Hybrid Warfare 2026: Russian Propaganda Destroying Europe From Within – Analysis
March 12, 2026
By San Hugo Roxi Ginting
In early 2026, there were numerous reports noting a significant increase in hybrid incidents linked to Russia in Europe since 2025, with more than 150 suspected cases across the European Union and NATO member states, particularly in relation to the Munich Security Report 2026. In Germany alone, there were 321 suspected incidents, including escalating drone intrusions into airspace and disinformation campaigns targeting critical infrastructure. The data, based on analysis from the International Centre for Counter-Terrorism (ICCT) and GLOBSEC, shows a fourfold increase in sabotage and vandalism operations compared to the previous year, often involving criminal networks recruited by Russian intelligence. Incidents such as the violation of Estonian airspace by Russian fighter jets and drone attacks over Polish airports in late 2025 also illustrate how Moscow exploits ambiguities to test Western resilience without triggering a direct military response.
The contextualisation of Russian hybrid warfare also reveals a strategy known as ‘new generation warfare’ (NGW), which integrates kinetic elements such as sabotage and drone intrusion with cyber-attacks and cognitive operations. This doctrine, which evolved from the thinking of Valery Gerasimov, emphasises the use of non-military means to achieve strategic objectives and avoid open conflict while undermining the internal cohesion of the opponent. In this regard, propaganda is a key instrument in the cognitive domain, utilising social media, proxy outlets, and AI to spread narratives that divide European societies. It is not merely a supporting tool, but a weapon designed to weaken democracy from within by exploiting vulnerabilities such as political polarisation and post-war economic uncertainty in Ukraine.
Although the European Union has taken defensive measures, such as imposing Foreign Information Manipulation and Interference (FIMI) sanctions in January 2026 against six Russian individuals involved in disinformation campaigns, this approach still appears to be merely a reactive measure that is insufficient to counter existential threats. By 2026, Russian propaganda had become the primary instrument for the disintegration of European democracy from within, exploiting trends of escalating sabotage and electoral influence to amplify instability. As a result, Europe was forced to shift from a defensive ‘shield’ strategy to an offensive ‘sword’ strategy to achieve more effective deterrence, including proactive countermeasures targeting the source of the Russian threat.
By San Hugo Roxi Ginting
In early 2026, there were numerous reports noting a significant increase in hybrid incidents linked to Russia in Europe since 2025, with more than 150 suspected cases across the European Union and NATO member states, particularly in relation to the Munich Security Report 2026. In Germany alone, there were 321 suspected incidents, including escalating drone intrusions into airspace and disinformation campaigns targeting critical infrastructure. The data, based on analysis from the International Centre for Counter-Terrorism (ICCT) and GLOBSEC, shows a fourfold increase in sabotage and vandalism operations compared to the previous year, often involving criminal networks recruited by Russian intelligence. Incidents such as the violation of Estonian airspace by Russian fighter jets and drone attacks over Polish airports in late 2025 also illustrate how Moscow exploits ambiguities to test Western resilience without triggering a direct military response.
The contextualisation of Russian hybrid warfare also reveals a strategy known as ‘new generation warfare’ (NGW), which integrates kinetic elements such as sabotage and drone intrusion with cyber-attacks and cognitive operations. This doctrine, which evolved from the thinking of Valery Gerasimov, emphasises the use of non-military means to achieve strategic objectives and avoid open conflict while undermining the internal cohesion of the opponent. In this regard, propaganda is a key instrument in the cognitive domain, utilising social media, proxy outlets, and AI to spread narratives that divide European societies. It is not merely a supporting tool, but a weapon designed to weaken democracy from within by exploiting vulnerabilities such as political polarisation and post-war economic uncertainty in Ukraine.
Although the European Union has taken defensive measures, such as imposing Foreign Information Manipulation and Interference (FIMI) sanctions in January 2026 against six Russian individuals involved in disinformation campaigns, this approach still appears to be merely a reactive measure that is insufficient to counter existential threats. By 2026, Russian propaganda had become the primary instrument for the disintegration of European democracy from within, exploiting trends of escalating sabotage and electoral influence to amplify instability. As a result, Europe was forced to shift from a defensive ‘shield’ strategy to an offensive ‘sword’ strategy to achieve more effective deterrence, including proactive countermeasures targeting the source of the Russian threat.
Hybrid Warfare and the Role of Russian Propaganda
Hybrid warfare is academically defined as a combination of conventional and non-conventional methods, which evolved from the Gerasimov Doctrine, a Russian approach that emphasises non-linear warfare in which psychological and societal aspects dominate over traditional military force. The cognitive domain is key, with NATO identifying propaganda as a primary tool for influencing public perception, beliefs and decision-making. According to estimates from think tanks such as the Centre for European Policy Analysis (CEPA), Russia also allocates a significant budget, estimated at $2 billion per year, to these cognitive operations.
The evolution from 2022 to 2026 also shows a transition from operations such as Doppelganger, in which Russia clones Western media to spread disinformation, to the integration of AI and Large Language Models (LLMs) to mass-produce fake content. Reports by EUvsDisinfo and France’s Viginum also document networks such as Portal Kombat and Pravda, which generate millions of fake articles to amplify anti-EU and pro-Kremlin narratives. There is also empirical data to support this statement, with 151 Russia-related hybrid incidents since 2022, including sabotage exploited for the narrative that ‘NATO failed to protect citizens,’ according to ICCT/GLOBSEC 2026 analysis. This surge includes a mix of cyber and kinetic attacks, such as attacks on the European energy grid.
Propaganda in this case is no longer a supporting tool, but rather a force multiplier that amplifies the effects of sabotage and polarisation. It exploits Ukraine’s exhaustion and transatlantic uncertainty, particularly under the Trump administration, where the US isolationist narrative is also being used to weaken European support for Kyiv. Analysis from the Institute for the Study of War shows how Russia shapes an alternative reality to erode public trust in Western institutions, thereby creating an environment where conventional conflict becomes unnecessary. This approach is highly systematic, exploiting Europe’s internal vulnerabilities to achieve geopolitical goals without the cost of open warfare.
Russian Propaganda Mechanisms in Europe 2026
Russian propaganda instruments and channels have adapted following the blocking of state media such as RT and Sputnik in the EU. For now, proxy outlets and operations such as Matryoshka involving deepfakes and AI manipulation are dominant, as seen in Moldova and Romania in 2024–2025. LLM grooming also enables the corruption of AI output to spread disinformation, as documented in the Policy Genome 2026 study. These networks often involve criminal actors, recruited through prisons or organised groups, to maintain plausible deniability.
Key targets also include pivotal elections, such as Hungary’s April 2026 elections and German state elections, where propaganda exploits migration and energy issues to amplify pro-Russian populism. Integration with sabotage, such as drones over airports or infrastructure burnings, reinforces narratives of government incompetence. Recent evidence can also be seen in the January 2026 EU sanctions against six individuals, including a Russian TV presenter, involved in multi-platform campaigns. A report by the European Council on Foreign Relations (ECFR) also highlights how these operations continue despite sanctions, focusing on the 2024 European elections, which saw an increase in Russian influence through proxies such as Voice of Europe.
Russia’s strategy appears to be successful because it exploits Europe’s internal vulnerabilities, such as polarisation and distrust of institutions. Propaganda creates a ‘war of reality’ in which facts lose out to fabricated narratives, weakening support for Ukraine and EU cohesion. Analysis from Dutch intelligence also warns that Russia’s risk tolerance has increased since 2024, with a mix of sabotage and disinformation designed to provoke without full escalation. This is certainly not paranoia, but a data-driven reality where, without intervention, propaganda will continue to undermine the foundations of European democracy.
Strategic Impact and Projections for 2026
The impact includes increased socio-political polarisation, reduced support for sanctions against Ukraine, and the rise of pro-Kremlin radical parties on both the left and right. The Belfer Centre report projects the potential for limited incursions in the Baltics within three years if hybrid escalation continues. The risk of EU disintegration is increasing, with Russian narratives exploiting war fatigue to erode transatlantic solidarity.
The 2026 projection also describes the situation as a ‘year of living dangerously,’ in which, according to CEPA, the escalation of subversion during the elections and the risk of hybrid warfare appear high, as also reported by the EU Institute for Security Studies (EUISS) and the Latvian State Security Service (SAB). Trends also show a fourfold increase in sabotage since 2024, with a focus on critical infrastructure such as undersea cables and energy grids.
Europe also appears too defensive, relying solely on DSA, fact-checking and individual sanctions, while Russia remains offensive and coordinated. If Europe does not shift to a more proactive strategy, Russian propaganda will continue to undermine the foundations of European democracy and will continue to sow the seeds for further conflict.
Conclusions and Recommendations
Russian propaganda as the main weapon of hybrid warfare has damaged Europe from within in 2026, through systematic cognitive warfare integrated with sabotage and disinformation.
Europe must adopt a ‘from shield to sword’ approach, as recommended by the ECFR, including broader sanctions against proxies and oligarchs, strict regulation of AI/deepfakes, proactive counter-narrative campaigns, increased digital literacy, and hybrid deterrence through cyber and financial retaliation. With EU-NATO coordination and political commitment, Europe can reverse this threat and strengthen democratic resilience, ensuring that 2026 becomes a turning point towards more robust collective security.
ReferencesCouncil of the European Union. (2026). Russian hybrid threats: Council sanctions six individuals over information manipulation activities. https://www.consilium.europa.eu/en/press/press-releases/2026/01/29/russian-hybrid-threats-council-sanctions-six-individuals-over-information-manipulation-activities/
Deppe, C., & Schaal, G. S. (2024). Cognitive warfare: A conceptual analysis of the NATO ACT cognitive warfare exploratory concept. Frontiers in Big Data, 7, Article 1452129. https://doi.org/10.3389/fdata.2024.1452129
European Council on Foreign Relations. (2026). From shield to sword: Europe’s offensive strategy for the hybrid age (Policy brief). https://ecfr.eu/publication/from-shield-to-sword-europes-offensive-strategy-for-the-hybrid-age
EUvsDisinfo. (2024). The Kremlin’s upside-down world in 2024. https://euvsdisinfo.eu/the-kremlins-upside-down-world-in-2024/
McMillan, T. (2025). How Russia’s cognitive warfare strategy seeks to reshape reality and undermine the West. The Debrief. https://thedebrief.org/how-russias-cognitive-warfare-strategy-seeks-to-reshape-reality-and-undermine-the-west/
Munich Security Conference. (2026). Munich Security Report 2026: Under destruction. https://securityconference.org/publikationen/munich-security-report/2026/europe/
NATO Allied Command Transformation. (2024). Cognitive warfare. https://www.act.nato.int/activities/cognitive-warfare/
The Soufan Center. (2025). Europe builds deterrence as the Kremlin escalates hybrid warfare (INTELBRIEF). https://thesoufancenter.org/intelbrief-2025-december-9/
San Hugo Roxi Ginting
San Hugo Roxi Ginting is an undergraduate student in International Relations at Sriwijaya University, Indonesia. His research focuses on foreign policy strategies, global cooperation, and geopolitics, exploring how states formulate diplomatic strategies, build international partnerships, and navigate the complexities of global power dynamics in the contemporary world.
San Hugo Roxi Ginting
San Hugo Roxi Ginting is an undergraduate student in International Relations at Sriwijaya University, Indonesia. His research focuses on foreign policy strategies, global cooperation, and geopolitics, exploring how states formulate diplomatic strategies, build international partnerships, and navigate the complexities of global power dynamics in the contemporary world.
French mayoral candidates targeted in foreign disinformation campaign
A foreign disinformation campaign has targeted two candidates running in France’s local elections this weekend, a government agency and a security source said on Tuesday – the third foreign attack targeting public figures in recent days.
Issued on: 11/03/2026 - RFI
Political reaction
Both LFI lawmakers are outspoken critics of Israeli military operations in the Gaza Strip.
Delogu said on Tuesday he had faced “indecent and defamatory accusations” since the start of his campaign because of his positions on the Palestinian territories and domestic French issues.
“I am being targeted by the far-right Israeli government because I have denounced the ongoing genocide in Palestine, for having defended international law, and because I speak out against all forms of corruption that are damaging our city and our republic,” he said.
“Two far-right governments are targeting me – the United States and Israel.”
A foreign disinformation campaign has targeted two candidates running in France’s local elections this weekend, a government agency and a security source said on Tuesday – the third foreign attack targeting public figures in recent days.
Issued on: 11/03/2026 - RFI
Electoral posters of Marseille's left-leaning incumbent Mayor and candidate for re-election in France's upcoming municipal elections Benoît Payan, 20 January 2026
. AFP - MIGUEL MEDINA
The campaign targeted lawmakers from the hard-left party France Unbowed (LFI) who are running to become mayors of the southern cities of Marseille and Toulouse. The first round of voting takes place on Sunday.
France’s VIGINUM agency, which tracks foreign disinformation campaigns, said it had detected inauthentic looking websites and social media accounts with “foreign technical markers”.
The activity targeted “a French political party and... some of its candidates in the municipal elections in Marseille and Toulouse”, the agency said.
France accuses Russia of election interference using fake website
Targets identified
A security source told the French news agency AFP the MPs were Sébastien Delogu and François Piquemal.
“Investigations to clarify the exact origin are still underway,” the source added.
Marseille prosecutors said they had opened a defamation investigation, after Delogu filed a complaint.
An online blog claiming to be written by a former associate described “how Sébastien Delogu hurt me and destroyed my life”.
Posters with a QR code linking to the blog – which was no longer accessible on Tuesday – were pasted around Marseille, according to photos taken by Delogu’s team and sent to AFP.
French daily Le Monde reported the blog was connected to “a network of fake accounts” on the social media platform X that usually promotes messages from the pro-Israeli lobby European Leadership Network (ELNET), which is registered in France. The report said the network had also targeted Piquemal.
The campaign targeted lawmakers from the hard-left party France Unbowed (LFI) who are running to become mayors of the southern cities of Marseille and Toulouse. The first round of voting takes place on Sunday.
France’s VIGINUM agency, which tracks foreign disinformation campaigns, said it had detected inauthentic looking websites and social media accounts with “foreign technical markers”.
The activity targeted “a French political party and... some of its candidates in the municipal elections in Marseille and Toulouse”, the agency said.
France accuses Russia of election interference using fake website
Targets identified
A security source told the French news agency AFP the MPs were Sébastien Delogu and François Piquemal.
“Investigations to clarify the exact origin are still underway,” the source added.
Marseille prosecutors said they had opened a defamation investigation, after Delogu filed a complaint.
An online blog claiming to be written by a former associate described “how Sébastien Delogu hurt me and destroyed my life”.
Posters with a QR code linking to the blog – which was no longer accessible on Tuesday – were pasted around Marseille, according to photos taken by Delogu’s team and sent to AFP.
French daily Le Monde reported the blog was connected to “a network of fake accounts” on the social media platform X that usually promotes messages from the pro-Israeli lobby European Leadership Network (ELNET), which is registered in France. The report said the network had also targeted Piquemal.
Political reaction
Both LFI lawmakers are outspoken critics of Israeli military operations in the Gaza Strip.
Delogu said on Tuesday he had faced “indecent and defamatory accusations” since the start of his campaign because of his positions on the Palestinian territories and domestic French issues.
“I am being targeted by the far-right Israeli government because I have denounced the ongoing genocide in Palestine, for having defended international law, and because I speak out against all forms of corruption that are damaging our city and our republic,” he said.
“Two far-right governments are targeting me – the United States and Israel.”
France unbowed (LFI) MP Sebastien Delogu waves a Palestinian national flag during a debate at the National Assembly in Paris on 28 May, 2024. © AFP - Miguel Medina
"They're targeting a young man from the working-class neighbourhoods of Marseille who wants radical change for his city and who is denouncing the ongoing genocide."
Delogu received a two-week suspension from France’s lower house of parliament in May 2024, after waving a Palestinian flag during a heated debate on the creation of a Palestinian state.
Piquemal called on the judiciary to “shed light on all the ins and outs of these malicious acts”.
“This is not the first time we've faced threats and online harassment from Israeli far-right groups,” he said.
Earlier this month, VIGINUM accused a Russian group linked to military intelligence of foreign interference after it targeted Pierre-Yves Bournazel, a centre-right candidate in the Paris mayoral race, using a fraudulent website.
(with AFP)
"They're targeting a young man from the working-class neighbourhoods of Marseille who wants radical change for his city and who is denouncing the ongoing genocide."
Delogu received a two-week suspension from France’s lower house of parliament in May 2024, after waving a Palestinian flag during a heated debate on the creation of a Palestinian state.
Piquemal called on the judiciary to “shed light on all the ins and outs of these malicious acts”.
“This is not the first time we've faced threats and online harassment from Israeli far-right groups,” he said.
Earlier this month, VIGINUM accused a Russian group linked to military intelligence of foreign interference after it targeted Pierre-Yves Bournazel, a centre-right candidate in the Paris mayoral race, using a fraudulent website.
(with AFP)
Iranian hacker group Handala claimed on March 11 it had carried out a major cyber operation against Stryker Corporation, the US-listed medical technology company, saying the attack was carried out in retaliation for a strike on a school in Minab and ongoing cyber assaults against what it called the "Resistance Axis" infrastructure.
The group said the operation was "fully successful," claiming it had affected more than 200,000 systems, servers and mobile devices and extracted 50 terabytes of data, according to WANA News on March 11.
Handala claimed Stryker had been forced to close offices in 79 countries as a result of the attack. The group described the company as "deeply rooted in Zionism" and alleged links to what it termed the "New Epstein network," claims that could not be independently verified.
The group said the extracted data was intended to "expose injustice and corruption" and had been passed to what it described as the "free people of the world."
Handala described the operation as "only the beginning of a new chapter in the cyber war," and warned that the period of what it called hit-and-run attacks against Resistance Axis infrastructure was over.
Stryker Corporation had not issued a public statement in response to the claims at the time of publication. The extent of any verified disruption to the company's operations has not been independently confirmed.
According to the Irish Examiner, multiple sources have said that systems in the Cork headquarters have been “shut down” and that Stryker devices held by employees have been wiped out.
The company's login pages coming up on these devices have been defaced with the Handala logo.
According to the Handala social media channels, this post was listed on the website.
No comments:
Post a Comment