Russia wants to confront NATO but dares not fight it on the battlefield – so it’s waging a hybrid war instead

When someone tried – and failed – to burn down a bus garage in Prague earlier this month, the unsuccessful arson attack didn’t draw much attention. Until, that is, Czech Prime Minister Petr Fiala revealed it was “very likely” that Moscow was behind it.

The accusation prompted alarm among security officials and governments because several similar incidents have occurred across Europe in recent months. The Museum of Occupation in Riga was targeted in an arson attack in February. A London warehouse burnt down in March and a shopping center in Warsaw went up in flames in May. Police in Germany arrested several people suspected of planning explosions and arson attacks in April, and French authorities launched an anti-terror investigation after detaining a suspected bomb-maker who was injured in a botched explosion earlier this month.

Multiple hacking attacks and spying incidents have been reported in different European countries. As the same time, the European Union has accused Russia and Belarus of weaponizing migration by pushing asylum seekers from third countries to its borders. There have also been several suspicious attacks against individuals: a Russian defector was found shot dead in Spain and an opposition figure exiled in Lithuania was brutally attacked with a hammer.

The seemingly random attacks have one thing in common: according to local officials, they are all linked to Russia. And while they might look minor in isolation, taken together these incidents amount to what security experts say is Russia’s hybrid war on the West.

“We are threatened by something which is not a full-fledged military attack, which are these hybrid threats … everything from meddling in our political processes, (undermining) the trust in our political institutions, disinformation, cyber-attacks (…) and sabotage actions against critical infrastructure,” NATO Secretary General Jens Stoltenberg said during an event in Canada last week.

Rod Thornton, a senior lecturer in defense studies at King’s College London, said there’s been a pattern of attacks linked back to Russia. “There has definitely been an increase over the last few months in these particular types of operations. It is something that the Russians are ramping up,” Thornton said.

Moscow has not claimed responsibility for any of the attacks and has not responded to CNN’s request for comment, but Russian President Vladimir Putin has made it clear he sees the war in Ukraine as part of a broader conflict with NATO and that his regime views the government in Kyiv as a mere proxy of the West. And with every increase of Western aid to Ukraine – whether through new weapons deliveries, or the imposition of new sanctions on Russia – the Kremlin has stepped up its saber-rattling.

Thornton said Russia was resorting to a campaign of sabotage as an alternative to a full-on war with NATO, which would be disastrous for Russia.

“It’s long been a part of Russian military doctrine to try and avoid trying to face NATO on a battlefield, because they know they would lose to NATO forces,” he said. “What they are doing is undertaking activities which are below the threshold of armed conflict, so they are not inciting an Article 5 response from NATO,” he added.

Article 5 is the cornerstone principle that an attack on one member of NATO is an attack on all members. It’s only been invoked once – after the 9/11 terrorist attacks on the United States by al Qaeda.

Thornton said that by deliberately keeping the attacks below the threshold of armed conflict, Russia is hoping to sow more divisions within NATO because there is no clear blueprint on how to act.

“NATO only works when all member states of NATO act in unison. It’s no good if the US, the UK, maybe France say, let’s do this against Russia, and if the other countries say, well, you know, we don’t want to do that, we need to wait on this.”

Nicole Wolkov, a Russia researcher at the US-based Institute for the Study of War, said Russia’s main goal now is to disrupt the flows of Western military aid to Ukraine.

“These hybrid operations are part of Russia’s war effort to weaken Western resolve to support Ukraine and undermine unity within the West,” she said, warning that in the long term, Russia might be gearing up for a more direct confrontation.

“Russia is, and has been since before the war, conducting these hybrid operations against NATO, the West, the EU, in tandem with its attempts to improve its conventional military abilities for a potential future conflict with NATO,” she told CNN.

Years in the making

Russia-watchers say Moscow has been beefing up its hybrid war units for years. The most obvious sign of this, they say, was the promotion of a notorious spy commander, Andrei Averyanov, into the top ranks of the GRU in 2020.

Averyanov allegedly oversaw the 2018 Novichok nerve agent poisoning of Sergei and Yulia Skripal in Salisbury in England, and the 2014 blast in an ammunition depot in the Czech Republic that killed two people. Now the deputy head of the GRU, he is wanted in the Czech Republic over his role in the blast in the town of Vrbetice. Russia has repeatedly denied its involvement in both events.

“He was previously the head of 29155 unit, which is known for its participation in the Salisbury attack, they attempted to organize that coup d’etat in Montenegro, they had operations to destabilize Moldova and Macedonia,” said Oleksandr Danylyuk, an associate fellow at Royal United Services Institute, a UK defense and security think tank, and a former Ukrainian defense and foreign intelligence official.

“His promotion and the creation of a new Special Activity Division that has new powers to recruit their own assets … it’s a very strong indicator that Russia is trying to expand its capabilities,” he added.

Czech Police said that the suspected arsonist in the recent bus station incident was a 26-year-old foreigner who had only arrived in the Czech Republic five days earlier. Fiala, the prime minister, alleged the man was paid for his actions.

The amateurish nature of the Prague attack – the perpetrator did not manage to cause any significant damage and was caught – fits the pattern.

“At the moment, most of these people are just proxies that are paid by the GRU, they aren’t trained to do these types of operations, they might be seen as a testing mechanism conducted by the Russians to see where the weaknesses of Western critical national infrastructure are,” said Danylyuk.

Five people have been charged in connection with the arson attack in London – four of them were in their early 20s and at least one was accused of being paid for the attack. The office of the German Federal Public Prosecutor said the people who were arrested on suspicion of planning arson attacks and explosions on behalf of Russia were “in contact” with Russian security officials, rather than being spies themselves. In Poland, a man arrested for spying and planning Ukrainian President Volodymyr Zelensky’s assassination was also a local citizen.

Danylyuk said the Russian security apparatus doesn’t shy away from using criminals to do its dirty work, tapping into its links with international organized crime.

“What is actually super dangerous and disturbing is that they are using these networks, plus a lot of potentially violent organizations, radical groups, far-right groups, far-left groups,” he said.

Cybercrime and disinformation

Most of the attacks uncovered so far have been relatively minor, suggesting that Russia’s goal isn’t as much about inflicting the biggest possible damage as scaring the local population.

“The aim is to break the will of the citizens and to break the support for Ukraine. If you were living peacefully in your country and suddenly you have a series of terrorist attacks, and this is all attributed to your country supporting Ukraine, that puts pressure on your support for Ukraine,” said Olga Lautman, a security researcher who specializes in the intersection of organized crime and intelligence operations in Russia.

Many of the attacks are accompanied by a disinformation campaign designed to deflect the blame from Russia, researchers say.

That’s very much what happened in the aftermath of the failed arson attack in Prague, according to research from Czech Elves, a group of volunteer activists who monitor, analyze and fight disinformation campaigns that appear on the Czech internet.

The group said that disinformation campaigns it monitored tried to trivialize the attacks and discredit the Czech government. One narrative sought to portray the accusation by Fiala that Russia was behind the arson as an attempt to distract from the government’s poor showing in the European Parliament election. Others mocked the facts, saying the attack affected “only” a few buses.

“You have these terrorist attacks and at the same time disinformation operations are blaming the politicians in charge, saying this is why Germany or Poland or the United States should not be involved in supporting Ukraine, because this is not their war,” Lautman said.

The disinformation campaigns appear to go hand-in-hand with cyberattacks. Multiple countries across Europe have suffered major hacks in recent months. Authorities in Finland and Estonia said the GPS signal was being jammed regularly, causing disruptions to flights.

Multiple French government departments suffered what the French described as “a massive cyberattack” in February and, earlier this month, a blood-testing laboratory servicing multiple hospitals in England became a target of a ransomware attack.

Yet Thornton said these incidents are likely just the beginning.

“What Russian cyber operatives are doing now is testing weaknesses within cyber security systems, planting malware, finding out where and how to attack without doing it now,” he said. “They’ll wait for the big day when they need them.”

Underestimating Russia

NATO has for months been warning about Russia’s unconventional attacks on the West, saying Moscow is using espionage, cyber-attacks, electoral interference, disinformation and sabotage trying to destabilize the bloc and weaken its resolve to help Ukraine.

But until recently, European leaders were reluctant to point a finger directly at the Kremlin. According to Lautman, Moscow has become emboldened over recent years, because it has rarely been held accountable.

The US and some European countries imposed limited sanctions on Russia over its actions in Ukraine in 2014. However, it wasn’t until Russia launched its full-scale invasion of Ukraine in February 2022 that the West really flexed its sanctions muscle against Russia.

Lautman, who is a non-resident senior fellow at the Center for European Policy Analysis, said the complacency towards Russian attacks goes back to at least the 2006 killing of Alexander Litvinenko in London. The former Russian agent turned Kremlin critic was poisoned by a rare radioactive isotope, polonium-210, in what the European Court of Human Rights said was a state-sponsored attack by Russia. The Kremlin has always denied the accusation.

“They got away with it. Everyone knew it was Russia. I mean, the [alleged] assassin Andrei Lugovoi was promoted and put into the Duma,” Lautman said, adding: “And with Skripal, I will never forget (Prime Minister) Theresa May giving Russia an ultimatum to provide answers. And they delivered another dead body within 48 hours – Nikolai Glushkov.”

Glushkov, a Putin critic, was living in the UK after being granted political asylum. He was found dead in his home in London a week after the Salisbury poisoning. A spokesperson for the Metropolitan Police told CNN that a post-mortem found that he had been strangled and that a murder investigation led by detectives from the Met’s Counter Terrorism Command continues. No arrests have been made and no motive established.

Thornton said that NATO was reluctant to blame the Skripal poisoning directly on Putin and the Russian state because of the risk of escalation and pushing Russia into being a “complete adversary.”

“(They) would kind of said maybe it was a rogue GRU operation, was Putin really behind it? There was an element of ‘let’s not go too far, because we don’t want to lose Putin completely,’” he said.

“Now that’s completely off the table,” he added.

While many of the more high-profile attacks – the Litvinenko and Skripal poisonings, for example – are thought to have been approved or even ordered directly by Putin, the desire to hurt the West cuts through the Russian political establishment, analysts say.

The people known as siloviki — Russia’s most powerful men (they are almost exclusively men) who rose to power through the ranks of the Soviet and Russian security services – see the relationship between the West and Russia as a zero-sum game. Russia can only be strong if the West and NATO are weak.

“Russia has always been antagonistic towards the West,” Thornton said. “It goes way back to tsarist times, the idea of the West being a threat, that the West wants to do Russia down, to make Russia a smaller state, a weak state … so whoever you put in power in the Kremlin, there’s still going to be this mindset that the West is in essence the enemy.”

Lautman agreed, adding that the current establishment’s hatred towards the West stems partly from the events following the fall of the Soviet Union in the early 1990s, when Russia had to be bailed out by the West after its economy collapsed.

The idea that Russia’s aggression will end with the eventual demise of Putin is the West’s “biggest mistake,” she said, predicting successive leaders will continue to see the West as an enemy until the country gives up the idea of Russian imperialism – which won’t happen easily.

“And Europe, and the whole international community who wants global stability, they need to understand that Russia is at war with us and that they will continue escalating unless we start acting.”

For more CNN news and newsletters create an account at CNN.com