The usually calm and prosperous countries of Scandinavia today have become the object of hybrid activity on the part of Russia, feeling all the «peacefulness» of Russian foreign policy – from information campaigns to immediate threats to infrastructure and economic security.
Publicly available data and expert reports show that the combination of Russian propaganda, cyber-attacks, and «soft power» tools creates a destructive strategy for influence in northern Europe, which in turn requires systemic opposition.
Northern Europe has always been a region of high social development and trust in public institutions. However, after 2014, and especially after the full-scale invasion of Ukraine, Moscow has strengthened its influence against NB8 countries (Denmark, Iceland, Norway, Finland, Sweden, as well as Estonia, Latvia and Lithuania).
NATO StratCom research and independent analysts document a deliberate campaign to undermine the credibility of democratic institutions, manipulate societal themes, and create vulnerabilities in critical infrastructure. Russian «active activities» are carefully planned campaigns using local narratives – migration, energy, identity and military security issues to divide society and weaken support for Euro-Atlantic integration.
In Sweden and Finland, analysts are recording a shift from piecemeal inputs to systemic information operations aimed at undermining confidence in governments and NATO.
Thus, at the time of the discussion of Finland’s accession to the Alliance, hundreds of synchronized accounts appeared in social networks, spreading remarks about «loss of neutrality» and «dragging the country into a foreign war». In Sweden, proxy media such as NewsFront and Baltnews published material discrediting the Armed Forces and exaggerating crime among migrants to create a sense of social instability and state inefficiency.
In addition to direct disinformation, the techniques of «content reflection» are actively used. So-called «mirror accounts» are created, that is, pages imitating local news resources or public initiatives, but promoting pro-Russian narratives.
For example, in 2024 NATO StratCom researchers identified a network of more than 200 profiles masquerading as Swedish and Finnish journalists who systematically published on «corruption» in defence procurement and «militarization dangers».
Moscow also uses more «soft» channels. Cultural projects, diasporas and religious institutions give the Kremlin a convenient «foothold» to expand its influence, from promoting favorable narratives to creating platforms for forming loyalist communities and carrying out activities promoting theses on «traditional values» and «spiritual community of Slavs». It should be noted that the number of Russian diaspora is quite large, and according to various estimates is about 150 thousand. in the Scandinavian countries and more than 900 thousand. in the Baltic States.
European investigations drew attention to cases where the activities of some ROC parishes raised questions with local intelligence services about funding, connections and their possible use in undercover work. This does not mean that every cultural initiative is a threat, but the synchronization of cultural mechanisms with other instruments of hybrid warfare makes them part of the overall picture of pressure.
The speed of information dissemination and automation of its production opens up new vulnerabilities. Joint audits of Scandinavian fact-checking organizations found that in a number of cases popular chat models in the Nordic languages replicate or do not refute Russian propaganda narratives.
This indicates that propaganda content can be «infiltrated» into learning data sets and then inadvertently reinforced by AI tools. This effect broadens the coverage of narratives without the direct involvement of living operators and requires new rules on data verification for model training.
The shift from information pressure to physical exposure is one of the most disturbing trends. In Norway, in the spring of 2025, law enforcement and intelligence agencies linked a series of cyberattacks with pro-Russian hacking groups. In April, intruders gained access to the control of the dam, opened valves and changed the water mode. The incident was publicly attributed to pro-Russian forces and described as an element of fear and destabilization.
Such operations show that vulnerabilities in industrial automation and weak network segmentation make digital attacks a threat to life and economic stability.
Direct investment and official business relations with Russia have declined because of the sanctions, but this has not diminished its influence.
Journalistic investigations and court cases show that the so-called «shadow fleet» operates in the Baltic Sea. These old tankers, removed from European registries and converted into dummy firms in Dubai, Turkey or Hong Kong, transport Russian oil and petroleum products across the Baltic Sea by deliberately disabling identification systems (AIS) to hide the routes and origin of the cargo.
In 2024-2025, it was established that some of these tankers regularly stop off at the coast of Sweden and Finland, where there are «ship-to-ship» fuel trans-shipments, operations that formally do not violate international law, but actually allow Russia to export energy resources without EU sanctions.
Some vessels are registered under «comfortable» flags – Tanzania, Gabon or Panama – which makes their tracking difficult and makes cargo insurance impossible. The danger lies not only in financial schemes. In October 2023, the Danish and Finnish authorities investigated the damage of the submarine gas pipeline «Balticconnector» and telecommunication cable between Estonia and Finland.
The investigation established that at the time of the incident there was a Russian cargo ship Sevmorput and a Chinese cable installer Newnew Polar Bear, belonging to companies working with Russian logistics structures. Although no direct evidence of sabotage has been presented, experts and security services have recognized that the activity of the «shadow fleet» creates a permanent risk to the underwater infrastructure.
In 2025, similar concerns arose after a series of strange fiber-optic line outages in north-eastern Sweden. The tracks pointed to passing the courthouse without a tracking system. The financial losses from forced stoppages amounted to millions of euros, and cybersecurity experts stressed that physical damage to cables could become part of a hybrid pressure strategy, especially in combination with cyber attacks on energy companies and transport networks.
Thus, the «shadow fleet» has become not just a tool for circumventing sanctions, but also a lever of influence: it undermines the region’s economic security, creates environmental and technical threats, and allows Russia to maintain its presence in waters critical to European logistics.
The combination of information pressure, cyber attacks and economic maneuvers leads to a gradual decline in institutional and social resilience. Society is increasingly concerned about the vulnerability of infrastructure, and political debates are shifting from substantive to polarizing themes.
For countries with an active Russian diaspora, this also means an increase in social pressure, which additionally plays into the hands of external manipulations.
Russia’s destructive influence in the Scandinavian region is a deliberate strategy, combining information operations, cyber-attacks, economic circumvention schemes and exploitation of social institutions. If protection measures are not taken in a timely manner, the vulnerability of northern societies will increase, and thus the cost of counteraction will only increase.
