Publications Archive - Hybrid CoE - The European Centre of Excellence for Countering Hybrid Threats

Photo: JRC

October 23, 2026

Defending Europe against hybrid warfare

by Julien Theron, Aleksi Aho, Jukka Savolainen, Frederic Petit, Alessandra de Angelis, Georgios Valsamos

Defending Europe against hybrid warfare is the outcome of joint efforts by the Joint Research Centre (JRC) and Hybrid CoE.

In an increasingly complex and challenging security environment, the escalation of hybrid threats into hybrid warfare poses a growing risk to European democracies. In this context, reliance solely on resilience is insufficient, and an effective deterrence scheme is necessary.

This study undertakes an in-depth examination of the European security environment’s structural transformation, revealing novel requirements for enhanced resilience and presenting conceptual opportunities for deterrence against hybrid threats. Furthermore, it presents a Resilience-Deterrence strategy (RD strategy) that combines proactive, active and reactive approaches.

While this study primarily focuses on the strategic level, it also proposes operational measures for resilience and countermeasures for deterrence, thereby offering a holistic framework for implementation.

Read the Executive summary (pdf) here.

Photo: ercan senkaya / shutterstock.com

October 15, 2026

Artificial intelligence in hybrid threat operations: How AI empowers the existing adversarial playbook

by Tinna Þuríður Sigurðardóttir (Central Bank of Iceland), Martin Cvetko (NATO CCDCOE)

In recent years artificial intelligence (AI) has become integrated into people’s daily lives. The technology has improved rapidly, while regulations have failed to keep pace.

This Hybrid CoE Strategic Analysis examines how artificial intelligence affects the hybrid threat landscape through three capability clusters: shaping societal perception (generate and amplify); penetrating digital systems (probe and exploit); and directing effort (sense and target).

The analysis demonstrates that AI not only adds tools to hybrid threat operations but structurally alters existing threats.

Photo: Finnish Border Guard / Police of Finland

September 25, 2026

Handbook on maritime hybrid threats, volume II: Contemporary scenarios and legal scans

by Terry Gill, James Kraska, Henrik Ringbom, Valentin Schatz

This Hybrid CoE Paper examines recent developments in maritime hybrid threats through four sets of escalating scenarios and accompanying legal scans. The publication addresses critical undersea infrastructure (CUI) disruptions, drone interference, fishing boat disruption, and shadow fleet operations, analysing how existing international law applies to contemporary challenges in the maritime domain. The legal scans address questions related to jurisdiction, maritime interception operations, self-defence, collective defence, sanctions enforcement, and state responsibility.

The paper highlights the growing importance of common interpretations of international law, coordinated multi-flag operations and shared situational awareness in countering maritime hybrid threat activity and sanctions evasion. The paper concludes that more legal options are available to counter hybrid threat activity in the maritime domain than is commonly assumed.

Photo: Vitalii Vodolazskyi / Shutterstock

September 2, 2026

Western Balkans: Domestic, regional and international trends creating hybrid threat potential

by Martha Turnbull,

The Western Balkans occupy a strategically sensitive position at the intersection of the European Union, NATO and competing external actors.

This Hybrid CoE Trend Report examines four interrelated trends that will shape the Western Balkans over the next three to five years. Drawing on expert consultations and commissioned analysis, the report identifies the following trends:

the risks of partial and uneven EU enlargement;
the expansion of geopolitical competition;
Serbia’s pivotal but uncertain regional trajectory;
and the persistent governance and societal vulnerabilities that enable malign influence.

Although each Western Balkan state has its own political trajectory and resilience profile, the crosscutting vulnerabilities are sufficiently deep for domestic and external actors to seek to exploit them, meeting limited resistance.

The report underlines the need for credible EU integration pathways, reduced critical dependencies, stronger democratic institutions, media freedom, and civil society resilience.

Photo: Massimo Todaro / Shutterstock.com

May 28, 2026

China’s maritime hybrid warfare: How Beijing uses lawfare and civilian entities to amplify military power

by David Song-Pehamberger, Sanni Klein

For years, China has used its navy, coast guard, and maritime militia across the South China Sea, the Taiwan Strait, and the East China Sea to assert its claims to sovereignty over disputed territories. This Hybrid CoE Paper analyzes how China uses these military, paramilitary, and pseudo-civilian entities within the legal grey zone for hybrid threat purposes, projecting power below the threshold of war.

The paper argues that by using its so-called three navies to exploit the grey zone between war and peace, China engages in lawfare, ensuring that its provocations remain below the threshold of armed conflict.

The paper concludes that it is crucial for democracies to understand how Beijing exploits international norms to achieve a strategic advantage over its adversaries. Countermeasures should include officially recognizing the military nature of China’s ostensibly civilian coast guard and maritime militia.

Photo: Fanni_2021 / Shutterstock.com

April 16, 2026

Belarus as a hybrid threat actor: A Russian proxy with residual agency

by Anaïs Marin

This Hybrid CoE Paper analyzes Belarus as a hybrid threat actor in the context of Russia’s war against Ukraine and the broader confrontation between Russia and the democratic world. It examines how Alexander Lukashenka’s regime employs hybrid threats as a tool of regime survival, combining repression at home with hostile activities directed at neighbouring EU and NATO states.

The paper argues that while Belarus currently acts as a Kremlin proxy and co-aggressor, it is not merely a passive instrument of Russian strategy. Rather, the paper shows that Belarus retains residual agency and at times mobilizes hybrid threats autonomously in pursuit of its own strategic objectives. These include regime consolidation through the repression of dissent, including the transnational repression of exiled opponents, and regime legitimation vis-à-vis external actors.

The paper concludes that understanding Belarus’s distinct role on the hybrid threat battlefield is essential for assessing risks on NATO’s eastern flank and for designing effective responses to hybrid threats emanating from Russia’s closest ally.

Photo: Master1305 / Shutterstock.com

March 31, 2026

Artificial Intelligence and Foreign Information Manipulation: Chinese and Russian approaches

by Heidi Hanhijärvi

Rapid advances in artificial intelligence (AI) are reshaping how state actors conduct foreign information manipulation. This Hybrid CoE Paper examines how China and Russia integrate AI into their information manipulation strategies, national capability development and operational practices.

The paper shows that China’s advanced domestic AI ecosystem enables state linked actors to use AI tools for tailored content generation, large scale monitoring and targeting foreign audiences. Russia, by contrast, has more limited national AI capabilities but relies extensively on widely available tools to enhance and amplify established information manipulation tactics. The analysis highlights that both countries use AI primarily to augment rather than replace existing approaches, while emerging developments, including agentic AI, may further increase the scale and adaptability of information manipulation.

The paper concludes by outlining policy implications for the Euro Atlantic community, emphasizing cross sectoral cooperation and improved capacity to counter AI enabled hybrid influence activities.

Photo: Popartic / Shutterstock.com

March 3, 2026

MENA: Four political trends shaping the hybrid threat landscape

by Maxime Lebrun

This Hybrid CoE Trend Report provides a comprehensive analysis of political trends related to hybrid threats in the Middle East and North Africa (MENA) region, examining their implications for regional stability and global security. The Report identifies four crosscutting trends shaping the region:

the widening gap between regimes and societies;
escalating tensions between Iran and Israel (up to August 2025);
intensifying strategic competition for resources and influence;
and the erosion of international law in the context of the Israel–Palestine conflict.

Drawing on expert insights and case studies, it highlights aspects essential to understanding and anticipating potential developments and underscores the growing strategic importance of the MENA region for Europe and the Euro-Atlantic community.

The analysis covers developments up to August 2025.

Photo: Andrei Stepanov / Shutterstock.com

January 21, 2026

Bracing for a cold front: Assessing Russian and Chinese strategic objectives and hybrid threat capabilities in the Arctic

by Johan Schalin, Sophie Arts

The Arctic region is transforming as receding sea ice and technological progress create new access and vulnerabilities. Simultaneously, Russia and China are developing additional capabilities to support their Arctic operations and presence and advance their hybrid threat tools.

This Hybrid CoE Paper presents Russia’s and China’s long-term objectives in the Arctic, assessing how their capability, technology and infrastructure development, as well as broader civil-military cooperation, create the potential for future hybrid threats. The paper focuses primarily on civilian and multipurpose capabilities that support situational awareness, navigation and other activity in maritime and coastal environments.

A key thesis of the paper is that beyond their potential for physical operations or military use Russia’s and China’s evolving capabilities can be leveraged to establish an advantage or dominance in information, logistics, communications and data flows in the Arctic, and to create socioeconomic dependencies. The paper calls for cooperation and coordination between affected democratic countries, and cooperation with Indigenous and other local stakeholders.

Photo: StockSmartStart / Shutterstock.com

December 18, 2025

Handbook on the role of non-state actors in Russian hybrid threats

by Eginhards Volāns, Vladimir Rauta, Magda Long, Andis Kudors, Agata Kleczkowska, Eliza Lockhart

Russia’s employment of non-state actors is a staple of its approach to hybrid threat operations, whether through attacks on German military and industrial facilities by individuals, sabotage of French rail infrastructure by loosely co-ordinated groups, disinformation campaigns run by private companies, or cyber operations by hacktivist collectives.

This handbook provides an overarching assessment of Russia’s approach to working with and through various NSAs across different operational domains, mapping both the empirical depth and breadth of the phenomenon. It establishes a much-needed baseline for understanding the logic behind Russia’s use of NSAs and lays the groundwork for determining appropriate measures and countermeasures at a time when operations below and above the threshold of war are on the rise.

Organization (Hybrid CoE)

News

Jarmo Lindberg re-elected Chair of Hybrid CoE’s Steering Board

Hybrid CoE Paper examines legal responses for countering maritime hybrid threats

Defending Europe against hybrid warfare

How can Europe counter hybrid warfare? A new report calls for a unified EU response

Cyber hybrid course explores scenarios, responses and insights from Ukraine

Artificial intelligence in hybrid threat operations: How AI empowers the existing adversarial playbook

Unpacking Chinese, Russian and Iranian approaches to disinformation

The Arctic: A critical operational theatre for hybrid threats

Handbook on maritime hybrid threats, volume II: Contemporary scenarios and legal scans

Hybrid threat wargaming builds resilience against the unexpected

Hybrid CoE hosts third biannual meeting for Points of Contact

Building Europe’s cyber expertise with EU-iNSPIRE

Western Balkans: Domestic, regional and international trends creating hybrid threat potential

Government perspective: How to protect elections from foreign interference

Spring Steering Board meeting brings Participating States together in Vienna

China’s maritime hybrid warfare: How Beijing uses lawfare and civilian entities to amplify military power

Join the Hybrid CoE network