Hybrid Warfare (RUSI Falsification)

As of 18 October 2026. With ten and a half weeks of the forecast year left, the campaign runs on at a tempo officials call rising. Attribution trails it by days or weeks, and a verdict by years. In May the head of GCHQ said Russia was scaling up its daily hybrid activity against Britain and Europe, and on 31 August NATO's deputy secretary general said it was getting worse. The counts point both ways: Leiden University recorded 69 Russian operations against Europe in 2024 and 40 in 2025.

Poland named Russian intelligence within days of the railway sabotage of November 2025. Germany named Russia on 1 September for an attempted attack with an explosive drone at Leipzig/Halle airport four weeks earlier and closed the Russian consulate general in Bonn. Estonia took six weeks to blame Russian security services for an arson attack on a defence firm in Tallinn. Bulgaria, after drones sank a merchant ship in its economic zone on 13 October, calls Russian authorship logical and the evidence inconclusive. Courts come last. In Warsaw four men went on trial on 12 October for a series of arson attacks on Russian orders, among them the fire that destroyed the Marywilska 44 shopping centre in May 2024. The forecast year closes on 31 December.

Hybrid pressure works on the way governments decide. A severed cable, an arson attack on a depot or a drone over an airport is one incident for the analyst who attributes it. For a coalition it opens a chain of questions: who did it, how sure are we, what answer is proportionate and who bears the cost. The forecast read sabotage as the move of a desperate Russia. RUSI’s Calvin Bailey had written two weeks earlier that grey-zone activity “is war itself”. A RUSI paper of January 2026 found that states on NATO’s eastern flank attribute sabotage to Russia faster and more explicitly than many in Western Europe. Each declared red line then becomes an argument at home about proportion, risk and legitimacy, which the study calls the public rehearsal of hesitation.

The study measures that load in five gauges: the time from trigger to binding decision, the number of actors who can block it, announcements reversed within weeks, open dispute inside coalitions, and money and staff moved from strategy to protection. Germany is its example. With the AfD polling in the mid-twenties in late 2025, beside steady shares for the Left and the BSW, coalition arithmetic narrows. Outside pressure then has only to raise the cost of governing.

Forecast and study agree on one effect: pressure makes governments move money and staff from strategy, and from support for Ukraine, to protection at home. It lands on concrete places, a defence firm's vehicles in Tallinn, an airport near Leipzig, a shopping centre in Warsaw where 1,400 businesses burned, and on the services that must protect, investigate and answer. Where the two part is time. A danger dated to 2026 prepares governments for a turning point, which can seem to have passed once the year is out. The study treats the load as present and puts its gauges inside government, in the delay before a decision binds and in the reversals that follow.

If 2026 ends without the turning point the forecast named, which governments will read that as relief, and which as a warning?

European governments attribute the campaign to Russia’s services and answer it nationally. Romania expelled a Russian diplomat in July after repeated drone incursions. The recruits are found on encrypted apps and paid in cryptocurrency, a RUSI paper of January 2026 records. NATO guards undersea cables under Baltic Sentry and the eastern flank under Eastern Sentry. On 8 October the EU extended its sanctions for Russian destabilisation, which now name 80 people and 20 entities.

RUSI stands on both sides of the case, as publisher of the forecast and of the evidence against it. The war sets the frame. Talks brokered by Washington broke off when the war with Iran began, a round in Miami on 9 October ended after one day, and the Kremlin rejected a 60-day ceasefire on 12 October. In Hungary, where the forecast expected subversion around the April election, DURCHD8’s NATO study records Russian operations against the vote, from a planned fake attempt on Orbán’s life to a network of automated accounts. Both failed to prevent his defeat, and Tisza took 141 of 199 seats.

Hybrid Warfare Is Already Working appeared on 22 December 2025, three days after the forecast. The method is internal. The study breaks the commentary into five claims, from a Russia turning to hybrid tools because it is losing to a gap in deterrence below Article 5, and tests each only against RUSI’s own earlier work. On 4 December Calvin Bailey had described a Europe already in conflict, “present and continuous”. Eerik Kross and Greg Mills traced the method back to Lenin’s “state of partial war”. Matt Ince relayed the count of incidents since 2014. V-Dem indicators and INSA’s German polls serve only to fix the order of events.

The study left a test for the year it disputed. A real change of phase, it wrote, would show in four signs: attacks spreading to targets left alone before, new combinations of tools across domains that change how attribution works, operations timed to elections and treaty votes as a rhythm, and signals that make a higher rung of escalation normal. None met the threshold when it was written. It makes no claim about Russia’s intentions and leaves future tempo open. Its reading of decisions has since carried into DURCHD8’s studies of Ivashov and of Russia’s information domain.

Every incident of 2026 can be held against the four signs, and the result will show whether the year brought a new phase or the same campaign at a faster pace.