This week ended with several European countries announcing that Russia had either carried out or attempted to carry out hacker attacks on critical EU state infrastructure. The statement from the EU’s High Representative for Foreign Affairs, Kaja Kallas, on July 18, 2025, sounded the alarm: Russia is systematically attacking Europe—across cyberspace, the information domain, politics, and infrastructure. And indeed, these attacks are no longer isolated incidents; they are elements of a long-term Kremlin strategy aimed at destabilizing democratic societies and dismantling the unity of the EU.
This includes deliberate election interference, spreading disinformation, bribing politicians, hacking government and private servers, sabotaging energy infrastructure—and all of this is taking place while Europe is trying to maintain unity in the face of Russian aggression.
Russia’s actions are broad and multifaceted. For example, in 2024–2025, French intelligence documented attempts to influence the presidential campaign: Russian agents spread fake videos and AI-generated content discrediting specific candidates. And this didn’t just happen in France—it occurred across Europe. The Kremlin’s support for far-right and Eurosceptic movements has become routine, part of a systematic effort since 2014 to invest in political forces aimed at dividing the EU.
In addition, Russia actively exploits migration and humanitarian crises as tools of pressure. Examples include hybrid provocations at the Polish-Belarusian border and disinformation campaigns about the “forced conscription” of refugees or alleged discrimination against Russian-speaking populations in the Baltic states. These are all part of the same destabilization playbook. The objective is simple: the Kremlin seeks to create controllable pressure points within the EU and its member states by supporting separatism, religious radicals, and anti-immigrant movements—different facets of a single strategy.
Clearly, such wide-scale operations do not happen spontaneously, nor are they the work of some abstract “Moscow” or “Kremlin.” There are specific state-level structures that generate and support these efforts: the Foreign Intelligence Service (SVR), the Main Intelligence Directorate (GRU), and the Federal Security Service (FSB). These agencies have honed their ability to carry out such “delicate” and critical missions over many years—especially in Russia, a country with deep historical roots in using intelligence services as integral parts of statecraft.
According to the EU, the recent cyberattacks in the Czech Republic and Germany were carried out by the APT28/Fancy Bear group—one of the most notorious hacker groups linked to Russian military intelligence (GRU). These attacks were aimed not just at stealing data but at undermining trust in government institutions, discrediting democratic processes, and increasing political polarization within EU countries. APT28 is responsible for the hacks of Germany’s Bundestag (2015, 2020), the Czech Parliament (2023), Norway’s Foreign Ministry (2022), and the 2017 campaign of Emmanuel Macron. More recently, APT28 targeted the email infrastructure of members of the European Parliament, attempting to access documents related to sanctions against Russia. This same group was behind election interference in the U.S., France, and Germany, the hacking of World Anti-Doping Agency (WADA) databases, and the dissemination of forged documents.
In the past two years alone, EU officials have recorded over 50 major incidents directly linked to Russian hacker groups. In 2022, an attack on French research centers disabled more than 30 servers involved in energy and AI development. In 2023, the document exchange system between the German and Dutch ministries was breached. In 2024, personal data of defense industry employees in Poland and the Czech Republic was leaked. There have also been intrusions by Russian agents into nuclear energy facilities in Belgium and attempts to access internal systems at nuclear plants in France and Lithuania.
The United Kingdom has also been a target of Russian military intelligence hackers. After a recent thwarted cyberattack, the UK imposed sanctions on three GRU units and 18 military intelligence officers for prolonged cyber operations and war crimes. These are not “independent” hacker-athletes but actual representatives of the Russian state—using cyberspace as a battlefield.
Russian SVR and FSB have not overlooked their “Slavic brothers” either. During elections in Slovakia, pro-Russian narratives were aggressively pushed through coordinated networks on TikTok and Facebook. In disinformation campaigns in Bulgaria and Slovakia, Russia’s intelligence services supported local Telegram channels and pseudo-news websites spreading anti-European propaganda.
So what did Kaja Kallas mean? It’s quite straightforward: the EU cannot respond to these threats case-by-case. A comprehensive strategy is needed to neutralize and prevent hybrid threats. To effectively counter hybrid aggression, the EU must develop a unified approach that combines cybersecurity, legal tools, and political resolve.
It’s encouraging that this issue is now on the EU’s agenda—but the next step must follow: the creation of a centralized pan-European cybersecurity agency with rapid-response authority; strengthening the mandates of Europol and Eurojust in hybrid threat investigations; and the implementation of an automatic sanctions mechanism in response to hostile actions, including cyberattacks, election interference, and espionage.
There is no alternative. Russia is already waging a full-scale covert war against Europe. The longer the EU sticks to diplomatic wording and piecemeal responses, the deeper hybrid influence will embed itself in the structures of European democracy. Neutralizing this threat demands strategic unity, political will, and the readiness to make hard decisions—because the cost of inaction is the erosion of sovereignty, democratic order, and European identity, which is precisely what the Kremlin seeks.