Countering Hybrid Threats

Hybrid threats usually refer to coordinated harmful activities that are planned and carried out with malign intent. They aim to undermine a state or an institution, through a variety of means, often combined.

In the EU, we have seen an increasing number of hybrid activities including cyber-attacks, foreign information manipulation and interference campaigns, acts of sabotage, incendiary devices in aircraft, damage to undersea infrastructure, airspace violations, assassination attempts, and the weaponisation of migration.

These activities belong to a broader pattern of Russia’s increasingly aggressive behaviour. However, Russia is not the only ‘hybrid actor’. We see similar techniques used against the EU, Member States and our partners also by others.

Hybrid campaigns are designed in a way that makes detecting and defending against them difficult. They are devised to remain below the threshold which could constitute or be perceived as an act of war.

Being able to deter these threats and to respond to them is essential, as they actively seek to undermine our institutions and to destabilise our democracies.

As part of the EU response: 

• We established an EU Hybrid Toolbox which allows us to expose, attribute and sanction the perpetrators;
• We also have a new dedicated Russia hybrid sanctions regime;
• We have developed a new tool – the EU Hybrid Rapid Response Teams - to help Member States and partners tackle hybrid activities. 

The EU ‘hybrid toolbox’ is an overarching framework, which comprises preventive, cooperative, stability-building, restrictive and support measures against hybrid threats, as set out in the Council conclusions on a framework for a coordinated EU response to hybrid campaigns.

What is the purpose of the EU 'hybrid toolbox'?

• To help identify complex and multifaceted hybrid campaigns;
• Coordinate responses that are tailor-made and cross-sectoral.

This ‘toolbox’ brings in other relevant response mechanisms and instruments, such as the foreign information manipulation and interference (FIMI) toolbox and Cyber Diplomacy toolboxes.

The use of hybrid threats and campaigns by Russia against the EU has intensified since Russia's full-scale invasion of Ukraine. This includes acts of sabotage, disruption of critical infrastructure, cyber-attacks, information manipulation and interference, attempts to undermine democracy and the electoral process on European ground.

These malicious activities are part of a broad and coordinated hybrid campaign to destabilise and weaken the EU and its Member States and to undermine the EU’s support for Ukraine. They illustrate Russia’s reckless and irresponsible behaviour and its disregard for international law and the rules-based international order.

The EU is responding to this threat with measures in different domains, including a dedicated sanctions framework against Russia’s destabilising activities. Sanctioned activities include:

• undermining electoral processes and democratic institutions
• threats against and sabotage of economic activities, services of public interest or critical infrastructure
• using coordinated disinformation, foreign information manipulation and interference (FIMI)
• malicious cyber activities
• instrumentalising the movement of migrants

The EU’s strategic approach towards Russia’s hybrid threats is structured around four lines of actions:

1. Situational awareness:  a better common understanding of the threat is the basis for informed decision-making and for an EU response that is adapted to the evolution of the threat; 
2. Deterrence by denial: strengthening European resilience across all sectors as well as reinforcing our societal resilience will reduce vulnerabilities, limit Russia’s ability to cause harm and increase overall preparedness; 
3. Deterrence by cost imposition: effective deterrence relies on the capacity to respond by increasing the costs for Russia for engaging in malicious activity;
4. Cooperation with partners: close coordination and joint action with partners contributes to amplifying the impact of the measures taken to counter Russia’s hybrid threats. Supporting partners who are most exposed to hybrid threats further contributes to mutual resilience.

The High Representative has issued two statements on behalf of the EU, condemning Russia’s persistent hybrid campaigns (October 2024 and July 2025) with the EU leaders doing the same at several European Council meetings (see July 2025).

The EU’s hybrid rapid response teams support member states, partner countries, CSDP missions and operations with countering hybrid threats.

The EU has mobilised the teams for first time in support of Moldova to enhance its resilience against hybrid threats ahead of the parliamentary elections of September 2025.

In a deteriorating security environment, with increasing disinformation, cyber-attacks, attacks on critical infrastructure, instrumentalised migration and election interference by malign actors, the Hybrid Rapid Response Teams are one of the most important instruments in the EU’s hybrid toolbox. The Council approved the guiding framework for the practical establishment of EU hybrid rapid response teams in May 2024.

At a time where hybrid threats don’t know borders, working together with EU partners and organisations is key to countering them.

The EU-NATO strategic partnership and initiatives are crucial for this and include parallel and coordinated exercises (PACE) for crisis management scenarios, structured dialogues, staff talks and common proposals for cooperation related to hybrid threats.

Security and Defence Partnerships between the EU and ten partner countries include hybrid threats and cyber issues as areas of cooperation.

The EU is committed to supporting its partners with countering hybrid threats. The EU Partnership Mission in the Republic of Moldova (EUPM Moldova) is a prime example of such cooperation. The mission was launched in May 2023 to help strengthen Moldova’s crisis management structures and assist in enhancing its resilience to hybrid threats and its cybersecurity.