in institutions or organizations such as the EU and NATO. The hybrid logic is to exploit existing tensions rather than create new ones. This makes its tactics more effective and harder to counter, as they amplify internal problems instead of attacking from the outside. 

What objectives does Russia pursue through its hybrid threat strategies? 

To start from general observations, Russia uses hybrid tactics to weaken alliances and spread influence while avoiding direct military confrontation. It aims to divide NATO and the EU, complicate collective action, and exploit disagreements. 

For instance, during the 2023 NATO Vilnius summit, Russian-linked hackers spread fake news to sow confusion and tension.

Photo: President Volodymyr Zelenskyy (Ukraine) with former NATO Secretary General Jens Stoltenberg. Credit: NATO via Flickr https://flic.kr/p/2oP3Srd.

Russia seeks to erode faith in democracy by fueling polarization and distrust in government. Studies have found that up to 40% of the German population partially believed NATO provoked Russia’s actions, showing the impact of propaganda.

Russia targets elections to support pro-Kremlin candidates or cast doubt on democratic legitimacy. Simultaneously, it tries to destabilize neighbors like Ukraine through hybrid attacks while simultaneously promoting Ukraine fatigue in the West, hoping to weaken Western resolve.  

Globally, Russia challenges Western global leadership by portraying Western institutions as ineffective or hypocritical, advancing a multipolar world order where it can exert greater influence. This includes the above-mentioned partnerships with Iran, North Korea, and militant groups like Hezbollah, aimed at distracting and stretching Western responses. 

Disinformation is also used to obscure the truth, as with the MH17 case in 2014, when a Russian-made Buk missile was fired, where Russia spread numerous false narratives to avoid accountability.  

Moreover, Russia leverages nuclear threats as a psychological weapon, aiming to deter NATO involvement and reduce Western support for Ukraine without crossing red lines.  

Finally, Russia exploits economic and military vulnerabilities through cyber espionage and sabotage. These operations target Western capabilities, aiming to steal secrets and disrupt infrastructure, thereby weakening the West’s response capacity. What makes these actions particularly dangerous is not just their individual impact but their cumulative effect as part of a coordinated strategy. Each operation — whether a cyber breach, energy supply disruption, or targeted disinformation campaign — might, on its own, seem manageable within an open and resilient system. But hybrid warfare deliberately blurs lines, weaving these attacks together across multiple domains to overwhelm democratic societies’ ability to detect, attribute, and respond. 

This layered approach creates an ambiguous environment in which no single incident quite crosses the threshold for retaliation, but together they steadily erode institutional trust, social cohesion, and strategic readiness. In this way, hybrid warfare is designed to exploit systemic openness and democratic restraint. Precisely because it masks its full scale behind plausible deniability and decentralized execution, hybrid warfare constitutes a top-tier threat to democratic security. Recognizing the pattern and preventing it with targeted punitive actions — rather than reacting to individual provocations — is essential to mounting an effective response. In summary, key methods of Russia’s hybrid warfare include the following:

Strategic Narratives and Propaganda

These are a cornerstone of Russia’s hybrid strategy. Using state-controlled outlets like RT and Sputnik, Moscow shapes narratives to target Western unity and global opinion. Troll farms, bots, and now more often AI amplify messages, adjusting content for local audiences — from economic hardship in Europe and falsification of history to anticolonial themes in the Global South. A notable example of Russian disinformation is its manipulation of the 2016 US presidential election. Russia also exploited the COVID-19 crisis to spread vaccine misinformation and erode trust in institutions. For example, Lithuania has responded to Russia’s disinformation tactics with a robust, multilayered approach — combining strong institutional coordination, strategic communication efforts, and grassroots civic activism, including the internationally recognized “Lithuanian Elves” volunteer network, which works to detect and debunk online falsehoods in real time, thereby reinforcing societal resilience and serving as a model for whole-of-society defense. 

Cyberattacks and digital warfare

Cyber operations support broader hybrid goals — stealing data, disrupting services, and spreading fear. Notable attacks include Ukraine’s power grid in 2015–16 and the cyberattack against Viasat in 2022, disrupting military communications as Russia invaded Ukraine. The Baltics are often cited in textbooks on cyber threats — the first large-scale cyberattack on government networks by Russia was carried out in Estonia in 2007, to which Estonia responded by rapidly strengthening its national cyber defenses and spearheading international cooperation, culminating in the establishment of the NATO Cooperative Cyber Defence Centre of Excellence in Tallinn, which now serves as a key hub for cyber strategy, training, and policy coordination across the alliance.

Sabotage and infrastructure disruptions

Over the last two years, Russia has increasingly engaged in sabotage, targeting both physical and digital infrastructure to weaken adversaries. This includes industrial fires, GPS jamming in the Baltic, and attacks on European underwater infrastructure, such as energy and communication cables in the Baltic Sea. Sabotage, with its kinetic nature, has emerged as one of the most prominent and frequently cited tools in Russia’s current hybrid warfare arsenal. In response to sabotage activities in the Baltic Sea, the regional states have significantly stepped up maritime and critical infrastructure surveillance, bolstering national security services and enhancing interagency coordination. Regionally, they have deepened cooperation among themselves and NATO through joint patrols, intelligence sharing, and new initiatives such as NATO’s Baltic Sentry, a naval operation that has deployed at least 10 vessels plus surveillance aircraft and underwater drones to patrol and protect critical seabed infrastructure in the Baltic Sea.

Political interference and social destabilization

Russia exploits societal divides to polarize politics and disrupt decision-making. Disinformation campaigns in Europe and the US target elections and migration, and race to provoke unrest. In Germany and France, Russian-backed actors have been linked to far-right movements. On the other hand, Operation Doppelgänger revealed the vast scope of Russia’s hybrid warfare, particularly through the Social Design Agency, which orchestrated large-scale disinformation campaigns aimed at destabilizing the West and weakening support for Ukraine. Even religion could be used to achieve political interference. For example, in the Baltic States, Russia strategically manipulates Russian-speaking minorities and diasporas to amplify influence, often through media control and cultural institutions such as the Russian Orthodox.  

Weaponized migration

Russia, with the support of the Belarus regime, has also used migration as a hybrid tool to strain EU cohesion. In 2021, Moscow weaponized migration to destabilize EU borders, stoking anti-immigrant sentiment and deepening divisions among European governments. This hybrid operation foreshadowed the full-scale invasion of Ukraine in 2022, serving as both a stress test and a distraction. Lithuania, Latvia, and Poland responded by closing sections of their borders, rapidly reinforcing border infrastructure, pressing the EU and NATO for coordinated support, and diplomatically engaging countries like Iraq to curb migrant flows facilitated by the Belarusian regime.

Economic coercion and energy manipulation

The Baltic states are a prime example of countries facing hybrid threats in the energy sector. For example, Lithuania responded to energy-related hybrid threats with a firm legal framework restricting foreign — especially hostile-state — investments in strategic infrastructure such as energy, transport, and telecommunications, and has prioritized energy independence by disconnecting from the Russian-controlled BRELL power grid and rapidly expanding liquefied natural gas, solar, and wind capacities. Beyond energy, Russia leverages oligarchs to buy influence in Europe’s financial systems. Despite sanctions, many networks persist, particularly in real estate and shadow corporations.

Proxy warfare and paramilitary groups

Groups like Wagner allowed Russia to exert influence abroad while maintaining plausible deniability. In Ukraine, Wagner led brutal operations in cities like Bakhmut. In Africa, Wagner secured resource contracts to support Russia’s sanctions resilience. 

Active Mercenary Groups Outside of Russia

Map: Center for European Policy AnalysisSource: Taylor, Edwin. “Redut PMC: The Kremlin’s Private Army.” Grey Dynamics, November 18, 2025. https://greydynamics.com/redut-pmc-the-kremlins-private-army/.; Molfar Intelligence Institute. “Catalogue of Russian PMCs: 37 Private Military Companies of the Russian Federation.” Molfar Institute, October 23, 2025. https://www.molfar.institute/en/catalog-of-russian-pmcs/.; Katz, Brian, Seth G. Jones, Catrina Doxsee, and Nicholas Harrington. “Moscow’s Mercenary Wars: The Expansion of Russian Private Military Companies.” Centre for Strategic & International Studies, September 2020. https://russianpmcs.csis.org/?utm_source=chatgpt.com.; Serwat, Ladd, Héni Nsaibia, and Nichita Gurcov. “Moving out of The Shadows: Shifts in Wagner Group Operations around the World.” ACLED, August 2, 2023. https://acleddata.com/2023/08/02/moving-out-of-the-shadows-shifts-in-wagner-group-operations-around-the-world/#s2.; The Sukhankin, Sergey. “After Prigozhin: The Anatomy of Russia’s Evolving Private Military and Mercenary Industry.” Jamestown, March 3, 2024. https://jamestown.org/program/after-prigozhin-the-anatomy-of-russias-evolving-private-military-and-mercenary-industry/?utm_source=chatgpt.com%3B+https%3A%2F%2Fwww.rand.org%2Fcontent%2Fdam%2Frand%2Fpubs%2Fresearch_reports%2FRRA2600%2FRRA2613-1%2FRAND_RRA2613-1.pdf.; Bauer, Ryan, Alexandra Gerber, and Erik E. Mueller. “Russian Mercenary and Paramilitary Groups in Africa.” RAND, 2025. https://www.rand.org/content/dam/rand/pubs/research_reports/RRA2600/RRA2613-1/RAND_RRA2613-1.pdf.

Psychological warfare and nuclear intimidation

The Kremlin has consistently used nuclear threats to deter NATO intervention in Ukraine, signaling that any escalation by the West could trigger catastrophic consequences. The occupation of the Zaporizhzhia nuclear plant in Ukraine underscores this tactic of fear without direct conflict.

Exploiting legal and ethical gaps

Russia takes advantage of Western legal systems — through fake media sites or “lawfare” tactics — using lawsuits to stifle opposition and delay sanctions enforcement. In 2019, Russia-owned RT filed defamation suits against several Western broadcasters and individual journalists in France’s “defamation” framework. These legal actions were widely interpreted as politically motivated, aiming to shield RT’s narrative and punish critical media, often referred to as “lawfare.”

Russia’s hybrid methods in the war in Ukraine

The war in Ukraine has sharpened Russia’s hybrid toolkit — ramping up cyberattacks, disinformation, sabotage, and economic manipulation. For example, Russia has used the story of grain exports as a propaganda tool to discredit Ukraine and the West, presenting itself as a food security provider to the Global South. Electronic warfare, including the jamming of Ukrainian communications, demonstrates how Russia integrates modern tech into its hybrid operations.

Active Russian Mercenary Groups in Ukraine

Group	Year Started	Activity
Yastreb	2014	Combat role alongside the Russian army.
Vostok Battalion	2014	Military technical support and testing for weapons.
Union of Donbass Volunteers	2014	Pro-Russian forces deployed to aid in combat.
Tsar's Wolves	2014	Aided in the full-scale invasion of Ukraine to achieve military and political objectives.
The Russian Imperial Movement	2014	Intelligence collection and aiding the Russian Armed Forces in combat.
Redut	2022	Personal protection of Russian interests.
Potok (Flow)	2023	Deployment to support pro-Russian separatist ideologies.
Plamya (Flame)	2023	Combat operations in eastern Ukraine.
Patriot	2022	Contributed to the intial invasion of Ukraine and has continued to take part in and influence the war.
Kadyrovites	2022	Combat operations in eastern Ukraine.
Fakel (Torch)	2023	Sabotage and infiltration missions to support pro-Russian separatist ideologies.
Espanola	2022	Combat operations in eastern Ukraine.
Don Brigade	2014	Engage in combat, saborage, and electronic warfare.
Convoy	2022	Cooperation with white supremacists.
(Rusich) Sabotage Assault Reconnaissance Group	2014	Soldiers in the company are being deployed to fight in combat alongside the Russian military.

Table: Center for European Policy AnalysisSource: Taylor, Edwin. “Redut PMC: The Kremlin’s Private Army.” Grey Dynamics, November 18, 2025. https://greydynamics.com/redut-pmc-the-kremlins-private-army/.; Molfar Intelligence Institute. “37 Private Military Companies of the Russian Federation - Mii.” Molfar Institute, October 23, 2025. https://www.molfar.institute/en/catalog-of-russian-pmcs/.; Katz, Brian, Seth G. Jones, and Nicholas Harrington. “Moscow’s Mercenary Wars: The Expansion of Russian Private Military Companies.” Center for Strategic & International Studies, March 1, 2014. https://russianpmcs.csis.org/?utm_source=chatgpt.com.; Serwat, Ladd, Héni Nsaibia, and Nichita Gurcov. 2024. “Moving out of the Shadows: Shifts in Wagner Group Operations around the World.” ACLED. December 12, 2024. https://acleddata.com/report/moving-out-shadows-shifts-wagner-group-operations-around-world#s2.; Sukhankin, Sergey. 2024. “After Prigozhin: The Anatomy of Russia’s Evolving Private Military and Mercenary Industry - Jamestown.” Jamestown.org. March 3, 2024. https://jamestown.org/after-prigozhin-the-anatomy-of-russias-evolving-private-military-and-mercenary-industry/.

Current Western Responses

The first stage in responding to hybrid threats must begin with a broad understanding of hybrid warfare as a phenomenon. What is it, why does it matter, and how does it impact the West’s security? 

The next stage involves delving into the specifics of how to counter these threats. Combating hybrid threats comes with several serious challenges. One of the biggest is identifying and attributing hostile actions. Attacks are often carried out through proxies, concealing the true perpetrators. So even when the responsible actor is known, proving it is difficult. Without clear attribution, it becomes hard to justify and carry out an appropriate response. In the Baltic States, efforts to counter disinformation through proper attribution have become increasingly structured and institutionalized. For example, Lithuania’s National Cyber Security Centre and independent fact-checking platforms like “Delfi” and “15min” meticulously trace the origin of toxic narratives — identifying Russian troll farms or state-controlled outlets as sources — and publicly deconstruct their tactics. These proactive attribution practices help to not only target sanctions and media regulation, but also to bolster public awareness and institutional resilience against hybrid manipulation.  

Then, hybrid threats usually take place in the “gray zone,” meaning they fall below the threshold that would trigger collective defense mechanisms like NATO’s Article 5. As a result, the West is often caught off guard, without a clear mandate to respond forcefully. Given that Russia has prioritized gray-zone tactics for over a decade — particularly since the annexation of Crimea — the West can no longer afford strategic surprise in an arena that is now familiar and well-practiced by its adversaries. 

Although hybrid threats affect a wide range of sectors — from the media and infrastructure to defense and energy — many countries still lack effective coordination across their institutions. For example, Estonia is known for its whole-of-government approach to countering hybrid threats, coordinating ministries, intelligence services, and the private sector through its National Cybersecurity Strategy and crisis management framework. Exercises like NATO’s “Locked Shields,” led from Tallinn, integrate civilian, military, and corporate actors to rehearse responses to cyberattacks, disinformation, and critical infrastructure sabotage — ensuring resilience is built across all sectors.

But precisely because hybrid threats span such a disparate set of sectors, coordination among them is especially difficult, making institutional alignment both more necessary and more elusive to achieve. Moreover, decision-making can be slow, and political hesitation allows adversaries to act more quickly than democratic governments can respond.  

Another major issue is the lack of strategic communication. The West often struggles to deliver a unified message, while Moscow’s information operations are fast, targeted, and coordinated. This asymmetry is corrosive for democracies because open societies rely on transparency, debate, and consensus — features that can be exploited by hostile narratives. When democracies fail to counter disinformation decisively and cohesively, they risk losing control of the public narrative, allowing adversaries to shape perceptions and polarize societies from within. In the absence of a more concerted strategic communications approach, Moscow will continue to exploit these divisions, retaining a crucial — and potentially decisive — advantage in its hybrid competition with the West. 

Additionally, modern societies are heavily dependent on vulnerable infrastructure — from internet cables to GPS systems. The enemy might not attack the military directly but instead strike communication networks or gas pipelines. 

This brings us to the next key phase in the fight against hybrid threats: strengthening resilience. In a classic case — in cybersecurity — this means not just technical solutions like firewalls and encryption but also the capacity to respond quickly to attacks, restore systems, and maintain communication. Equally important is informational resilience — the public’s ability to recognize disinformation, trust credible sources, and think critically. Education, independent media, and an active civil society play a crucial role here. 

It is also essential to protect critical infrastructure — energy grids, water supplies, communications systems — from both physical and digital sabotage. Response systems and crisis management plans must move from paper to real-world implementation. Again, using the example of the Baltic States, governments have indeed moved beyond policy papers by conducting large-scale joint exercises simulating cyber and physical attacks on energy grids, ports, and telecom networks. Lithuania’s Amber Mist cyber security exercise runs in cooperation with NATO to test real-time crisis responses, while Latvia has integrated its civil protection agencies, military, and private sector operators into coordinated incident-response protocols. These measures ensure that crisis management frameworks are stress-tested under realistic conditions, not just filed away in strategy documents. 

Photo: Locked Shields 2024, the world’s most advanced live-fire cyber defence exercise. Credit: NATO CCDCOE via Flickr.

A resilient society is one that trusts its institutions, is less socially divided, and has fewer “weak spots” or vulnerabilities for adversaries to exploit. In other words, the stronger, more united, and more mature society, the less space hybrid attacks have to take root. It is a long, demanding process — but a necessary one. 

Thus, in response to increasingly complex hybrid threats, resilience has emerged as a vital component of national and international security strategies. These threats — cyberattacks, disinformation, economic coercion — operate below the threshold of open conflict, making them difficult to detect and counter. 

Resilience involves now widely spread whole-of-government and whole-of-society approaches to withstand and recover from such disruptions. Key efforts include securing infrastructure, reinforcing communication and energy systems, and boosting public awareness through education and media literacy. Governance plays a central role in defining strategic objectives, while international cooperation strengthens information sharing and collective responses. The report, presented to the US Helsinki Commission, outlines how Latvia, Lithuania, and Estonia have institutionalized whole-of-government and whole-of-society approaches to hybrid threats. It details efforts such as strengthening cyber defenses and critical infrastructure; enhancing public awareness through media literacy and education; coordinating across ministries and civil society, and engaging in international cooperation for intelligence sharing and strategic alignment. It also emphasizes how Russian hybrid tactics — ranging from disinformation to airspace violations — have shaped Baltic resilience strategies.

Still, resilience alone cannot stop hostile actors. While it helps mitigate harm, it does not deter aggression. Adversaries can continue adapting and probing for weaknesses. Defensive measures, though necessary, must be backed by credible punitive tools. 

Effective hybrid defense demands a combination of deterrence-by-denial (resilience) and deterrence-by-punishment. The former limits an adversary’s chances of success; the latter raises the costs of aggression. Punitive measures — economic, diplomatic, cyber — signal that hybrid interference will meet serious consequences. 

Hybrid threats exploit ambiguity and inaction. A purely defensive stance, therefore, is insufficient. Resilience is indispensable, but without deterrence by punishment, adversaries will continue to exploit vulnerabilities with impunity. Only by pairing resilience with firm, retaliatory tools can the West prevent and counter hybrid warfare effectively. 

From Resilience to Deterrence

Hybrid threats exploit the space between war and peace, allowing adversaries like Russia to undermine democracies without provoking a military response. Therefore, to counter this, Western nations must go beyond resilience and adopt deterrence-by-punishment — a strategy that raises the cost of hostile actions until they are no longer worth the risk. 

Russian Diplomats Expelled From International Embassies

The first question that arises is the following: How justified is the use of the term “deterrence” when discussing how to counter hybrid threats? There are several strong arguments in favor of using this concept. 

To start with, Russia handles war and peace as a continuum, not a binary. In Russian strategic thinking, there is no clear boundary between peacetime and wartime operations. Instead, Russia engages in continuous confrontation using tools that fall below the threshold of conventional war — cyberattacks, disinformation, energy coercion, sabotage, and election interference. This is hybrid warfare. And in this framework, Russia considers itself to be in a constant struggle with the West, even if the West does not formally recognize it as war. Then, hybrid aggression follows the same strategic logic as military conflict. Like conventional or nuclear threats, hybrid threats aim to coerce, destabilize, and impose costs without open conflict. Therefore, deterrence — shaping adversary behavior by influencing their cost-benefit calculations — remains relevant. Just as in nuclear or conventional deterrence, the objective is to prevent aggression by convincing the aggressor that the costs will outweigh any potential gains. Because hybrid operations are often covert, deniable, and cross-sectoral, the tools of deterrence must shift. But the principle stays the same.  

The West can and should use deterrence-by-punishment (i.e., threatening consequences) and deterrence-by-denial (i.e., making attacks less effective) to raise the costs of hostile hybrid actions. Finally, if the West refuses to use strategic language like “deterrence” simply because there are no Russian tanks crossing NATO borders (although, there are already Russian drones crossing NATO air space), it risks underestimating the seriousness of hybrid threats. Worse, it allows Russia to act freely in the gray zone, exploiting Western hesitation and ambiguity. Therefore, the language of deterrence is appropriate because Russia is waging conflict through hybrid means, and it sees the West as an adversary. Whether or not the West acknowledges that it is “at war,” Russia behaves as though it is. Therefore, the strategic response must include deterrence tailored to the hybrid domain, not just resilience. 

The second question relates to the challenges in applying a deterrence strategy to hybrid threats.  Admittedly, it is a challenging undertaking from the start — no Western country can credibly threaten to seize even a small piece of Russian territory in response to gradual border changes orchestrated by the Kremlin — but deterrence remains viable through coordinated, strategic action.

Let us examine some of the key challenges in implementing a deterrence-by-punishment strategy. 

The first challenge concerns the principles. Experts propose that three principles sustain deterrence: credibility, capability, and communication. Credibility (or the political will to act, in other words) means that threats of retaliation must be believable and backed by a proven record of action. If hostile actors see that “red lines” are never enforced, deterrence quickly erodes. Capability refers to having the actual tools and resources — military, cyber, economic, legal — ready and available to respond decisively when needed. Communication is equally vital: Adversaries need to clearly understand what actions will trigger a response, while allies and the public must be reassured of a unified and prepared stance. This involves both overt and covert messaging, supported by timely intelligence sharing and accurate attribution. Together, these pillars ensure that deterrence is not just theoretical — it is visible, actionable, and effective. 

Indeed, the Multinational Capability Development Campaign, a well-respected expert pool, emphasizes that deterrence-by-punishment must be strategic, coordinated, and clearly communicated to be effective against hybrid threats. This includes defined thresholds, credible multi-domain responses, and joint efforts across government and allied nations. 

Then, strategic ambiguity adds pressure by introducing risk and uncertainty into adversary planning. The goal is that someone in Moscow says: “We don’t know what the West will do, but they will definitely do something — and it will cost us.” That kind of uncertainty often serves as a more effective deterrent than a predictable, concrete response. 

The second challenge concerns asymmetry versus symmetry. Because hybrid threats cut across multiple domains, symmetric responses are often ineffective — and can even be harmful. For example, responding to disinformation or election interference with similar tactics risks undermining core democratic principles like free elections and a free press. Likewise, using military force to respond to espionage or cyberattacks could violate international law and risk dangerous escalation. Instead, a calibrated mix of overt and covert actions should be employed to manage escalation under a deterrence-by-punishment approach and avoid provoking swift retaliation.

The third concerns coordinating “deterrence-by-punishment” with other actions. Deterrence by punishment to hybrid threats does not come as a standalone action. Deterring hybrid threats is effective only when aligned with broader national and international strategies and communicated clearly. It must connect with diplomacy, public engagement, and democratic integrity — what some call “democratic deterrence.” Say NATO’s forward posture and joint exercises, along with integrated cyber capabilities, reinforce deterrence. Tailored strategies target adversary vulnerabilities — economic dependencies, regime legitimacy, and access to critical technologies.

Photo: A Spanish Navy Weapon System Supervisor aboard Spanish frigate ESPS Cristobal Colon tracks targets on her screen while conducting tactical air defense drills during Trident Juncture 18 on November 2, 2018. Credit: NATO By WO FRAN C.Valverde.

Furthermore, this form of deterrence to respond to hybrid threats integrates economic, diplomatic, cyber, and military tools: sanctions targeting Russian elites and defense sectors, diplomatic isolation, cyber countermeasures, and military signaling. Over time, deterrence-by-punishment has come to encompass deterrence through norms, delegitimization, and entanglement, adapting to the gray zone’s cross-domain complexity.

The fourth challenge concerns escalation. Any punitive response must be proportionate to prevent unintended escalation. Mismatched retaliation — like disinformation to counter disinformation — can backfire. Effective deterrence requires linking actions to strategic effects, targeting vulnerabilities smartly, and avoiding unnecessary escalation. 

Countering hybrid threats involves overt or covert actions. Overt steps carry escalation risks, while covert methods may lack deterrent value but reduce fallout. Both can backfire if misjudged. 

Escalation risk assessment is key, especially when different actors interpret threats and responses differently, especially in cross-domain hybrid conflicts. Clear international norms and shared thresholds help manage ambiguity and guide proportional responses. 

The fifth concerns flexibility. Some hybrid actors want their actions to be noticed to project fear or power (e.g., recent Russian sabotage activities in the Baltic Sea). Others rely on plausible deniability. Deterrence must account for both and be flexible enough to adapt. It complements resilience and disruption, especially as threats evolve through tools like AI-enabled disinformation and cyber sabotage. 

It also requires knowing the most effective ways to impose consequences on hostile actors, understanding their goals, values, and thresholds. Rapid, decisive action is crucial to prove that Western threats are not hollow.

Finally, the West is built on the foundation of the rule of law. That means any strategy of deterrence-by-punishment must be grounded in both national and international legal frameworks. The response to hybrid threats must reflect the West’s values — measured, lawful, and accountable. Deterrence works best not through arbitrary force, but through credible, legally sound actions that uphold the legitimacy of the West’s systems while imposing real costs on aggressors. 

So, in conclusion, what deters Russia? Credible threats, allied unity, and resolve. Inaction or a lack of resolve undermines deterrence from the outset, as failing to impose costs can inadvertently encourage further aggression. Western governments must act decisively, not just reactively. 

Current efforts — resilience building, attribution, expulsions, cyber responses, sanctions, military presence, and support for Ukraine — form a foundation. But more is needed. Ukraine’s innovations by bringing the war to the territory of Russia should inspire a tougher Western stance. 

Ultimately, deterrence-by-punishment must reshape Russia’s cost-benefit calculus — making hybrid warfare a gamble Moscow cannot afford.

Practical Implementation of Deterrence

To effectively counter Russian hybrid threats, Western nations must adopt a deterrence-by-punishment strategy based on practical measures. This multifaceted approach targets both state and nonstate actors engaged in hybrid warfare.  

A report by former Finnish President Sauli Niinistö contains many good ideas for the EU actions, including in deterrence-by-punishment, offering guidance as NATO and the EU strengthen their hybrid threat frameworks.

Many more ideas for the practical implementation of deterrence-by-punishment have been formulated, and some have already been put into practice.

The following compendium details methods of deterrence-by-punishment to counter hybrid threats. 

Conclusion: A Strategic Imperative for the West

The author’s country, Lithuania, stands on the front lines of hybrid warfare. Its infrastructure, information space, social fabric, and economic ties can be, and many times have been, targeted. That is why Lithuania is especially interested in not only investing in and strengthening its resilience but also developing a clear, proactive, and multilayered deterrence strategy. 

Recognition of hybrid threats and investment in resilience are necessary first steps — but they are only part of the response. If the West aims to stop Russia’s hybrid operations, it must not only defend but also deter. The Kremlin operates on a simple logic: “If we can act with impunity, we will.” That is why a strategy of deterrence-by-punishment is crucial. Its purpose is to force a strategic dilemma: For every hostile move, the aggressor must weigh the risk of meaningful consequences. 

Resilience helps limit damage, but it does not stop aggression. A credible deterrence-by-punishment approach must impose costs that outweigh the benefits of hostile actions. This requires coordinated use of military, economic, legal, and informational tools — ranging from sanctions and cyber responses to public attribution and legal prosecution. 

Such deterrence demands a whole-of-government effort, strong public-private cooperation, and close alignment with allies, especially NATO and the EU. Strategic communication and transparency — through clear signaling, intelligence sharing, and investment screening — are also essential to shape adversary decisions and deny them exploitable weaknesses. 

Deterrence must be proactive and tailored to specific vulnerabilities. It requires political will and long-term commitment. Through a cross-sector strategy, the West can shift the cost-benefit balance and effectively counter hybrid threats. 

There is also a pragmatic understanding that not all deterrence measures will be easily adopted at the EU or NATO level. While the EU holds more tools in areas like regulation and sanctions, developments in the US raise uncertainty about NATO’s future cohesion. The closure of the State Department’s Global Engagement Center, funding cuts to Voice of America and Radio Free Europe/Radio Liberty, and the dismantling of disinformation response teams suggest a retreat from the information battlefield — just as adversaries are ramping up their efforts. 

Still, developing actionable proposals remains vital. These strategies are not just responses to today’s threats — they lay the groundwork for the future. Even if current politics delay implementation, a strong deterrence framework helps guide national policies, aligns allies, and ensures that the West is ready to act decisively when the moment comes. 

Finally, if Russia considers itself in a permanent confrontation with the West — even in the absence of formal declarations — democracies can no longer afford to frame the threat in peacetime terms. Policy elites must acknowledge and communicate the nature of this ongoing struggle, recognizing hybrid warfare not as a series of isolated events but as a systemic campaign with strategic intent. This requires moving from a reactive stance to a proactive one: integrating hybrid threat awareness into national security doctrines, institutional planning, public discourse, and allied coordination. Without a clear and unified framing of the threat, democracies risk responding piecemeal, always on the back foot — granting the Kremlin exactly the ambiguity and initiative it seeks. Only by naming the challenge for what it is — a continuous, multi-domain confrontation — can the West mobilize the clarity, urgency, and coordination needed to resist and prevail. 

Annex: Implementing Deterrence-by-Punishment to Counter Hybrid Threats

Naming-and-Shaming

Collaboration With Intelligence and Civil Society

Publicly exposing hostile actions, backed by credible evidence, helps reduce future covert operations. Civil society and intelligence agencies should cooperate on timely, evidence-based attributions. The US intelligence community’s attribution of Russian interference in the 2016 presidential election and the public disclosure of the Internet Research Agency’s role in spreading disinformation are examples of this approach. Covert deterrence can also be achieved by gathering intelligence on an adversary’s capabilities and signaling the potential for retaliation or exposure to discourage implementing malign activities. As another example, during Russia’s attempted meddling in the French elections in 2018, Macron’s team openly exposed the hacking, used fake emails to trap attackers, and worked with researchers and/ the media to debunk disinformation.

Enhanced Intelligence Sharing

Coordinated intelligence sharing is crucial. The NATO Intelligence Fusion Centre, which provides timely, relevant, and accurate intelligence to support planning and execution of NATO operations, and the EU Hybrid Fusion Cell provide vital frameworks. By publishing their annual threat assessments, Lithuania and Estonia raise awareness and deter hybrid activity at the national level. NATO and EU members should adopt standardized intelligence-sharing protocols and publicly expose Russian hybrid tactics. 

Overt NATO and Article 5 Considerations

Indeed, at the summit in July 2024, NATO leaders reinforced the alliance’s approach to countering hybrid threats, including the possibility of invoking Article 5 in response to severe hybrid attacks. The very overt considerations to activate Article 5 might serve as a deterring factor. But before reaching Article 5 thresholds, NATO should continue consultations under Article 4 and deploy Counter Hybrid Support Teams (CHSTs) as needed. Lithuania also requested and received support from NATO’s CHSTs in 2021.

Keeping Ambiguity

The West should, at the same time, enhance the uncertainty surrounding its deterrence posture by broadening its range of potential responses and avoiding any upfront limitations on how it might act. Keeping adversaries guessing strengthens deterrence by making retaliation less predictable and more difficult to plan against. 

Photo: Hearing for the Allegations of Genocide Ukraine v. Russian Federation on March 7, 2022. Credit: Courtesy of the ICJ via Twitter.

Legal Punitive Measures

Legal Actions

Prosecutions under espionage, cybercrime, or election interference laws demonstrate consequences. The indictment of Russian operatives for election interference in the US and cases against RT employees show enforcement in action.

Lawsuits Brought Against Russia

Between 2000-2024

Date	Organization	Countries	Title	Decision
2025	European Court of Human Rights	Ukraine and the Netherlands v Russia	Joined cases of Ukraine and the Netherlands against Russia	Russia committed systematic and widespread human-rights violations
2022	International Court of Justice	Ukraine v Russia	Allegations of Genocide under the Convention on the Prevention and Punishment of the Crime of Genocide	In litigation
2021	European Court of Human Rights	Georgia v Russia	Conflict of violations in Abkhazia and South Oseetia	Russia violated convention rights including right to life and investigation of alleged crimes
2021	European Court of Human Rights	Ukraine v Russia (IX)	Ninth case of Ukraine on Russian Human Right's Violations	Russia was responsible for multiple violations of the Convention of Crimea. Russia was required to ensure the safe return of prisoners from Crimea
2019	International Tribunal for the Law of the Sea	Ukraine v Russia	Request for Provisional Measures in the Kerch Strait Incident (Ukraine v. Russia)	Provisional measures granted
2019	Permanent Court of Arbitration	Ukraine v Russia	Dispute Concerning Detention of Ukrainian Naval Vessels and Servicemen (Ukraine v. Russia)	Pending
2018	European Court of Human Rights	Georgia v Russia (IV)	Georgia v Rusia (IV)	Russia committed systematic violations of rights along the administrative boundary lines
2018		Georgia v Russia (IV)	Georgia v Russia (IV)	Russia committed multiple violations of the European Convention
2018	European Court of Human Rights	Ukraine v Russia (VIII)	Kerch Strait naval incident	Pending
2017	International Court of Justice	Ukraine v Russia	Application of the International Convention for the Suppression of the Financing of Terrorism and of the International Convention on the Elimination of All Forms of Racial Discrimination	In litigation
2016	Permanent Court of Arbitration	Ukraine v Russia	Dispute Concerning Coastal State Rights in the Black Sea, Sea of Azov, and Kerch Strait	Pending
2013	International Tribunal for the Law of the Sea	Kingdom of the Netherlands v Russia	The "Arctic Sunrise" case	Russia must release the 'Arctic Sunrise' to exercise the freedom of navigation
2008	International Court of Justice	Georgia v Russia	Application of the International Convention on the Elimination of All Forms of Racial Discrimination	Pending
2008	European Court of Human Rights	Georgia v Russia (II)	Georgia v Russa (II)	Russia committed serious human rights violations
2007	International Tribunal for the Law of the Sea	Japan v Russia	The "Tomimaru" Case	Declined to proceed, case without object
2007	International Tribunal for the Law of the Sea	Japan v Russia	The "Hoshinmaru" Case	Ordered Russia to promptly release the vessel and crew
2007	European Court of Human Rights	Georgia v Russia (I)	Case of Georgia v Russia (I)	Russia found in violation of the European Convention

Table: Center for European Policy AnalysisSource: “List of All Cases.” INTERNATIONAL COURT OF JUSTICE. Accessed December 2, 2025. https://icj-cij.org/index.php/list-of-all-cases.; “European Court of Human Rights.” HUDOC. Accessed December 2, 2025. https://hudoc.echr.coe.int/eng#%7B%22sort%22:[%22kpdate%20Descending%22],%22languageisocode%22:[%22ENG%22],%22respondent%22:[%22RUS%22]%7D.; “List of Cases.” International Tribunal for the Law of the Sea: List of Cases. Accessed December 2, 2025. https://itlos.org/en/main/cases/list-of-cases/.; “News & Cases.” Permanent Court of Arbitration. Accessed December 2, 2025. https://pca-cpa.org/en/news/page/4/?num=100. Get the data

Counter Hybrid Legal Actions

The EU and member states could also use other types of legal proceedings (e.g., anti-corruption, tax evasion measures, environmental inspections at sea, anti-coercion) as well as actions in other domains such as trade (e.g., anti-subsidy or anti-dumping investigations, leading to access restrictions to the single market).

Magnitsky Act–Type Frameworks

Applying these sanctions to corrupt or abusive individuals makes hybrid operations costly and risky. 

Counter-Sabotage Measures

Enhanced Maritime Security

Expand the use of satellite imagery, drones, underwater sensors, and Automatic Identification Systems to track vessel movements across the Baltic. For example, NATO implemented Operation Baltic Sentry to patrol and protect the Baltic Sea using drones, ships, and AI. Nations should invest in AI-driven maritime anomaly detection to flag unusual behaviors like ship-to-ship transfers or unexplained route changes near critical infrastructure. Introduce stricter inspections of suspicious vessels, especially tankers associated with Russia’s shadow fleet. Ports should be empowered to deny access to vessels failing transparency checks, particularly those operating under shell companies or unknown ownership.

Photo: An MQ-9 Sea Guardian unmanned maritime surveillance aircraft system flies over Independence-variant littoral combat ship USS Coronado (LCS 4) during US Pacific Fleet’s Unmanned Systems Integrated Battle Problem. Credit: US Navy.

Sanctions

Sanction ships, logistics firms, and insurers involved in circumventing existing EU and Group of Seven sanctions. Public exposure of violators increases reputational costs and acts as a deterrent. The goal is to make shadow fleet operations financially and logistically unsustainable. Ban Western companies from offering insurance, refueling, repair, or other maritime services to sanctioned or evasive vessels. Countries are already imposing sanctions targeting Russia’s “shadow fleet,” suspected of aiding infrastructure sabotage.

Timeline of Sanctions Against Russia

Up to date as of May 2025

Date	Country	Description
October 23, 2025	European Union	Targeted sanctions on banks and oligarchs, with asset freezes; no sovereign debt issuance allowed on UK markets.
October 23, 2025	United States	Secondary-market sovereign-bond ban; VEB & PSB asset freezes; Central bank sanctions.
August 15, 2025	European Union	First package of sanctions against Russia.
May 21, 2025	United States	Nord Stream 2 AG and CEO blocked.
May 20, 2025	European Union	Comprehensive sanctions targeting the Finance sector (Sberbank and VTB), specific oligarchs, and major companies.
May 20, 2025	United Kingdom	Finance ban on key industries; asset freezes incl. VTB; export controls; sanctions on transport, dual-use goods, more Generals.
February 24, 2025	Canada	New asset freezes and dealings bans.
February 24, 2025	European Union	Japan to suspend visas, freeze assets, and restrict exports to Russia, including military-related and dual-use items.
February 21, 2025	Canada	Second package of sanctions against Russia.
January 10, 2025	Japan	Strengthened Korean Export Controls on Strategic and Non-Strategic Items to Russia.
January 10, 2025	United States	Central-Bank transaction ban.
December 16, 2024	European Union	Korea to suspend transactions with seven Russian banks, halt new Russian sovereign bonds, and implement SWIFT exclusion.
November 21, 2024	United States	Third package of sanctions: SWIFT ban.
October 8, 2024	European Union	Japan freezes assets of additional Russian, Belarusian, Donetsk and Luhansk persons and banks.
September 1, 2024	Canada	Docking ban for Russian ships.
August 23, 2024	United States	Cease transactions with Central Bank of Russia.
June 24, 2024	European Union	Import ban on petroleum products.
June 21, 2024	Japan	Japan bans exports of controlled goods, dual-use items and oil-refining equipment to Russia / Belarus.
June 12, 2024	United States	Import bans (seafood, alcohol, diamonds); luxury-goods export and new-investment prohibitions.
May 1, 2024	United States	Fourth package of sanctions against Russia.

Table: Center for European Policy AnalysisSource: Sanctions on Russia

Military Readiness and Presence

NATO should continue its Enhanced Forward Presence, and regular drills in Eastern Europe exemplify this posture. Expand joint naval and hybrid threat exercises under NATO and Council of the Baltic Sea States (CBSS) frameworks. Simulate sabotage scenarios, such as undersea cable cuts or energy infrastructure attacks, to stress-test coordination and communication.  

Anti-sabotage Actions

Create a shared Baltic registry of pipelines, data cables, offshore energy assets, and other critical infrastructure. This will support early-warning systems and identify gaps in coverage. NATO’s “Seabed Warfare” initiative can provide technical support here. CBSS’s foreign ministers issued a joint statement urging protection of submarine infrastructure.

Incidents of Russian Sabotage

Acts of arson, industrial sabotage, and vandalism. Map: Center for European Policy Analysis

Other Measures

Strengthen anti-sabotage networks and deploy GPS protection technologies. Modernizing NATO’s Integrated Air and Missile Defence systems will enhance readiness against emerging threats from drones and other airborne platforms, while also targeting hostile logistics networks and weaponized migration flows.

Targeted Economic Sanctions

Asset Freezes and Travel Bans

These are already widely used measures, but there is an obvious need to sharpen them and make them even more targeted. For example, the US, EU, and United Kingdom have already imposed travel bans and frozen assets, including luxury properties and financial accounts, of individuals involved in Russia’s hybrid operations. Apart from government officials, Russian oligarchs supporting the war and interference with the West should also be sanctioned.

New EU Sanctions Framework

The EU is moving in the direction of imposing specific framework sanctioning against those countries and individuals implementing hybrid warfare. This framework, grounded in EU Council findings, includes asset freezes, travel bans, and bans on financial engagement with sanctioned actors.

Other Measures

Crack down on sanctions evasion, coordinate enforcement across borders, incentivize defections, and target Russian real estate and investments abroad. Sanctioning these assets cuts off capital storage options and increases pressure on decision-makers within the Kremlin system. Sanction agencies and individuals involved in hostile activities against Ukraine and Western democracies.

Diplomatic Expulsions and Isolation

Coordinated Expulsions

Mass expulsions following events like the Sergei Skripal poisoning and the 2022 invasion show collective resolve.

Photo: Russian Embassy in Denmark. Credit: @russian_embassy_d via Instagram.

Restrict Diplomatic Privileges

Limit Russian diplomatic missions’ staffing and deny re-accreditation to suspected intelligence officers. 

Cultural Center Closures

Shutter centers used for influence operations to constrain soft power manipulation. 

Media and Disinformation Countermeasures

Expose Disinformation Networks and Target Propaganda Outlets

The most direct and painful measure against hostile infowars is the removal of accounts spreading false narratives. The EU’s Code of Practice on Disinformation and partnerships with tech companies exemplify this approach. Sanction state-controlled media and their backers.

Delegitimization of the Regime by Strategic Communication

Efforts should be made to undermine the legitimacy of Vladimir Putin’s regime by exposing human rights violations and corruption. This can involve supporting independent media and civil society organizations that challenge the Kremlin’s narratives. Combine Cold War–era tactics with modern tech to erode authoritarian control. 

Public-Private Collaboration

Enhance cooperation among state-run counter-disinformation units, technology platforms, and independent fact-checkers to create a more robust defense against propaganda and disinformation campaigns. By sharing data, coordinating rapid responses, and promoting transparency, it becomes significantly harder for hostile actors to spread false narratives and manipulate public opinion. 

Offensive Narrative Strategy

Support independent media, civil society, and campaigns that promote democratic values. In the context of hybrid threats, psychological operations can also be employed to counter hostile messaging and influence public perception in favor of democratic resilience. 

Support Independent Journalism and Civil Society

Fund Russian-language outlets and enable continued investigative reporting targeting Russian audiences.

Use of Social Media and Satellite TV, and Support for Nongovernmental Organizations

Use digital and broadcast platforms to amplify credible voices. These tools, combined with the work of nongovernmental organizations, help strengthen civil society and promote public accountability.

Grassroots Digital Activism

A notable example is the volunteer group known as the “Elves,” which plays a key role in identifying and countering Russian disinformation online. Operating through private social media groups, these volunteers monitor, debunk, and report false narratives, effectively disrupting the efforts of Russian troll farms. Their coordinated actions have led to the removal of numerous fake accounts and misleading content from platforms such as Facebook. 

Offensive Cyber Measures

Disruption Operations

Proactively dismantling the technical infrastructure behind cyber threats is a crucial element of deterrence. This includes taking down botnets — networks of hijacked devices used to conduct large-scale cyberattacks or spread malware. Notable examples include the successful operations against TrickBot, GameOver Zeus, and Emotet, which disrupted major cybercriminal ecosystems. These takedowns, often coordinated among governments, law enforcement, and private cybersecurity firms, not only neutralize immediate threats but also send a strong message to malicious actors about the West’s capacity and willingness to act. Use wiper malware, honeypots, and other tools to disrupt hostile operations. 

NATO’s Cyber Doctrine

NATO’s cyber doctrine integrates cyber defense into collective security, recognizing cyberattacks as potential triggers for Article 5.  

Lawful Access to Encrypted Data

Balance privacy with security by developing responsible legal frameworks. 

Intelligence and Attribution

Disrupt hacker networks and publicly name attackers to degrade covert operations. 

Legal and Sanctions Frameworks

The EU’s cyber sanctions framework helps punish cyber offenders.

Strategic Communications, Multilateral Coordination, and Other Measures

Vulnerabilities of Penetrator

Deliver a current and thorough analysis of Russia, detailing its strategic goals, operational tactics, and, importantly, key vulnerabilities and susceptibility to Western countermeasures. 

Unified Messaging

Clearly attributing hybrid attacks to their perpetrators increases political and reputational costs for adversaries. To enhance coordination and consistency across allied nations, it is essential to maintain and regularly update shared databases of known vulnerabilities, threat actors, and incidents. Unified messaging not only reinforces deterrence by showing collective awareness and resolve, but also helps prevent disinformation and manipulation that exploit inconsistent or delayed responses. 

Photo: NATO Secretary General Mark Rutte and NATO Heads of State and Government Credit: NATO HQ Photo: NATO Secretary General Mark Rutte and NATO Heads of State and Government Credit: NATO hq https://www.nato.int/cps/en/natohq/photos_236427.htm

“Shadow Deterrence”

Signals of possible retaliation are sent quietly through diplomatic or intelligence channels. This raises the threshold for escalation while reminding adversaries that the West is watching and prepared to act. 

NATO-EU Coordination

Coordinating responses with allies and international organizations like NATO and the EU ensures a unified front, preventing adversaries from exploiting divisions (the EU and NATO agreed years ago to act jointly in countering hybrid threats). The EU and NATO can complement each other in a deterrence-by-punishment strategy by aligning the EU’s economic and legal tools — such as sanctions, investment screening, and legal accountability — with NATO’s military readiness, cyber capabilities, and intelligence sharing. Coordinated signaling and joint responses would ensure that adversaries face consequences across multiple domains, reducing space for hybrid aggression. 

Prevent Russia’s Military Recovery

Preventing Russia’s military recovery is a core element of deterrence-by-punishment. Expanding export controls and exposing illicit arms deals raises the long-term cost of aggression by limiting Russia’s ability to rebuild its military. Targeting supply chains and sanctioning intermediaries not only disrupts current capabilities but also deters future hybrid and conventional threats. 

Bolster Russia’s Neighbors

Aid, training, and intelligence sharing strengthen regional defenses against hybrid tactics, including in Ukraine, Georgia, and Moldova. 

---

By Eitvydas Bajarūnas. Eitvydas Bajarūnas is the Representative of the Lithuanian Confederation of Industrialists to the European Economic and Social Committee, and a Center for Europe Policy Analysis (CEPA) Non-resident Senior Fellow. Article first time published on CEPA web page. Prepared for publication by volunteers from the Res Publica - The Center for Civil Resistance.