Russia stepping up hybrid attacks, preparing for long standoff with West, Dutch intelligence warns

Russia’s intensifying cyberattacks, sabotage and covert influence operations across Europe show the Kremlin is preparing for a prolonged confrontation with the West, Dutch intelligence agencies said in a report published this week.

In a joint assessment by the General Intelligence and Security Service (AIVD) and the Military Intelligence and Security Service (MIVD), the Dutch agencies warned that while a direct military clash between Russia and NATO remains unlikely, it is no longer unthinkable.

“Russia has not only proven capable of absorbing the substantial losses in Ukraine but has even expanded and reformed its armed forces. Furthermore, the Russian armed forces are preparing for the possibility of a conflict with NATO and are carrying out various activities to test the West’s willingness to escalate,” the report said.

The most immediate danger, according to Dutch intelligence, lies in what it calls Russia’s “hybrid” campaign — a mix of cyberattacks, sabotage, disinformation, covert political influence and espionage designed to stay below the threshold of open war.

Since late 2023, Europe has seen a sharp rise in such activity, the agencies said. Similar observations have been made by other NATO allies and the president of the European Commission, who last October told the European Parliament: “It is time to call it by its name. This is hybrid warfare, and we have to take it very seriously.”

The goal of these activities is to undermine public trust, sow fear and division, weaken support for Ukraine and test Western red lines, all while avoiding a direct military response, said the Dutch services.

Speaking in Munich last week, NATO’s deputy secretary general called for the alliance to “impose costs on those seeking harm,” although the practical and operational realities of efforts to impose costs remain unclear.

The Dutch agencies said Russian risk tolerance has increased since 2024, with the Kremlin showing greater willingness to accept physical damage and even casualties. They warn the threat is likely to continue in waves of escalation and de-escalation, and could become more impactful as Russia gains experience and technical capability.

The Netherlands itself has been targeted, the report noted, with the Russians laying the groundwork for sabotage and carrying out cyber operations against public institutions and critical infrastructure.

Below threshold of war

A wide range of activities attributed to Russia or Russian-linked actors are detailed in the report, from disinformation campaigns across social and traditional media, covert efforts to influence European politicians, vandalism and symbolic provocations, arson attacks, and attempts to disrupt logistics supporting Ukraine.

In the cyber domain, Dutch authorities have seen attacks ranging from distributed denial-of-service assaults on political and public-sector websites to espionage operations that stole sensitive data from police and government systems. In one case, hackers linked to Russia accessed the control system of a public fountain in a Dutch city, an incident the agencies say illustrates how intrusions can be used to probe for future sabotage.

There have been responses to this hybrid activity. Last year, the Dutch services exposed a new Russian hacking group they called Laundry Bear that was uncovered following “an opportunistic cyber attack on the Dutch police in September 2024” that involved police officers’ work-related contact details being stolen.

The Kremlin continues to adapt its tactics despite these public attributions, ongoing sanctions efforts and material support for Ukraine.

The expulsion of hundreds of Russian intelligence officers from Europe following the 2022 invasion has seen Moscow increasingly rely on “low-level” agents — often recruited online, sometimes with criminal backgrounds, and in many cases unaware they are working for Russia. That approach increases deniability but also raises the risk of mistakes and exposure, the report said.

The intelligence services also addressed a string of incidents involving damaged undersea cables in the Baltic Sea and drone sightings near sensitive sites.

While some cases involved ships with Russian links, investigators said many of the cable breaks were likely caused by anchors dragging or heavy maritime traffic, not by proven sabotage — aligning with officials from several European countries who previously told Recorded Future News there is increasing confidence among their governments the incidents were accidental and not directed by the Kremlin.

But the report warned Russia is actively mapping seabed infrastructure and conducting maritime espionage, knowledge that could later be used for sabotage. The chief of Norway’s domestic security agency warned earlier this month that Russian crews on so-called “shadow fleet” vessels pose a security risk as they transited through European waters.

The Dutch agencies’ assessment said the Kremlin frames the conflict as a civilizational struggle between a “decadent” West and a “unique” Russian civilization, a narrative it described as tied to zero-sum thinking and regime survival. Domestically, support for the war is bolstered by repression, and Russian leaders are already concerned about the social and economic strains of a postwar period, including reintegrating large numbers of veterans.

The report also noted that Russia revised its public nuclear doctrine in 2024, effectively lowering the threshold for nuclear use to strengthen deterrence — a move Dutch intelligence described as an escalatory signal in the broader standoff with the West.

Dutch officials said the findings underline the need for stronger resilience across government, business and critical sectors. Disruption of vital services, the report warned, could seriously destabilize society even without open warfare.

Because the confrontation is asymmetric — pitting democratic systems against an adversary that operates by different rules — the intelligence services called for closer national and international cooperation, including with private-sector partners.

“Regardless of how the war in Ukraine ends, Russia is likely to remain a long-term threat,” the report concluded, urging European countries to prepare not only for military risks but for sustained pressure in cyberspace, politics and daily life.