What is the role of cyber in hybrid threat activity?
Cyberspace bridges all societal domains, making resilience critical. In early October 2026 Hybrid CoE, with the European Security and Defence College (ESDC) and the European Defence Agency (EDA), organized a course on how the cyber domain contributes to hybrid conflict. The five-day course brought together practitioners from across the Centre’s Participating States, Ukraine, the EU, and NATO.
Hybrid CoE Director Teija Tiilikainen framed this year’s course against the shifting balance of power as China and Russia advance their partnership, shape a common narrative and expand their global influence. The event provided an opportunity to explore countermeasures and practise effective responses against evolving hybrid threats in cyberspace.
The event featured expert talks on topics from Russia and China to EU responses, lessons from Ukraine, international law, and deterrence. Multiday wargaming sessions simulated measures and responses in the cyber domain, exposing participants to training that was fictional yet embedded in reality.
Cyber: a significant hybrid threat enabler
Echoing Tiilikainen’s remarks about narratives and influence, the talks noted the potential of cyber tools to change a society’s behaviour. Cyber enables diverse hybrid threat activity, from information manipulation to economic pressure, military measures, attacks against critical infrastructure, and political influence.
Martin Cvetko from the NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE) called attention to the significant attack surface created by cyberspace, pointing to vulnerabilities in home appliances and devices within the Internet of Things (IoT) from smart boilers to air conditioners, and security gaps in supply chains that could be difficult to address.
Cvetko also discussed the nature of cyberspace, cyber operations, data, and other related concepts. He viewed data both as foundational for operations and decision making and as a potential target for theft, manipulation and sabotage.
In a fast-evolving landscape some definitions may require periodic revision. For example, the distinction between certain threat actor categories – specifically, hacktivism, terrorism and warfare – sparked discussion among the participants.
Countering FIMI: a more disruptive approach
Tudor Fabian from the European External Action Service (EEAS) provided clarity on the concept of FIMI (foreign information manipulation and interference), describing it as a hybrid security threat entailing a pattern of behaviour that sought to undermine values, procedures and political processes. Threat actors engaged in FIMI campaigns to destabilize and paralyse decision making, not necessarily to achieve a specific outcome in an event like an election.
In response to these campaigns the EEAS has developed the FIMI Toolbox, a whole-of-society approach to combating FIMI that relies on situational awareness, resilience building, disruption and regulation, and external action.
Tudor said that recent responses to FIMI had shifted from resilience building to a more disruptive approach that targeted weak points across the hostile FIMI infrastructure adversaries deployed, with the aim of deterring future attacks.
Ukraine: intensive and evolving cyber threats
The course also discussed Russia’s cyberattacks against Ukraine’s security and defence sector. Oleksandr Gain, Director of Strategic Communications for Ukraine’s Ministry of Defence, described the cyber threat faced by Ukraine as high-intensity and constantly evolving.
According to Gain more than 3,100 cyber incidents were recorded in Ukraine during the first half of 2026. Russia’s broad attacks targeted everything from users and credentials to workstations, mobile devices, server infrastructure, and specialized military systems.
Gain noted that Russia tended to combine cyberattacks with physical strikes, as was the case with Nova Post, a major private shipping service in Ukraine. In that attack Russia launched missile strikes on the company’s terminals and logistics hubs, and conducted a DDoS (Distributed Denial of Service) attack against its systems.
Responding to a question about taking the offensive in cyber operations, Gain said that nothing was preventing Ukraine using various offensive methods against enemy targets, but all such attacks must be performed under legal supervision.
Gain also commented on the role of emerging threats involving AI technology, saying that new tools such as deepfakes were evolving rapidly, and that Ukraine’s recruitment efforts had recently been targeted by AI-based cyber campaigns.
