In reality, Russia’s ongoing attacks and operations against Europe are much better understood through the concept of a “phase zero” war: a continuous, multi-domain campaign that has moved beyond isolated or merely “destabilising activities”. Their cumulative scale, coordination and coercive impact indicate a deliberate effort to target the European security environment both from outside and from within, while progressively stretching the limits of what constitutes an act of war, yet remaining formally just below that threshold.

Despite this, these actions continue to be intentionally downplayed by some political leaders, contributing to a gradual expansion of what is considered tolerable.

A particularly illustrative example of this dynamic happened in the second half of 2025. An invisible “battle” took place in Brussels, in which Russia deployed a full spectrum of hybrid activities, combined with physical threats against the Belgian leadership, which have resulted in the blockade of a decision on using Russian frozen assets for the so-called “reparation loan” for Ukraine. 

Russian intelligence have reportedly used direct threats and intimidation campaigns against Belgian political leaders, including the Prime Minister, and key executives of Euroclear depository holding the frozen assets, including its CEO. Investigators revealed “Bolshoi-loving bankers” working inside the Euroclear, like Olivier Huby, a French banker who had reportedly visited Russia 155 times over a decade and passed direct threats to Euroclear management. Russian authorities also used “legal warfare”, announcing legal action against Euroclear in the Moscow courts and European institutions. Simultaneously, multiple “unidentified drones” were reported flying over Belgium’s nuclear power plants, Belgian military facilities, Brussels’ key airport Zaventem, Liege airport, and other critical infrastructure. In the end, Belgian authorities blocked the decision, citing various economic, financial and other concerns. Russia appears to have drawn a clear conclusion – its intimidation works and it can continue to rely on hybrid means to influence European decision-making. 

This paper examines how Russia applies its expanding hybrid toolkit across the European continent. It maps the principal domains in which these activities occur, identifies the patterns and actors involved, and highlights specific cases documented between 2022 and early 2026. 

The research combines qualitative analysis, open-source intelligence (OSINT), and selected case studies to examine Russian hybrid activities across Europe. It draws on government statements, official reports, including from national intelligence and law-enforcement authorities, media investigations and reporting, as well as NATO and EU assessments and statements. 

The paper does not aim to provide an exhaustive record of all Russian hybrid activities in Europe. Instead, it focuses on representative cases that illustrate broader operational patterns, tactics, and strategic intent. Where possible, incidents are cross-referenced across multiple domains to reflect the increasingly interconnected nature of Russia’s hybrid toolkit.

The analysis covers the period from February 2022 to early 2026, with earlier examples included when they highlight long-term trends. While the paper follows a domain-based structure, these activities perform specific functions within Russia’s broader approach and are therefore grouped, based on hierarchy of functions – ranging from enabling access and intelligence collection (preparation layer), through direct disruption and coercion (core pressure layer), to influence operations (cognitive layer) and military signaling and threshold testing (escalation layer).