Publications Archive - Hybrid CoE - The European Centre of Excellence for Countering Hybrid Threats

Photo: Finnish Border Guard / Police of Finland

September 25, 2026

Handbook on maritime hybrid threats, volume II: Contemporary scenarios and legal scans

by Henrik Ringblom, James Kraska, Jukka Savolainen, Stylianos Tzimis, Terry Gill, Valentin Schatz

This Hybrid CoE Paper examines recent developments in maritime hybrid threats through four sets of escalating scenarios and accompanying legal scans. The publication addresses critical undersea infrastructure (CUI) disruptions, drone interference, fishing boat disruption, and shadow fleet operations, analysing how existing international law applies to contemporary challenges in the maritime domain. The legal scans address questions related to jurisdiction, maritime interception operations, self-defence, collective defence, sanctions enforcement, and state responsibility.

The paper highlights the growing importance of common interpretations of international law, coordinated multi-flag operations and shared situational awareness in countering maritime hybrid threat activity and sanctions evasion. The paper concludes that more legal options are available to counter hybrid threat activity in the maritime domain than is commonly assumed.

Photo: Vitalii Vodolazskyi / Shutterstock

September 2, 2026

Western Balkans: Domestic, regional and international trends creating hybrid threat potential

The Western Balkans occupy a strategically sensitive position at the intersection of the European Union, NATO and competing external actors.

This Hybrid CoE Trend Report examines four interrelated trends that will shape the Western Balkans over the next three to five years. Drawing on expert consultations and commissioned analysis, the report identifies the following trends:

the risks of partial and uneven EU enlargement;
the expansion of geopolitical competition;
Serbia’s pivotal but uncertain regional trajectory;
and the persistent governance and societal vulnerabilities that enable malign influence.

Although each Western Balkan state has its own political trajectory and resilience profile, the crosscutting vulnerabilities are sufficiently deep for domestic and external actors to seek to exploit them, meeting limited resistance.

The report underlines the need for credible EU integration pathways, reduced critical dependencies, stronger democratic institutions, media freedom, and civil society resilience.

Photo: Massimo Todaro / Shutterstock.com

May 28, 2026

China’s maritime hybrid warfare: How Beijing uses lawfare and civilian entities to amplify military power

by David Song-Pehamberger, Sanni Klein

For years, China has used its navy, coast guard, and maritime militia across the South China Sea, the Taiwan Strait, and the East China Sea to assert its claims to sovereignty over disputed territories. This Hybrid CoE Paper analyzes how China uses these military, paramilitary, and pseudo-civilian entities within the legal grey zone for hybrid threat purposes, projecting power below the threshold of war.

The paper argues that by using its so-called three navies to exploit the grey zone between war and peace, China engages in lawfare, ensuring that its provocations remain below the threshold of armed conflict.

The paper concludes that it is crucial for democracies to understand how Beijing exploits international norms to achieve a strategic advantage over its adversaries. Countermeasures should include officially recognizing the military nature of China’s ostensibly civilian coast guard and maritime militia.

Photo: Fanni_2021 / Shutterstock.com

April 16, 2026

Belarus as a hybrid threat actor: A Russian proxy with residual agency

by Anaïs Marin

This Hybrid CoE Paper analyzes Belarus as a hybrid threat actor in the context of Russia’s war against Ukraine and the broader confrontation between Russia and the democratic world. It examines how Alexander Lukashenka’s regime employs hybrid threats as a tool of regime survival, combining repression at home with hostile activities directed at neighbouring EU and NATO states.

The paper argues that while Belarus currently acts as a Kremlin proxy and co-aggressor, it is not merely a passive instrument of Russian strategy. Rather, the paper shows that Belarus retains residual agency and at times mobilizes hybrid threats autonomously in pursuit of its own strategic objectives. These include regime consolidation through the repression of dissent, including the transnational repression of exiled opponents, and regime legitimation vis-à-vis external actors.

The paper concludes that understanding Belarus’s distinct role on the hybrid threat battlefield is essential for assessing risks on NATO’s eastern flank and for designing effective responses to hybrid threats emanating from Russia’s closest ally.

Photo: Master1305 / Shutterstock.com

March 31, 2026

Artificial Intelligence and Foreign Information Manipulation: Chinese and Russian approaches

by Heidi Hanhijärvi

Rapid advances in artificial intelligence (AI) are reshaping how state actors conduct foreign information manipulation. This Hybrid CoE Paper examines how China and Russia integrate AI into their information manipulation strategies, national capability development and operational practices.

The paper shows that China’s advanced domestic AI ecosystem enables state linked actors to use AI tools for tailored content generation, large scale monitoring and targeting foreign audiences. Russia, by contrast, has more limited national AI capabilities but relies extensively on widely available tools to enhance and amplify established information manipulation tactics. The analysis highlights that both countries use AI primarily to augment rather than replace existing approaches, while emerging developments, including agentic AI, may further increase the scale and adaptability of information manipulation.

The paper concludes by outlining policy implications for the Euro Atlantic community, emphasizing cross sectoral cooperation and improved capacity to counter AI enabled hybrid influence activities.

Photo: Popartic / Shutterstock.com

March 3, 2026

MENA: Four political trends shaping the hybrid threat landscape

by Maxime Lebrun

This Hybrid CoE Trend Report provides a comprehensive analysis of political trends related to hybrid threats in the Middle East and North Africa (MENA) region, examining their implications for regional stability and global security. The Report identifies four crosscutting trends shaping the region:

the widening gap between regimes and societies;
escalating tensions between Iran and Israel (up to August 2025);
intensifying strategic competition for resources and influence;
and the erosion of international law in the context of the Israel–Palestine conflict.

Drawing on expert insights and case studies, it highlights aspects essential to understanding and anticipating potential developments and underscores the growing strategic importance of the MENA region for Europe and the Euro-Atlantic community.

The analysis covers developments up to August 2025.

Photo: Andrei Stepanov / Shutterstock.com

January 21, 2026

Bracing for a cold front: Assessing Russian and Chinese strategic objectives and hybrid threat capabilities in the Arctic

by Johan Schalin, Sophie Arts

The Arctic region is transforming as receding sea ice and technological progress create new access and vulnerabilities. Simultaneously, Russia and China are developing additional capabilities to support their Arctic operations and presence and advance their hybrid threat tools.

This Hybrid CoE Paper presents Russia’s and China’s long-term objectives in the Arctic, assessing how their capability, technology and infrastructure development, as well as broader civil-military cooperation, create the potential for future hybrid threats. The paper focuses primarily on civilian and multipurpose capabilities that support situational awareness, navigation and other activity in maritime and coastal environments.

A key thesis of the paper is that beyond their potential for physical operations or military use Russia’s and China’s evolving capabilities can be leveraged to establish an advantage or dominance in information, logistics, communications and data flows in the Arctic, and to create socioeconomic dependencies. The paper calls for cooperation and coordination between affected democratic countries, and cooperation with Indigenous and other local stakeholders.

Photo: StockSmartStart / Shutterstock.com

December 18, 2025

Handbook on the role of non-state actors in Russian hybrid threats

by Eginhards Volāns, Vladimir Rauta, Magda Long, Andis Kudors, Agata Kleczkowska, Eliza Lockhart

Russia’s employment of non-state actors is a staple of its approach to hybrid threat operations, whether through attacks on German military and industrial facilities by individuals, sabotage of French rail infrastructure by loosely co-ordinated groups, disinformation campaigns run by private companies, or cyber operations by hacktivist collectives.

This handbook provides an overarching assessment of Russia’s approach to working with and through various NSAs across different operational domains, mapping both the empirical depth and breadth of the phenomenon. It establishes a much-needed baseline for understanding the logic behind Russia’s use of NSAs and lays the groundwork for determining appropriate measures and countermeasures at a time when operations below and above the threshold of war are on the rise.

Photo: Thomas Nilsen / Barents Observer

December 10, 2025

Hybrid threats in high latitudes: Facing Russia on Svalbard

by Kari Aga Myklebost, Stian Bones, Thomas Nilsen

Russia’s sustained use of hybrid threat tools on Svalbard has become a defining feature of the security environment in the Arctic, where legal ambiguity, historical narratives and grey-zone actions are leveraged to pressure Norway and test Western cohesion.

This Hybrid CoE Paper outlines how Moscow blends information campaigns, coercive signalling at sea, symbolic gestures and surprise visits to challenge Norwegian authority while remaining below the threshold of open conflict. To counter this, the paper recommends a twofold strategy of deterring Russian hybrid threats while building resilience in Norway. This includes investment in enhanced institutional defences, public awareness campaigns, strengthened international cooperation and support for independent editorial-led media to resist information manipulation.

Photo: enciktepstudio / Shutterstock.com

October 2, 2025

Countering disinformation in the Euro-Atlantic: Strengths and gaps

by Jakub Kalenský, Heidi Hanhijärvi

Russia renewed its daily ongoing information aggression in 2013–14 in connection with the Revolution of Dignity and the annexation of Crimea, which generated heightened demand for countermeasures across the Euro-Atlantic. This Hybrid CoE Research Report presents the results of a questionnaire sent to Hybrid CoE’s Participating States, the EU and NATO to map their counter-disinformation tools and policies; and qualitative insights based on the discussions of an annual workshop organized by Hybrid CoE.

While many good counter-disinformation measures are in place across the Euro-Atlantic region, the data from the questionnaires show that many practitioners in EU and NATO countries believe their counter-disinformation work is under-resourced. Moreover, there seems to be a lack of established mechanisms for cooperation between the authorities and the non-governmental sector. While many countries are implementing tools to raise awareness of disinformation, they are doing less to limit or punish the perpetrators.

Hybrid CoE’s qualitative and quantitative analysis shows that a few countries are using innovative tools to counter disinformation, and this could serve as an inspiration for the rest of the community: examples and case studies are included throughout this report.

The Arctic: A critical operational theatre for hybrid threats

Russia

News

The Arctic: A critical operational theatre for hybrid threats

Handbook on maritime hybrid threats, volume II: Contemporary scenarios and legal scans

Hybrid threat wargaming builds resilience against the unexpected

Hybrid CoE hosts third biannual meeting for Points of Contact

Building Europe’s cyber expertise with EU-iNSPIRE

Western Balkans: Domestic, regional and international trends creating hybrid threat potential

Government perspective: How to protect elections from foreign interference

Spring Steering Board meeting brings Participating States together in Vienna

China’s maritime hybrid warfare: How Beijing uses lawfare and civilian entities to amplify military power

Cyber Power Symposium: Our societies are deeply dependent on the digital domain

Belarus as a hybrid threat actor: A Russian proxy with residual agency

Artificial Intelligence and Foreign Information Manipulation: Chinese and Russian approaches

Thomas Schroll starts as Director of the Community of Interest on Strategy and Defence

Katja Kärkkäinen appointed HR Director

MENA: Four political trends shaping the hybrid threat landscape

The United States withdraws from Hybrid CoE

Join the Hybrid CoE network