The attacks do not arrive at the border. They do not wear uniforms, and they do not require an army to deliver them. Cyberattacks, disinformation campaigns, election interference, critical infrastructure sabotage, and the manipulation of political discourse through social media platforms — the toolkit of what NATO and the EU call “hybrid warfare” is designed precisely to achieve strategic effects below the threshold that would trigger a conventional military response. European states are grappling with threats for which existing legal frameworks, military doctrines and institutional structures were not designed.
Who is doing what — and what for
Dr. Heli Tiirmaa-Klaar, Estonia’s former Cyber Ambassador and one of Europe’s foremost experts on hybrid threats, is precise about attribution. “The vast majority of significant cyberattacks and hybrid operations against European states are attributable to Russia, China and Iran — with Russia the most aggressive and the most active, and China the most sophisticated and persistent,” she says. The motivations differ: Russia prioritises disruption, intimidation and influence operations designed to weaken European political cohesion and Ukraine support. China focuses more on economic espionage — stealing industrial and defence technology — and on persistent access to critical systems that could be activated in a future crisis. Iran’s operations tend to target diaspora communities and political opponents of the regime.
“What has changed since 2022 is the tempo,” Tiirmaa-Klaar notes. “Before the full-scale invasion of Ukraine, Russian cyber operations against EU member states were significant but somewhat calibrated. Since 2022, the frequency, scope and aggressiveness of operations — against energy infrastructure, government systems, media organisations, and transportation networks — has increased substantially.”
What European states are most vulnerable
The Baltic states — Estonia, Latvia and Lithuania — face the highest intensity of operations given their geographic proximity to Russia, large Russian-speaking minority populations that can be targeted by information operations, and their historic role as testing grounds for Russian hybrid tactics. Estonia’s 2007 cyberattacks — the first major state-attributed offensive cyber operation in history — effectively created the field of cyber defence policy and produced the NATO Cooperative Cyber Defence Centre of Excellence in Tallinn, which has since become Europe’s primary centre for cyber defence research and training. As explored in our Baltic security analysis, the experience has made these small states some of the most sophisticated cyber defenders in the world.
The EU’s response architecture
The EU’s cybersecurity framework has developed significantly since 2016. ENISA — the EU Agency for Cybersecurity — provides technical support, threat intelligence sharing, and capacity building across member states. The NIS2 Directive, in force since 2024, extends mandatory cybersecurity requirements to a much broader range of critical infrastructure operators and imposes significant penalties for non-compliance. The EU Cyber Solidarity Act creates a mechanism for collective response to major cyberattacks and a reserve of cybersecurity professionals that member states can call on in emergencies.
Tiirmaa-Klaar identifies intelligence sharing as the remaining gap. “The technical frameworks are improving. The challenge is that cyber threat intelligence — who is attacking, how, with what tools — is classified at national level in most EU member states and shared only selectively. Building genuine collective intelligence on hybrid threats requires a level of trust and institutional integration between national intelligence services that does not yet exist at EU level. That is the frontier where the most important work remains to be done.”
