Hybrid threats, in particular from Russia, have flooded Europe in the wake of its invasion of Ukraine. EU officials and intelligence reports warn of a surge in attacks designed to destabilise European democracies - with national elections, infrastructure, and public trust in the crosshairs.

The European Union has become increasingly concerned about Russian interference as part of what it sees as a broader hybrid campaign from Moscow to weaken the West.

Addressing a meeting of the European Parliament Special Committee on the European Democracy Shield (EUDS) on Tuesday, Bulgarian investigative journalist Christo Grozev stressed that Russia's hybrid warfare goes far beyond espionage to include sabotage, cyberattacks, disinformation, and orchestrated chaos.

According to Grozev - who used to work at investigative website Bellingcat and now writes for the German magazine Der Spiegel and Russia-focused, independent media outlet The Insider -, Russia's campaigns are designed to sow chaos and confusion and to spread fear.

The war in Ukraine remains a major target for Russia - but events such as the Olympics in Paris as well as national elections in Romania, Germany, Moldova and last year's EU-wide European Parliament elections were also in its focus.

European Commission President Ursula von der Leyen during her re-election campaign last year pledged to set up the EUDS to counter the threats. Commissioner for Democracy, Justice, the Rule of Law and Consumer Protection, Michael McGrath, is now in charge of developing the initiative. The Commission has not yet officially published a policy proposal.

The European Parliament voted in December to establish the special committee amid increasing fears of malicious interference in the EU's democratic processes and is tasked with proposing tangible solutions to strengthen the bloc's resilience to hybrid threats.

Grozev was optimistic that Russian hybrid threats can be countered. 'Exposed cells, mapped networks, and convicted spies show that these operations can be countered. Success stems from collaboration - cooperation among journalists and among states,' he underscored.


What are hybrid threats?

Hybrid threats refer to a range of non-traditional attacks such as cyberattacks or disinformation. The generic security term covers actions that state or non-state actors use to harm other countries without waging open warfare. As a rule, they are difficult or impossible to attribute to a specific perpetrator.

In recent months, many countries in Europe have reported damage to infrastructure, including underwater data cables in the Baltic Sea, as well as arson attacks and suspected false flag operations. Investigators believe that Russia is behind many of the attacks.

The EU's foreign policy chief, Kaja Kallas, said in an annual report last month that 'foreign information manipulation and interference is a major security threat to the EU'. The report said that last year it tracked disinformation attacks against over 80 countries and more than 200 organisations.

Ahead of a NATO foreign ministers meeting in Brussels in December, Czech Foreign Minister Jan Lipavský said there were 500 suspicious incidents in Europe in 2024 and that nearly 100 of them can be attributed to Russia.

The chief of the military alliance, Mark Rutte, said at the meeting that China, Iran and North Korea are also active in cyberattacks.


Disrupting servers...and elections

A common type cyberattack is a so-called Distributed Denial-of-Service (DDoS) attack, which floods a server with internet traffic in an attempt to make it inaccessible.

Last year, the pro-Russian hacker group NoName057(16) launched such a DDoS against public institutions and strategic sectors in Spain and other NATO countries seen as allies to Ukraine. In Spain, while temporarily blocking some of their websites, the attack was contained and no data thefts or malicious software were reported.

The hacktivist group emerged after Russia began its war against Ukraine and threatened to respond to the 'anti-Russian' actions of Western countries. In July, Spain's Civil Guard arrested three people for their alleged involvement in the attacks.

According to intelligence services, Russia has also often tried to interfere with democratic processes in Europe by trying to disrupt elections.

The 2024 annual report by the Dutch Military Intelligence and Security Service (MIVD) this week revealed that Russian hackers carried out cyberattacks on public transport companies and political party websites in an attempt to disrupt the European Parliament elections in the Netherlands, making it more difficult for citizens to vote.

According to MIVD Vice Admiral Peter Reesink, the hackers also tried to access vital infrastructure in the Netherlands with the goal of disrupting aid to Ukraine.

In Germany, days before a general election in February, the Interior Ministry warned that Russia was targeting voters with a disinformation campaign seeking to help the far-right Alternative for Germany (AfD) party and 'destroy confidence in democracy'.

The campaign suggested that the AfD, which is sympathetic to Russia, was being unfairly treated. The AfD has been accused of having links to Moscow and has called for Germany to end its military support for Ukraine.

According to the head of the Academic Network Eastern Europe (AKNO), Philipp Schmädeke, Russian intelligence services are also increasingly targeting German academic organisations focused on Eastern Europe. AKNO, which has supported 1,200 people from Russia, Belarus and Ukraine over the past four years, helps scientists forced to flee repression, persecution, employment bans and war.

In December, the Constitutional Court of Romania (CCR) annulled the country's presidential election over concerns of Russian interference in the vote, in which the far-right Moscow-backed Călin Georgescu unexpectedly won the first round.

According to the Supreme Council for National Defense (CSAT), Romania was targeted by 'actions of a state cyber actor' on information and communication technologies supporting the electoral process.

Following the annulment, the 2024 Democracy Index published by The Economist Intelligence Unit (EIU) downgraded Romania from a 'flawed democracy' to a 'hybrid regime', pushing it down 12 places to rank 72nd globally. According to the EIU, the cancellation of the election also negatively affected the country''s score for pluralism.

The presidential election in Romania is now scheduled to take place on May 4 (first round) and May 18 (second round).


Keeping the EU's neighbourhood at bay

Disinformation and conspiracy theories also continue to flood the EU's neighbourhood - such as in Moldova, which shares a border with Ukraine, and in North Macedonia, which is pushing ahead for EU membership.

Moldova, one of Europe's poorest countries, remains heavily reliant on Russian gas. The former Soviet republic is deeply divided between pro-European and pro-Russian factions. Pro-Western President Maia Sandu won a second term in office in October, and the EU accused Russia of 'unprecedented' meddling in the votes in an attempt to favour pro-Kremlin candidate Alexandr Stoianoglo.

In North Macedonia, pro-Kremlin actors on social media play on disillusionment, scepticism, and suspicion, the 'Foreign influence in North Macedonia' report issued by Euro-Atlantic Council of North Macedonia said.

Foreign Affairs and Foreign Trade Minister Timcho Mucunski has warned that the EU's credibility is at stake, and that enlargement is necessary to prevent weaponising Russian propaganda. He specifically warned about 'malign actors' exploiting North Macedonia's frustration with the constantly shifting requirements to join the EU.

Nine countries in total have been granted EU candidate status, and the EU closely watches countries like Serbia and Georgia as their governments appear to lean closer to Russia.


FACT CHECK: Fake newspaper cover about war in Ukraine

Disinformation about Russia's war against Ukraine continues to spread widely - not only in those countries but also in neighbouring Eastern Europe and across the continent.

Last month, far-right blogger Ian Miles Cheong spread a false post on social media suggesting that the British Hull Daily Mail newspaper reported that tens of thousands of Ukrainian soldiers had died in Russia's Kursk region and blaming President Volodymyr Zelensky for the casualties.

The factchecking team of Agence France-Presse (AFP) has debunked the claims. According to a spokesperson for Reach PLC, the Hull Daily Mail's parent company, the newspaper cover was fabricated.

Read the full fact check here: https://factcheck.afp.com/doc.afp.com.372Y6CV


The content of this article is based on reporting by AFP, Agerpres, ANP, BTA, CTK, dpa, EFE, MIA, as part of the European Newsroom (enr) project. AGERPRES (editing by: Mariana Ionescu)