Number of Russia-linked hybrid attacks in Europe has increased sharply since mid-2025, ICCT and GLOBSEC report

The International Centre for Counter-Terrorism (ICCT) and the GLOBSEC policy think tank have updated their report on Russia’s so-called “crime-terror nexus” in Europe. According to the document, the Kremlin’s hybrid attack campaign significantly accelerated starting in the fall of 2025, and it shows no signs of slowing down.

The original report, published on Sept. 30, recorded a total of 110 incidents of Russian hybrid activity over the course of the full-scale war in Ukraine. In the last five months alone, however, 41 new incidents have been recorded. The number of identified perpetrators has risen to 172, compared with 131 in the earlier assessment.

Poland remains the most affected country, with 31 incidents occurring on its territory. It is followed by France (20), Lithuania (15), and Germany (15). The authors cite these states’ support for Ukraine as a key factor in the Kremlin’s selection of targets.

The range of hybrid activities ranges from online propaganda and incitement of ethnic hatred (including acts of vandalism targeting Jewish and Muslim sites) to arson, the plotting of assassinations, and attempts to set off explosions at logistical and infrastructure facilities. The researchers note that the list includes both physical attacks and actions aimed at undermining social cohesion.

The update devotes particular attention to the profile of the perpetrators. According to the authors, 95% of the 172 identified participants are private individuals with no formal ties to Russian intelligence services. Financial reward is cited as their primary motive. Recruitment, the report says, often takes place through social media platforms, including Telegram and TikTok, where potential operatives are offered quick payments or participation in “challenges.” Those recruited included minors, citizens of post-Soviet countries in difficult economic circumstances, as well as football hooligans and individuals with criminal backgrounds. The authors conclude that the use of “disposable” operatives allows organizers to carry out operations on EU territory with relatively low risk to themselves.

Russia’s hybrid efforts have had a tangible impact on the internal security and social stability of the targeted countries. In December 2025, Germany’s Military Counterintelligence Service (MAD) reported a record surge in espionage and sabotage cases. In its annual report for 2024, the agency identified Russia and China as the main sources of threat. MAD President Martina Rosenberg said espionage should be viewed as “preparation for potential military conflicts,” adding that the number of detected incidents in 2025 had nearly doubled. According to MAD, authorities have recorded attempts to gather information on the size and armaments of the Bundeswehr, acts of sabotage targeting supply lines, cyberattacks, disinformation operations, and efforts to infiltrate agents into Germany via third countries.