After the start of the Russian Federation’s full-scale war against Ukraine in 2022, Britain became a priority target for hybrid operations by Russian intelligence services for a number of reasons. Firstly, because of its military leadership in NATO and its active position in supporting Ukraine. It was the first to start supplying the Ukrainian army with tanks, long-range missiles and training Ukrainian pilots. Secondly, London remains a key newsmaker, whose political signals invariably become headlines on the pages of rating publications, which makes Britain an influential entity capable of setting the tone and direction of global information flows. Thirdly, London has for decades served as a financial hub for the legalization and laundering of the Russian elite’s capital. The freezing of their assets and the strengthening of the sanctions regime have turned the former “quiet haven” into a conflict zone, which the Kremlin sees as a challenge and is trying to retaliate.
Playing on long-standing historical British-Scottish tensions, Russian intelligence services have sought to incite and revive Scottish separatism. During the Scottish independence referendum (September 18, 2014), the Kremlin first tested the techniques it would later use during Brexit and the 2016 US election. These included informational dumping and the spread of disinformation via social media. For example, after voting in the Scottish referendum, a video was distributed by Russian bot farms that appeared to show the dumping of packages of ballots “against” independence. It later turned out to be footage from the 2012 Russian election.
In their typical fashion, Russian bot farms actively promoted narratives like “Westminster is robbing Edinburgh to fund someone else’s war,” or that London is “stealing Scottish oil” in the North Sea and without Britain, Scotland would instantly become the richest country in Europe, and a host of other conspiracy theories.
The Intelligence and Security Committee of the British Parliament published a resonant report in July 2020, which stated that there was “credible open-source commentary” indicating that Russia conducted influence campaigns during the 2014 Scottish independence referendum. Attempts were recorded by Russians to reach out to the radical wings of nationalist movements through closed groups on Telegram, pushing them to take direct action (blocking roads, administrative buildings and arson) under the pretext of “fighting for freedom”.
Despite the long-standing and tense relations between London and Moscow, the latter did not abandon attempts to intervene in British politics and find ways to influence. During the 2024-2025 election cycle, British intelligence agencies and journalists exposed the work of the “Doppelgänger” network, which was an extensive system of clones of publications such as The Guardian and The Daily Mail, which published fake articles about corruption in the British government and anti-Ukrainian materials. Up to 80% of comments under resonant posts by British politicians on the X network (Twitter) were generated by bot farms associated with the Russian “Internet Research Agency”, also known as the “troll factory”.
The materials distributed by these pseudo-media outlets and bot farms were analyzed by British government agencies and the French agency for the study of digital foreign interference (VIGINUM). They found that AI was used to write the texts, which wrote them in good English, and the publications were distributed on social networks on a viral basis using a network of fake accounts.
The Kremlin did not abandon attempts to maintain influence over British decision-making centers. According to ISC, Russian oligarchs from V. Putin’s inner circle have been making contributions to the Conservative Party of Great Britain for years (over £2 million in recent years). As a result, in 2024-2025, Britain was forced to introduce a law on the registration of foreign agents (Foreign Influence Registration Scheme) to make such funding schemes more transparent and understandable.
Any internal unrest and public protests in states within the Kremlin’s strategic interests instantly become targets for intervention. During the anti-migrant protests in August 2024, Russian botnets (including those linked to the aforementioned Internet Research Agency) generated thousands of posts per hour, calling for radical action on both sides. Former MI6 chief Sir Richard Dearlove then said that Russia was actively “adding fuel to the fire,” using botnets to coordinate protesters on Telegram and X in order to radicalize the protests as much as possible.
At the same time, cyberattacks were launched aimed at disabling British critical infrastructure and disrupting the usual rhythm of British life. In June 2024, the Qilin hacker group, linked to the Russian Federation, paralyzed the work of a number of London hospitals. At that time, more than 800 planned surgeries and 700 procedures for oncology patients were canceled.
In October 2025, the Lynx hacker group (military unit 26165 of the Russian military intelligence) gained access to the servers of a company that provides communications and liaison services at Royal Air Force bases. As a result, patrol schedules and technical and confidential characteristics of protected communication channels were stolen. Russian hackers also tried to penetrate the networks of the national gas operator National Grid, which, if successful, would have allowed them to interrupt gas supplies to regions of Great Britain and important facilities in the country.
The most alarming trend of 2024–2026 was Russia’s transition to actions of physical influence (sabotage), which it tried to carry out in Britain with the help of mercenaries from local criminal and disadvantaged migrant environments. This contingent is most often an expendable material and a one-time tool of Russian special services. Their use allows you to hide direct communication with Russia.
In 2024, the case of Dylan Earl was solved, who, on the instructions of Russian intelligence services, organized the arson of a warehouse in East London, where humanitarian aid intended for Ukraine was stored. British investigators then established that the Russians recruited him via Telegram and rewarded him via cryptocurrency. In the summer of 2024, a parcel with an incendiary device exploded at the DHL sorting center in Birmingham. It is assumed that the purpose of the sabotage was to check the possibility of placing explosive devices on board cargo planes heading to the USA, and a number of signs indirectly indicated the probable involvement of Russia in this terrorist attack.
Currently, there is an increase in Russian espionage activity in the North Sea, the target of which is the underwater infrastructure of cables and pipelines. The British Navy has repeatedly observed Russian ships equipped with deep-sea reconnaissance devices and underwater work over their locations. Such actions by Russia pose a direct threat to international communications. Over the past few months, there have been cases of unfounded parking of Russian cargo ships over the locations of underwater communications, to which the British coast guard was forced to respond.
The confrontation with Russia since the end of the Cold War has been intensifying and reaching a qualitatively new level. The Kremlin will not abandon attempts to influence social and political processes in the UK, using the entire arsenal of hybrid measures mentioned above. Britain will be forced to respond not only with sanctions, but also to strengthen its own cyber defense and strengthen counterintelligence measures.