Moscow tests Europe's borders ahead of key elections

From disinformation and cyberattacks to sabotage and explosive-laden drones, Russian operations across Europe are becoming increasingly aggressive, with security experts questioning whether the term "hybrid warfare" still fits the scale of the confrontation.

As important elections in the European Union (EU) approach, member states are no longer hiding their concerns Russian interference. In their assessment, the war that Moscow is waging is not limited to the Ukrainian front, but aims to undermine democracies from within. Warnings destabilizing operations have become almost commonplace for the public. In response, governments have adopted new laws and mobilized intelligence services. However, although EU member states have raised the alarm, they continue to act individually, despite the fact that the entire continent is the target of coordinated attacks from Russia, writes the French “Mond”.

At an international conference held in Stockholm on August 20, Estonian Defense Minister Hanno Pevkur warned partners: “Sweden has elections coming up soon, on September 13. Latvia will hold them right after, on October 3. We will have ours in March 2027. This means that Russia will look for ways to influence our societies and incite tensions.”

He was accompanied by Polish official Henrika Mošćicka-Dendiš, Undersecretary of State at the Ministry of Foreign Affairs, who said: "The elections are an ideal opportunity to try to sow distrust and test the resilience of our societies. We must remain vigilant and act to counter this, but we must do it together."

Two days earlier, Sweden, which hosted the conference, was the target of a series of fake videos posted on the X network less than an hour apart, bearing the logos of Swedish and German national media outlets. The videos sought to discredit the upcoming parliamentary elections by warning of fabricated electoral fraud, while accusing Prime Minister Ulf Kristerson of corruption. The videos were identified by the group Antibot4navalny, which monitors Russian disinformation on social media. The Russian opposition collective said the campaign was part of a pro-Russian influence operation known as “Matryoshka,” which has also been registered in other parts of the continent.

“We see these kinds of videos all over Europe. The Russians are used to targeting countries that support Ukraine,” the Swedish prime minister said. The Swedish Psychological Science Agency, a Stockholm-based government agency tasked with monitoring attempts to destabilize elections, said the aim of the offensive was “not to convince voters that there are irregularities in the elections,” but rather to “inundate the media with a large amount of disinformation.”

In February, the Norwegian Institute for Defense Research announced that it had discovered a group of pro-Russian hackers who attempted to influence the Norwegian elections scheduled for September 2025. The researchers specifically pointed to a cyberattack that targeted the conservative Hojre party. “According to our analysis,” said Eskil Grendal Sivertsen, a special advisor at the institute, “this attempt did not have an impact on the elections themselves, but it shows an intention to carry out activities that directly target democratic processes.”

Denmark's three main intelligence agencies have warned of the risk of a pro-Russian disinformation campaign ahead of the last parliamentary elections, held on March 24, 2026. The aim, they said, was to "promote Russian interests, sow discord and weaken support for Ukraine", and they also warned that "this could have consequences for certain candidates and parties, as well as their election campaigns".

"Le Monde" states that these interference operations were aimed at both the domestic and foreign policies of the countries providing assistance to Kiev.

As the leading European aid provider to Ukraine, Germany is particularly vulnerable to attacks on its infrastructure and information systems. Although the country’s political leaders almost never explicitly blame Russia for these attacks, they acknowledge that the threat exists. “There is not always evidence that can be used in legal proceedings to determine who is flying a drone,” Federal Defense Minister Boris Pistorius admitted in November 2025. “But there are many indications that can be used to determine who benefits from flying such a device at a particular location.”

Security experts, diplomats and defense officials warn that the term "hybrid warfare" could downplay the seriousness of the threat and obscure how much the confrontation with Russia has already escalated.

Germany was the target of an attempted attack on Leipzig Airport on August 4. Authorities discovered a drone packed with explosives in a secure cargo area near several Ukrainian cargo planes. A second device reportedly hit a DHL plane minutes later, while a third was found in a nearby field ten days later. German Chancellor Friedrich Merz, who had previously remained mum on the matter, warned on August 25 that Berlin would make sure those behind the attacks “pay a price for their actions.”

In 2025 alone, Germany's Federal Criminal Police Office (Bundeskriminalamt) recorded more than 320 attempts at destabilization in the country - including sabotage, theft, burglary and attacks on critical infrastructure. According to Le Monde, Russia is suspected of organizing most of these actions. In April, the accounts of politicians and MPs on Signal, an application known for its high level of security, were targeted by a phishing attack, also attributed to Moscow. Among the accounts attacked was that of the President of the Bundestag, Julia Klöckner.

German authorities are also investigating possible foreign involvement in a wave of attacks that occurred in the run-up to the February 2025 election, some of which were deadly and often carried out by foreign nationals. The incidents shocked the public and helped push the issue of immigration into the center of the election campaign.

The Politiko portal writes that European leaders and officials often use the terms “hybrid threat” or “hybrid war” for such activities. According to the European Commission's definition, this term encompasses a combination of coercive and subversive activities, as well as conventional and unconventional methods – diplomatic, military, economic and technological – that state or non-state actors can use in a coordinated manner to achieve certain goals, while remaining below the threshold of formally declared war.

An EU official explained to Politiko that the terms “hybrid threats” and “hybrid warfare” are used for actions that do not reach the level of a direct attack on European military or civilian targets. Such a qualification, he said, allows these activities to not be treated as a state of war, and therefore do not require a military response from the EU or NATO.

However, such terminology is facing increasing criticism as sabotage, cyberattacks, drone incursions and other hostile operations increase across Europe. Security experts, diplomats and defense officials interviewed by Politico warn that the term “hybrid warfare” could downplay the seriousness of the threat and obscure the extent to which the confrontation with Russia has already escalated.

“We are truly in a hybrid war that is not so ‘hybrid’ anymore,” said Camille Grand, former NATO assistant secretary general and now head of the Aerospace, Security and Defence Industries Association of Europe.

Latvia is preparing for elections scheduled for October 3. The country has stepped up efforts to uncover possible Russian interference. The government’s disinformation portal Melns uz balta (“black on white”) has warned of an avalanche of false or misleading information aimed at deepening divisions in the country, particularly targeting Russian-speaking citizens, who make up almost a third of the population. Authorities have not yet reported any operations specifically targeting the vote itself.

Le Monde writes that the explanation for this apparent paradox can be found in Baltnews, a propaganda website that presents regional news from Moscow’s perspective, which published an article on the Latvian elections on July 7. Although it expressed its support for the far-right Latvia First party, led by businessman Ainars Šlesers, it assessed that a “turnaround” in Riga’s pro-European and pro-Ukrainian foreign policy was “impossible,” “even if Šlesers and the conservative coalition come to power.” The article adds: “Latvia’s economic and military dependence on Brussels leaves it little room for maneuver.”

The French newspaper explains that the aim was not to encourage closer ties with Russia by supporting pro-Russian candidates, but to undermine the Latvian state itself, through attacks on both its current policies and its history. As the portal Melns uz balta pointed out, the usual channels of Russian propaganda – social media, fake websites and the Belarusian state radio program, which can be heard in eastern parts of Latvia – were flooded with narratives depicting the Baltic state as a puppet state, whose independence, restored in 1991 after a period of independence from 1918 to 1940 and five decades of Soviet occupation, was allegedly illegitimate.

One of the tools of pro-Russian propaganda in the country is the spread of embellished and false representations of the Soviet era, in order to reinforce the narrative of a failed Latvian state since it left Moscow’s sphere of influence, writes “Mond”. The newspaper emphasizes that the relative calm that has accompanied the election campaign is not a sign of easing tensions. “On the contrary, it seems to be permeated with threats – not to the vote itself, but to the survival of Latvia as an independent state,” the analysis emphasizes.

France has also faced highly targeted operations of political destabilization. In early August, the Paris prosecutor's office opened an investigation into suspected Russian interference targeting two of Emmanuel Macron's former prime ministers – Gabriel Attal (Renaissance, the centrist party founded by Macron) and Edouard Philippe (Horizons, center-right) – as well as MEP Raphael Gliksmann (Place Publique, center-left).

All three, candidates in the 2027 presidential election, filed charges after deepfake videos and fake media reports began circulating claiming they had health problems or were involved in corruption. Viginum, the government agency tasked with combating foreign digital interference, criticized the publicity surrounding the operations, saying it gave “greater visibility to content that has been seen by a very small number of citizens.”

European governments rarely speak with one voice when it comes to countering foreign interference, but their intelligence services work closely together – secretly, bilaterally or within the so-called Berne Club.

In a rare joint response, France, the EU and the UK imposed sanctions on nine Russian nationals and four entities linked to the FSB, Russia’s Federal Security Service, on July 13. Le Monde reports that British authorities have added 24 more individuals to the list, including leaders of the GRU, Russia’s military intelligence service, and members of Rybar LLC, a Russian disinformation network targeting Ukraine known for orchestrating election interference across Europe.

The decision was in line with warnings from EU foreign policy chief Kaja Kalas: “Today’s wars are not only fought with tanks and drones, but also with lies and algorithms. Compared to last year, the use of AI tools in FIMI (foreign information manipulation and interference) incidents has increased exponentially. AI is now fully embedded in Russian and Chinese FIMI operations.”

"Le Monde" writes that European governments rarely act with one voice when it comes to opposing foreign interference, but that their intelligence services cooperate closely - secretly, bilaterally or within the so-called Berne Club, which brings together the United Kingdom, Switzerland, Norway and EU member states, with the exception of Austria.

“It is the only multilateral forum that really matters for the continent’s collective security,” a senior French intelligence official told the newspaper, speaking on condition of anonymity. The club meets regularly in different European capitals, sometimes in plenary sessions and sometimes in smaller groups, depending on the topic and the latest developments.

The analysis highlights that European intelligence services are aware that they have no choice but to cooperate, as Russian political interference is aimed at the whole of Europe. According to the French Interior Ministry, the deputy chief of staff of the Russian presidential administration, Sergei Kiriyenko, played a central role in these destabilization campaigns, as part of what Moscow calls directives against “enemy countries.”

"There is a general mandate, and each Russian intelligence structure then carries out possible actions in accordance with the access it has, the information it has or the opportunities that arise," the French intelligence source added.

Camille Grand described the gradual escalation for Politico with the metaphor of “boiling a frog” – the lack of reaction to a dangerous situation that gradually worsens. “What was shocking to us yesterday becomes the norm tomorrow, and so on until you find yourself in a much more intense situation... They are testing the limits.”