Confronting the Russian Hydra: Continuity and Innovation in the Grey Zone

The major threat to European security today is posed by Russia’s aggressive foreign policy, enacted in part by its intelligence services.

This report draws attention to the services’ strategic culture and enduring trends in order to help better understand the logic and legacy behind Russian covert operations and, more importantly, forecast the shape these might take in the future.

The Russian intelligence community has preserved a Bolshevik paranoid view of international affairs, where the suspicion of conspiracy turns all foreign actors into potential threats. In this institutionalised worldview, their cause is always righteous, entrenching a mindset where no limits as to how to engage a perceived enemy apply.

The services push narratives that reflect the features of their strategic culture. Namely, they favour consistent themes that echo their paranoia about international affairs, their sense of moral superiority, and the supposed irrationality and aggressiveness of the west. Many of these elements emulate Soviet-era Communist propaganda.

The Russian services draw from a long lineage of aggressive covert operations from the Bolshevik era to the Cold War. Externally, these aimed at narrowing the gap between the Soviet Union and its more technologically advanced rivals. Internally, stories about supposed sabotage, allegedly carried out by foreign operatives, served as both an instrument of propaganda and a justification for repression. The services of today have rediscovered sabotage—now increasingly common on European soil—as a tool in their campaign to dissuade the west from supporting Ukraine.

To confront these rising threats, government and non-government stakeholders must proactively mitigate vulnerabilities across all domains:

• Societal resilience. An informed public, with media literacy skills and access to independent journalism, will be able to resist Russian information operations.
• Cyber and information defence. Strengthen critical targets through preventive measures (e.g., risk-based cybersecurity) and responsive strategic communications.
• Secure critical infrastructure. Energy grids, transport hubs, and especially, undersea cables and pipelines require monitoring, patrolling, and public-private cooperation.
• Economic statecraft. Reduce strategic dependencies to undermine the levers of influence that actors may exploit to amplify the impact of covert operations.
• Alliance coordination. Achieve hybrid deterrence through cross-domain playbooks, shared attribution standards, and graduated response.
• Measuring success. Confronted by hybrid threats, defenders must assess their resilience across sectors. Transparency will, in turn, ensure political will.