Soufan Center report reveals Russian hybrid strategy in Europe – using criminals recruited from Serbia, Moldova and Bulgaria

A report published by The Soufan Center reveals how Russia has used hybrid tactics to weaken Western states during the period 2022–2025, while avoiding direct military confrontation.

Based on the analysis of 255 incidents in six European countries, the report shows a clear pattern of action: cheap, flexible and often invisible operations aimed at draining states' resources, increasing mistrust and deepening internal divisions.

According to the report, although tactics vary from one country to another, the objective remains the same - destabilization without open war.

Use of individuals from third countries (Moldovan, Serbian, Bulgarian), criminals recruited for vandalism or sabotage with low pay, from 2024 onwards, outsourcing increased significantly.

France – Stirring tensions through existing divisions

In France, Russian operations were not aimed at creating new crises, but rather at amplifying existing ones. Incidents included placing pig heads in front of mosques, drawing Stars of David, and placing fake coffins draped in French flags near the Eiffel Tower.

These actions were intended to incite social tensions and mutual distrust between communities.

The number of incidents increased by up to 240% during 2022–2024, with clear timing ahead of important events such as the 2024 Summer Olympics, parliamentary and European Parliament elections. In total, 43 incidents were recorded, most part of a coordinated campaign.

France has changed its approach, starting to publicly attribute responsibility to Russia – a significant development in its policy towards Moscow.

Germany – “Preparing the ground” for intelligence

Germany appears to be the main target, with 57 incidents – the highest number among the countries analyzed.

The focus of the operations was on preparing the intelligence terrain: mapping military routes, monitoring the training of Ukrainian soldiers, and identifying vulnerabilities in critical infrastructure.

Russia used a combination of traditional espionage, drones, and logistical reconnaissance, also relying on historical networks built since the Cold War period.

These activities signal a long-term strategy and preparation for possible escalations, especially given Germany's role as the EU's leading economy and NATO's logistics hub.

United Kingdom – “Invisible” Sabotage and Threats

In the United Kingdom, Russian operations include sabotage, arson, cyberattacks and advanced intelligence activities.

Particularly worrying are the movements of Russian ships near undersea cables and nuclear submarine routes, where surveillance sensors are suspected.

There were 38 incidents recorded, most of which were high-level security incidents attributed to Russia. However, the report highlights a lack of transparency as a key problem in the British response, with the public only being partially informed.

This, according to the report, weakens social resistance and sends a signal that such operations do not have serious consequences, while simultaneously depleting the resources of security services.

Estonia – Resistance to constant pressure

Estonia appears as one of the most exposed, but also most resistant, states to hybrid operations.

Russia exerts pressure through disinformation against the Russian-speaking population, cyberattacks, sabotage, and occasional violations of air and land space.

In total, 46 incidents have been recorded. However, the Estonian response has been characterized by calm, speed, and institutional stability.

The experience gained since the 2007 cyberattacks has helped build strong defense systems and close cooperation between the public and private sectors.

Moldova – Election influence and information space

In Moldova, Russian activities have focused on politics and information, with the aim of hindering European integration.

Methods include vote buying, financing political actors, media manipulation, and the spread of disinformation.

41 incidents have been recorded, many of which aimed to directly influence electoral processes. The role of the Transnistria region remains key, giving Russia political, military and energy influence.

However, in 2025, pro-European forces managed to secure a parliamentary majority, thanks to a transparent approach that publicly exposed interference and disrupted vote-buying networks.

Georgia – Long-term impact without open conflict

Georgia presents a case where Russian objectives have been achieved largely without war.

Of the 30 recorded incidents, a significant portion is related to the "coercion" phase, through the long-term impact on the territories of Abkhazia and South Ossetia.

Through prolonged information operations and the use of conservative and religious narratives, conditions have been created for political changes that have led to the freezing of the integration process into the European Union.

The adoption of laws based on the Russian model, political crises, and mass protests testify to the depth of this influence.

Low cost, high impact strategy

The Soufan Center report emphasizes that the Russian strategy relies on cost asymmetry: operations are cheap and difficult to detect, while the state response is costly and complex.

Two main trends have been identified:

Increased use of intermediaries, often recruited through social networks;

The transition from digital to physical operations, especially during 2025.

According to the report, the examples of Estonia and Moldova show that transparency, institutional strength, and social resistance can significantly mitigate the effects of these operations.

In contrast, the case of the United Kingdom warns that a lack of public communication can have the opposite effect, weakening the response to hybrid threats. /The Geopost/