Russia continues to ramp up hybrid, asymmetric efforts to target its adversaries across Europe in both virtual and physical space, in support of its invasion of Ukraine, which began in February 2022.
That's according to Recorded Future, which found that the activity stops short of a kinetic, boots-on-the-ground invasion, instead involving a number of psychological, cyber, and physical tactics intended to test enemy defenses, degrade critical infrastructure, and foster fear within an enemy's government and population.
Russia's hybrid warfare strategy has been apparent even outside of Recorded Future's reporting. There are the recent water and wastewater attacks targeting Norway and Poland, for example. In June, DomainTools observed that state actors like to target water and wastewater for primarily psychological reasons, as even a brief disruption in service can trigger disproportionate reaction among the affected populace. Attacks against Poland's energy infrastructure at the beginning of the year were also attributed to Russia-aligned actors.
In a new report, Recorded Future's Insikt Group offered several examples of its own. On the influence operations front, Russia has "often involved impersonating national and pan-European media outlets to disseminate Kremlin propaganda," the blog post said. For example, last month Russia's CopyCop disinformation network reportedly impersonated localized news and fact-checking outlets across Europe, particularly in France and Norway, using AI-generated text and voice.
Other operations were to keep NATO members in what the blog described as a reactive, defensive posture. Russian drones have reportedly violated NATO airspace by flying near Estonia's border. And Romanian authorities intercepted and destroyed a Russian drone detected near Romania's Neptun Deep offshore gas project in the Black Sea, according to the report. "Authorities determined the incident was meant to threaten offshore energy infrastructure and test NATO maritime response protocols," Recorded Future researchers wrote.
Further incidents included an alleged attempt on Russia's part to use drones and explosives to damage cargo infrastructure at a German airport, as well as coordinated cyberattacks against Norwegian public infrastructure.
Chelsea Cederbaum, a senior threat intelligence analyst at Recorded Future who authored the blog post, tells Dark Reading that the key metric to evaluate a company's risk of Russian targeting "is its proximity to providing material support to Ukraine's war effort."