Hybrid Warfare Explained: Disinformation, Sabotage and the Gray Zone

Hybrid warfare is the coordinated use of military and non-military instruments, from disinformation and cyber operations to economic pressure and deniable sabotage, to achieve strategic goals while staying below the threshold that would trigger open war. It has moved from academic concept to daily operational reality, visible in severed Baltic Sea cables, an annulled presidential election in Romania and coast guard confrontations in the South China Sea. This guide explains what the term means, where the definitional debates lie, which tools are used, and how states and alliances are organizing their defense.

Key takeaways

• Hybrid warfare blends overt and covert, military and non-military means; NATO and the EU define it as a threat category rather than a single doctrine.
• The so-called "Gerasimov Doctrine" is a Western label, and the analyst who coined it has publicly regretted the term.
• Between 2022 and early 2026 the Baltic Sea saw a run of pipeline and cable incidents, but courts and prosecutors have struggled to prove intent.
• Gray-zone pressure in the South China Sea relies on coast guards and maritime militia rather than navies, keeping escalation risk deliberately ambiguous.
• Resilience, attribution, legal tools and allied coordination, including the Helsinki-based Hybrid CoE, form the core of current countermeasures.

What is hybrid warfare?#

There is no single legal definition of hybrid warfare, which is part of what makes it effective. The term entered Western defense debate through Frank Hoffman, whose 2007 study for the Potomac Institute, Conflict in the 21st Century: The Rise of Hybrid Wars, described adversaries that fuse conventional capabilities, irregular tactics, terrorism and criminal activity within the same battlespace. Hoffman's main reference point was Hezbollah's performance against Israel in 2006, where a non-state actor fielded guided missiles, drones and disciplined infantry alongside information campaigns. In that early usage, "hybrid" described a blend of military methods on the battlefield.

After Russia's annexation of Crimea in 2014, the concept widened considerably. Western governments began using hybrid warfare to describe campaigns that combined unmarked soldiers, local proxies, disinformation, cyberattacks and energy pressure, often with the goal of achieving a fait accompli before a defender could agree on how to respond. The emphasis shifted from what happens on the battlefield to what happens before, around and instead of it.

How NATO and the EU define hybrid threats#

NATO states that "hybrid threats combine military and non-military as well as covert and overt means, including disinformation, cyber attacks, economic pressure, deployment of irregular armed groups and use of regular forces." The Alliance adopted a strategy for countering hybrid warfare in 2015 and has said since 2016 that hybrid actions against one or more Allies could lead to a decision to invoke Article 5, the collective defense clause.

The European Union's 2016 Joint Framework on countering hybrid threats uses similar language, describing a mixture of coercive and subversive activity, conventional and unconventional methods, coordinated by state or non-state actors to achieve specific objectives while remaining below the threshold of formally declared warfare. The EU tends to speak of "hybrid threats" rather than "hybrid warfare," reflecting its focus on resilience, law and economic tools rather than military response.

Source	Year	Core idea	Emphasis
Frank Hoffman, Potomac Institute	2007	Fusion of conventional, irregular, terrorist and criminal methods in one battlespace	Battlefield tactics
Valery Gerasimov, Military-Industrial Courier	2013	Non-military means increasingly outweigh military force in achieving political goals	Russian reading of Western practice
NATO strategy on hybrid warfare	2015	Military and non-military, covert and overt means combined	Deterrence and defense, Article 5
EU Joint Framework	2016	Coercive and subversive activity below the threshold of declared war	Resilience and societal security
Hybrid CoE, Helsinki	2017 onward	Hostile influencing through to hybrid warfare, exploiting democratic vulnerabilities	Analysis, training, exercises

Table: Major definitions of hybrid warfare and hybrid threats. Sources: Hoffman (2007), NATO, European Commission, Hybrid CoE.

Hybrid warfare versus gray-zone conflict#

"Gray zone" is often used interchangeably with hybrid warfare, but the terms are not identical. Gray-zone activity describes the space between peace and war, where an actor applies pressure in increments small enough that each step does not justify a military response. Hybrid warfare describes the combination of instruments. A gray-zone campaign is usually hybrid in method, but hybrid methods can also accompany open war, as Russia's cyber and information operations alongside its full-scale invasion of Ukraine in 2022 demonstrate.

Chart: Key milestones in the development of hybrid warfare as a policy concept. Sources: Hoffman (2007), NATO, European Commission, Hybrid CoE, 2026.

The Gerasimov debate and Russian thinking#

In February 2013, General Valery Gerasimov, Chief of the Russian General Staff, published an article in the Russian weekly Voenno-Promyshlennyi Kurier (Military-Industrial Courier) on the changing character of war. He argued that the "rules of war" had changed and that non-military means, including political, economic, informational and humanitarian measures, had in many cases exceeded the power of weapons. A widely reproduced chart in the translated article suggested a ratio of roughly four non-military measures to one military measure in modern conflict.

Why "Gerasimov Doctrine" is a misleading label#

British analyst Mark Galeotti popularized the phrase "Gerasimov Doctrine" in a 2014 blog post. In 2018 he wrote in Foreign Policy that he was "sorry for creating the Gerasimov Doctrine," arguing that the article was a description of how Russia's General Staff perceived Western behavior, notably the Arab Spring and color revolutions, rather than a blueprint for Russian action. Many scholars of Russian military thought agree that the article was about preparing Russia to defend against what Moscow saw as Western hybrid methods.

That debate matters for analysis. Treating every Russian action as part of a single master plan overstates coherence and can lead to misreading opportunistic or bureaucratically driven behavior as strategy. At the same time, Russian doctrine does place heavy weight on "information confrontation" and on blending state and non-state tools, which is consistent with what Western governments have documented since 2014.

Russia is not the only practitioner#

Hybrid warfare is frequently discussed through a Russia lens, but the methods are widely used. China's approach to maritime disputes, Iran's network of regional partners and proxies, and North Korea's use of cybercrime for revenue all combine non-military and military tools in ways that fit NATO's definition. Western states also use economic sanctions, covert action and information campaigns, which is one reason Moscow and Beijing reject the framing as one-sided.

The hybrid toolkit#

Hybrid campaigns draw from a broad menu of instruments. Their effect comes less from any single tool than from orchestration and from exploiting the seams between government departments, legal regimes and allied decision-making. The chart below groups the main categories.

Chart: Categories of hybrid warfare instruments as identified by NATO and the EU. Sources: NATO, European Commission Joint Framework, 2016–2025.

Disinformation and influence#

Disinformation is the most visible hybrid instrument. It aims to polarize societies, erode trust in institutions and shape the information environment ahead of a crisis. The EU's East StratCom Task Force, through its EUvsDisinfo database, has catalogued thousands of pro-Kremlin disinformation cases since 2015. Modern campaigns rely on networks of inauthentic accounts, paid influencers and look-alike news sites, and increasingly on generative AI to produce content at scale.

Cyber operations#

Cyber operations range from espionage to destructive attacks. In a hybrid context, the most significant are those that pre-position access inside critical infrastructure. In February 2024, U.S. agencies and allied partners warned that the China-linked group Volt Typhoon had maintained access to some U.S. infrastructure networks for at least five years, with the aim of being able to disrupt them in a future crisis. Cyber warfare is covered in depth in our companion guide.

Lawfare and economic coercion#

Lawfare is the use of legal systems and claims to achieve strategic aims, such as issuing passports to residents of a neighboring country and then citing their protection as grounds for intervention, as Russia did in Georgia's breakaway regions and later in eastern Ukraine. Economic coercion includes energy cutoffs, as when Russian gas flows to Europe were sharply reduced in 2022, and targeted trade pressure, as when China restricted imports from Lithuania after Vilnius allowed a Taiwanese representative office to open in 2021, prompting the EU to launch World Trade Organization proceedings in January 2022.

Proxies and instrumentalized migration#

Proxies provide deniability. Russia's use of the Wagner Group in Ukraine, Syria, Libya and the Sahel is the best-known example, while Iran works through partner militias across the Middle East. A newer tactic is the instrumentalization of migration: in 2021 Belarus facilitated the movement of migrants toward the Polish, Lithuanian and Latvian borders, and in November 2023 Finland closed crossings on its border with Russia, accusing Moscow of directing asylum seekers toward it. Russia denied the accusations.

Undersea cables and infrastructure sabotage in the Baltic#

The Baltic Sea has become the most closely watched theater for suspected infrastructure sabotage. It is shallow, heavily trafficked and crisscrossed by power cables, gas pipelines and data links connecting Nordic and Baltic states. A ship dragging its anchor can cause serious damage while maintaining plausible deniability, which makes the region a test case for hybrid warfare below the threshold of armed attack.

The incident record, 2022 to 2026#

Date	Infrastructure	Vessel linked	Outcome as reported
Sept 2022	Nord Stream 1 and 2 gas pipelines	None (explosions)	Attribution contested; Russia, Ukraine, US and UK deny involvement
Oct 2023	Balticconnector gas pipeline, Estonia telecom cables	NewNew Polar Bear (Hong Kong-flagged, Chinese-operated)	Finnish investigators say anchor drag severed pipeline; captain charged in Hong Kong in 2025
Nov 2024	Two fiber-optic cables (Lithuania-Sweden, Finland-Germany)	Yi Peng 3 (Chinese bulk carrier)	China allowed partner states to board in December; no conclusive evidence of wrongdoing found
Dec 2024	Estlink 2 power cable and four telecom cables	Eagle S (Cook Islands-flagged tanker)	Finnish court dismissed charges against captain and officers in October 2025
Jan 2025	Latvia-Gotland fiber-optic cable	Vezhen (Maltese-flagged)	Swedish prosecutor ruled damage accidental
Dec 2025	Helsinki-Estonia telecom cable	Fitburg (cargo ship from Russia)	Ship seized by Finnish police; investigation ongoing at time of reporting

Table: Reported Baltic Sea undersea infrastructure incidents. Sources: Reuters via Malay Mail timeline (January 2026), Baird Maritime, gCaptain.

Chart: Major reported Baltic pipeline and cable incidents by year, based on the table above. A further cable incident between Lithuania and Latvia was reported on 2 January 2026. Source: Reuters timeline via Malay Mail, January 2026.

The attribution problem#

The legal outcomes illustrate why infrastructure sabotage is attractive as a hybrid tool. Proving that an anchor drag was deliberate requires evidence of intent, often from crew communications or orders that are hard to obtain. Several cases have ended with charges dismissed or damage ruled accidental. Some U.S. and European officials have also cautioned publicly that maritime accidents are common in congested waters. The result is persistent ambiguity: governments may suspect a campaign, while courts require proof that meets criminal standards.

The Eagle S case drew particular attention because European officials described the tanker as part of Russia's "shadow fleet," the aging, often poorly insured vessels used to move Russian oil around sanctions. That link turned a maritime incident into a sanctions-enforcement and security question at the same time.

NATO's response: Baltic Sentry#

In January 2025, NATO launched Baltic Sentry, an enhanced vigilance activity bringing frigates, maritime patrol aircraft and naval drones to monitor the Baltic Sea and deter attacks on critical undersea infrastructure. Coastal states have also expanded inspection of vessels, tightened insurance checks and invested in repair capacity, aiming to reduce both the likelihood and the impact of future incidents.

Election interference and information operations#

Elections are high-value targets for hybrid campaigns because a successful operation can change a country's policy direction without any use of force. The scale and sophistication of interference has grown with the reach of social media platforms.

United States, 2016#

The U.S. intelligence community's January 2017 assessment concluded that Russia conducted an influence campaign aimed at the 2016 presidential election, combining hack-and-leak operations by GRU military intelligence with social media activity by the St. Petersburg-based Internet Research Agency. The Special Counsel's report in 2019 described the social media campaign and the GRU hacking operations in detail. Russia has denied interfering.

Romania, 2024#

The most consequential recent case occurred in Romania. On 24 November 2024, Călin Georgescu, a little-known candidate who had polled around 5 percent, won the first round of the presidential election with about 23 percent. Declassified Romanian intelligence documents described a social media campaign using roughly 25,000 accounts, heavily on TikTok, and pointed to the involvement of a "state actor" without naming it, though the context indicated Russia. On 6 December 2024 Romania's Constitutional Court annulled the first round and ordered the electoral process to be repeated. Critics, including some Romanian politicians, condemned the decision as undemocratic, illustrating how responses to interference can themselves become contested.

Moldova and beyond#

Moldova's October 2024 presidential election and EU membership referendum took place amid allegations by Moldovan authorities of large-scale vote-buying schemes linked to fugitive pro-Russian politician Ilan Shor. The referendum passed by a narrow margin. Across Europe, authorities have also reported networks of cloned news websites, a campaign often referred to as "Doppelganger," which the EU has sanctioned under its Russia-related frameworks.

Gray-zone tactics in the South China Sea#

The South China Sea offers a different model of hybrid pressure. Rather than deniable sabotage, China relies on overwhelming presence by its coast guard and maritime militia, using law-enforcement framing to assert control over disputed features while keeping its navy in the background.

Coast guards and maritime militia#

The China Coast Guard has used water cannon, blocking maneuvers and ramming against Philippine vessels resupplying the BRP Sierra Madre, a grounded ship serving as a Philippine outpost at Second Thomas Shoal. On 17 June 2024, a Philippine Navy sailor lost a thumb when Chinese personnel rammed his small boat during a resupply mission. In July 2026, according to the Armed Forces of the Philippines, Chinese coast guard personnel struck Filipino sailors with batons near the shoal, injuring one service member. China maintains that the Philippines is illegally occupying Chinese territory and that its coast guard acts lawfully.

Lawfare at sea#

The legal dimension is central. In 2016, an arbitral tribunal constituted under the UN Convention on the Law of the Sea ruled that China's expansive "nine-dash line" claims had no legal basis. China rejected the ruling and did not participate. Beijing's 2021 Coast Guard Law, which authorizes the use of force in waters China claims, is cited by regional governments as an example of domestic law applied to disputed areas. The combination of presence, legal assertion and calibrated force is designed to change facts on the water without triggering the U.S.-Philippines Mutual Defense Treaty.

Chart: Escalation ladder in South China Sea gray-zone operations; dashed steps have so far been avoided. Sources: CSIS Asia Maritime Transparency Initiative, USNI News reporting, 2024–2026.

Countering hybrid threats#

Because hybrid warfare targets the gaps between agencies, laws and allies, countermeasures focus on closing those gaps. No single ministry owns the problem, and responses must combine intelligence, law enforcement, diplomacy, private-sector cooperation and, where necessary, military posture.

Hybrid CoE and institutional responses#

The European Centre of Excellence for Countering Hybrid Threats (Hybrid CoE) was established in Helsinki in April 2017 and inaugurated that October. It describes itself as serving 35 EU and NATO participating states, though the United States notified the Centre of its withdrawal in early 2026 following a presidential memorandum on international organizations. Hybrid CoE runs training, exercises and research for both the EU and NATO, functioning as one of the few formal bridges between the two organizations on this issue. NATO has added counter-hybrid support teams, available to Allies on request since 2018, and in 2025 created a Special Coordinator for Hybrid Threats.

Sanctions, attribution and law#

The EU created a dedicated sanctions framework in October 2024 to target individuals and entities responsible for Russia's destabilizing activities, including information manipulation and sabotage. By October 2025 it listed 47 individuals and 15 entities and was renewed until October 2026. Public attribution, ideally coordinated among allies, raises the political cost of hybrid operations even when criminal prosecution is not possible.

Resilience as deterrence#

The most durable countermeasure is resilience: redundant cables and power links, rapid repair capacity, media literacy, transparent election administration and platform accountability. Finland and Sweden's "total defense" and "comprehensive security" models, which prepare entire societies for crisis, are often cited as reference points. Deterrence by denial, making attacks less likely to succeed, matters as much in hybrid warfare as deterrence by punishment.

Frequently asked questions#

What is the simplest definition of hybrid warfare?#

Hybrid warfare is the combined use of military and non-military tools, such as disinformation, cyberattacks, economic pressure, proxies and sabotage, to achieve political or strategic goals. NATO describes hybrid threats as combining military and non-military as well as covert and overt means. The key feature is coordination across domains, often designed to remain below the threshold that would justify a conventional military response. Because each individual action may appear minor or deniable, the defender struggles to decide when and how to respond, which is the advantage the attacker seeks.

Is the Gerasimov Doctrine real?#

Not as a formal doctrine. General Valery Gerasimov's 2013 article described how Russia's General Staff saw the changing character of war, emphasizing the growing role of non-military means. Analyst Mark Galeotti, who coined the phrase "Gerasimov Doctrine," later apologized for it, arguing the article described Russian perceptions of Western behavior rather than a plan for Russian operations. Russia does, however, place heavy emphasis on information confrontation, and many of the methods discussed in the article have appeared in Russian practice since 2014.

Who is behind the Baltic Sea cable cuts?#

There is no confirmed answer covering all incidents. Investigations linked specific vessels to specific breaks, including the NewNew Polar Bear, Yi Peng 3 and Eagle S, but proving deliberate sabotage has been difficult. A Finnish court dismissed the Eagle S case in October 2025 and a Swedish prosecutor ruled the Vezhen damage accidental. European officials have voiced suspicion about Russian involvement in some cases, while Russia and China deny responsibility. The pattern itself, rather than any single case, has driven NATO's Baltic Sentry mission.

How is hybrid warfare different from cyber warfare?#

Cyber warfare is one instrument within hybrid warfare. It covers state-directed operations in computer networks, from espionage to destructive attacks. Hybrid warfare is broader: it combines cyber operations with disinformation, economic coercion, legal maneuvers, proxies and physical sabotage, often in a single campaign. A cyberattack on its own is not necessarily hybrid warfare; it becomes part of a hybrid campaign when coordinated with other instruments toward a common strategic objective.

Can hybrid attacks trigger NATO's Article 5?#

Yes, in principle. NATO has stated since 2016 that hybrid actions against one or more Allies could lead to a decision to invoke Article 5. The Alliance deliberately avoids specifying a threshold, preserving ambiguity for adversaries. In practice, the decision would be political and taken by consensus among Allies, based on the scale and effects of an attack. To date, no hybrid incident has led to an Article 5 invocation; the only invocation followed the 11 September 2001 attacks.

What can individuals do against hybrid threats?#

Individuals are often the target of the information component. Practical steps include checking the source and date of viral content, being cautious with accounts that appeared recently and post at high volume, using official channels for election information, and keeping devices and accounts secured against compromise. Organizations that operate critical infrastructure have a larger role, including reporting incidents promptly to national authorities and taking part in resilience exercises.

The RAGE X view#

Hybrid warfare is best understood not as a new kind of war but as the systematic exploitation of ambiguity. Its practitioners rarely need a decisive blow; they need defenders to hesitate, disagree and absorb costs over time. The Baltic cable cases show the legal system's difficulty proving intent, the Romanian election shows how interference and the response to it can both strain democratic legitimacy, and the South China Sea shows how law-enforcement framing can cap escalation while shifting control. In each case the advantage lies with whoever sets the pace.

The defensive agenda is therefore less about any single technology than about speed, coordination and resilience: faster attribution, shared maritime awareness, redundant infrastructure and societies prepared for disruption. RAGE X tracks these trends across regions through RAGE INDEX, our global conflict intelligence platform, while daily developments in hybrid and gray-zone activity are covered on RAGE Intel. For more on our work across intelligence and technology, visit RAGE X.

Sources#

1. Hoffman, F. G. (2007). Conflict in the 21st Century: The Rise of Hybrid Wars. Potomac Institute for Policy Studies. https://www.potomacinstitute.org/images/stories/publications/potomac_hybridwar_0108.pdf
2. NATO. "Countering hybrid threats." https://www.nato.int/cps/en/natohq/topics_156338.htm
3. European Commission and High Representative (2016). Joint Framework on countering hybrid threats, JOIN(2016) 18. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52016JC0018
4. Galeotti, M. (2018). "I'm Sorry for Creating the 'Gerasimov Doctrine'." Foreign Policy. https://foreignpolicy.com/2018/03/05/im-sorry-for-creating-the-gerasimov-doctrine/
5. Hybrid CoE. "Who, what and how." https://www.hybridcoe.fi/who-what-and-how/
6. Hybrid CoE (2026). "The United States withdraws from Hybrid CoE." https://www.hybridcoe.fi/news/the-united-states-withdraws-from-hybrid-coe/
7. Malay Mail / Reuters (2026). "Baltic Sea cable sabotage timeline from Nord Stream to 2026." https://www.malaymail.com/news/world/2026/01/06/baltic-sea-cable-sabotage-timeline-from-nord-stream-to-2026-whos-behind-the-attacks/204485
8. gCaptain. "A Timeline of Suspected Underwater Sabotage Incidents in the Baltic Sea." https://gcaptain.com/a-timeline-of-suspected-underwater-sabotage-incidents-in-the-baltic-sea/
9. NATO (2025). "NATO launches 'Baltic Sentry' to increase critical infrastructure security." https://www.nato.int/en/news-and-events/articles/news/2025/01/14/nato-launches-baltic-sentry-to-increase-critical-infrastructure-security
10. Office of the Director of National Intelligence (2017). Assessing Russian Activities and Intentions in Recent US Elections. https://www.dni.gov/files/documents/ICA_2017_01.pdf
11. OSW Centre for Eastern Studies (2024). "Romania: Constitutional Court annuls presidential election." https://www.osw.waw.pl/en/publikacje/analyses/2024-12-09/romania-constitutional-court-annuls-presidential-election
12. USNI News (2026). "Philippine Sailor Injured in Violent Clash with China Coast Guard off Second Thomas Shoal." https://news.usni.org/2026/07/20/philippine-sailor-injured-in-violent-clash-with-china-coast-guard-off-second-thomas-shoal
13. Permanent Court of Arbitration. The South China Sea Arbitration (Philippines v. China). https://pca-cpa.org/en/cases/7/
14. CSIS Asia Maritime Transparency Initiative. https://amti.csis.org/
15. EEAS (2025). "Russian hybrid threats: Council prolongs restrictive measures by another year." https://www.eeas.europa.eu/delegations/ukraine/russian-hybrid-threats-council-prolongs-restrictive-measures-another-year_en
16. CISA et al. (2024). "PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure." https://www.cisa.gov/sites/default/files/2024-02/aa24-038a-jcsa-prc-state-sponsored-actors-compromise-us-critical-infrastructure_1.pdf
17. Al Jazeera (2023). "Finland to block border amid Russian 'instrumentalisation of migrants'." https://aljazeera.com/news/2023/11/17/finland-to-place-barriers-on-russian-border-to-block-migrant-flow

About RAGE X: RAGE X is a global media, intelligence and technology organization delivering geopolitical intelligence, military and conflict analysis, OSINT and security insight through RAGE Intel, RAGE INDEX and its wider ecosystem.