Europe’s Shadow Campaign: Evaluating the Rise in Covert Hostilities Linked to Russia

Western capitals are reporting a noticeable uptick in hostile activities-ranging from targeted sabotage and cyberattacks to disinformation and suspected covert operations-that officials increasingly attribute to Moscow. The pattern has prompted a blunt strategic question among policymakers and analysts: are these cumulative actions amounting to an undeclared conflict?

In recent months a series of disruptive incidents with economic and political consequences has amplified concerns that a coordinated strategy is being used to weaken allies while avoiding a conventional war declaration. NATO and EU member states have answered with sharper public attributions, stepped-up defensive deployments and deeper investigative cooperation. Moscow routinely rejects responsibility for many of the operations that Western governments point to.

Recognizing the Pattern: Repeated, Denied, and Calibrated

Security observers describe the activity as deliberate pressure applied across multiple domains-physical, digital and informational-designed to stay below a formal threshold of armed conflict yet steadily degrade resilience and influence political outcomes. Rather than a single dramatic episode, the campaign resembles a long-term erosion strategy: multiple, carefully calibrated blows intended to impose cost without precipitating an overt military confrontation.

Open-source briefings and allied situation reports have cataloged representative incidents that illustrate the diversity and reach of the campaign:

Analysts caution that the near-simultaneous nature of some events, combined with persistent denial, suggests an intent to maintain ambiguity-forcing rivals to choose between inaction and escalation. To break that ambiguity, many experts emphasize rapid, synchronized intelligence processing and public attribution.

Hardening the Grid: Cyber and Information Operations Target Critical Infrastructure

Across Europe, cyber and influence campaigns have increasingly aimed at energy systems, freight corridors and logistics hubs. Security agencies have noted a pattern of reconnaissance probes followed by targeted intrusions timed to political flashpoints. Industry reports and national CERTs have documented a rise in attempts to disrupt electricity distribution, port operations and rail signaling systems-moves that threaten cascading economic and humanitarian effects if sustained.

Veteran incident commanders and policy specialists are urging three near-term priorities to blunt these attacks and raise the political cost of continued pressure:

• Regular national incident response exercises: Quarterly drills simulating simultaneous outages across power and transport networks to test coordination and surge capacity;
• Mandatory resilience standards for critical nodes: Enforced separation of operational technology from business networks, resilient backups and proven fallback power systems;
• Multinational cyber-defense agreements: Standing protocols for rapid cross-border intelligence sharing, collaborative attribution and joint technical countermeasures.

European cybersecurity agencies, including national CERTs and regional bodies, have reported a sustained rise in targeted intrusions against critical sectors since 2022-2023, underscoring the urgency of coordinated defenses.

Deterrence and Rapid Response: NATO Intelligence Fusion and Missile Defense Deployments

Given the multi-domain character of the campaign, military planners and policymakers are urging measures that combine deterrence with rapid operational reach. Two recurrent recommendations are prioritized in allied discussions: robust NATO intelligence fusion to link signals, human reporting and cyber telemetry in near-real time, and accelerated placement of air and missile defense deployments in vulnerable regions to deny exploitable tactical advantages.

Other practical actions being proposed include:

• Forward-deployed, mobile air-defense batteries and pre-authorized reinforcement plans to shorten response times;
• Cross-border liaison teams that embed at critical ports and energy hubs to coordinate protection and incident response;
• Unified public-attribution protocols so allies can collectively name responsible actors and impose synchronized consequences.

Think of the response as converting a fragmented set of local snapshots into a single live mosaic so decision-makers can see intent and respond proportionately-rather than reacting to each isolated incident in turn.

Legal and Diplomatic Tools: Defining Aggression Below the Threshold

Ambiguity in both law and practice complicates allied action. Cyberattacks, deniable strikes and proxy operations often fall into a legal gray area that was not designed to manage sustained coercive campaigns carried out short of declared war. To put such campaigns into a workable framework, experts propose aligning three pillars:

• Calibrated military deterrence: Visible defensive measures and contingency plans that raise the price of further coercion without creating an uncontrollable spiral;
• Targeted economic pressure: Synchronized sanctions aimed at finance, energy links and supply chains that underpin the adversary’s operational capacity;
• International recognition mechanisms: A multilateral process that can characterize prolonged coercion as equivalent to armed aggression for the purpose of collective responses under international law.

Operationalizing that alignment will require NATO, the EU and allied judicial bodies to agree on definitions, thresholds and cooperative enforcement-a politically sensitive process. Proposed practical steps include pre-agreed escalation ladders, unified attribution timelines and an international legal instrument or mandate that can adjudicate cross-border harms without waiting for a conventional declaration of war.

What Allies Must Decide Now

Whether the accumulation of covert acts will be treated as an undeclared war depends on more than intent or destructive effect: it depends on allied political will to classify and confront a protracted, multi-domain pressure campaign. Choices made in the coming months-deeper intelligence integration, forward defenses, collective attribution and calibrated sanctions-will shape European security for years.

If left unchecked, the pattern risks becoming a template for limited coercion that steadily undermines alliance cohesion and civilian resilience. If addressed decisively, it can be contained and deterred. Either way, Europe now faces a test of institutional agility: can governments move faster than the attackers who are deliberately exploiting seams between diplomacy, law and military response?