Loading story…
Russian state-backed cyber operations have intensified against Western democracies, with the United Kingdom and Moldova reporting significant hostile activities attributed to Kremlin-linked actors. In the UK, the former head of MI5, Baroness Manningham-Buller, publicly stated that the scale and nature of Russian cyberattacks, intelligence operations, and physical sabotage suggest the country may already be engaged in a form of warfare with Russia. She highlighted the extensive use of cyberattacks, intelligence collection, and physical attacks, referencing recent campaigns attributed to APT28, a group linked to Russia's GRU, which targeted Microsoft login credentials and passwords as part of espionage efforts. The UK's National Cyber Security Centre (NCSC) has issued warnings about these campaigns, noting that Russian hacking groups have focused on governments, technology firms, and logistics suppliers supporting Ukraine. These operations are not isolated, as Russian state-backed cyberattacks have targeted Western organizations for years, often in coordination with ransomware gangs and cybercriminals believed to have ties to Moscow's intelligence services. In Moldova, Deputy Prime Minister Doina Nistor accused Russia of orchestrating a cyberattack on the Central Electoral Commission ahead of parliamentary elections, describing it as part of a broader hybrid campaign to destabilize the country's democracy. The attack exploited a vulnerability that has since been secured, but officials warn that Moldova is being used as a testbed for Russian hybrid warfare tactics, including DDoS attacks via hijacked routers, AI-driven disinformation, and efforts to radicalize youth and orchestrate unrest. Moldovan authorities report that the scale of Russian interference now far exceeds previous years, with increased funding for vote-buying, more sophisticated disinformation campaigns, and greater resources dedicated to destabilizing the electoral process. These hybrid operations are seen as a warning for other Western democracies, with officials cautioning that successful tactics in Moldova could soon be deployed in upcoming elections across Europe and the United States. The overarching goal of these Russian operations is to manipulate public opinion, undermine trust in democratic institutions, and destabilize governments. Both the UK and Moldova have responded by strengthening cybersecurity measures and raising public awareness, but the persistent and evolving nature of Russian hybrid threats continues to pose a significant challenge to national security and democratic integrity across the West.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
A former head of MI5 publicly suggested that the UK may already effectively be at war with Russia, reflecting escalating concern over hostile Russian cyber and influence operations. The remarks underscored the growing view that cyber activity is part of a broader state conflict environment.
Moldova held a vote that resulted in a pro-EU outcome, despite reported Russian influence activity surrounding the process. The result highlighted concerns that future Moldovan elections could face continued foreign interference and cyber-enabled influence risks.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The United Kingdom has imposed new sanctions on several Russian and Chinese organizations and individuals accused of conducting cyberattacks and influence operations aimed at undermining Western democracies. Foreign Secretary Yvette Cooper announced these measures, which target Russian influence networks such as the Telegram channel Ryber, Pravfond, and the Centre for Geopolitical Expertise, as well as Chinese technology companies i-Soon and Integrity Technology Group. The sanctions are part of a broader effort to counter hybrid security threats, including disinformation campaigns and cyber operations, with the UK calling for enhanced multilateral cooperation across Europe to address these evolving challenges. In a related address, Cooper emphasized the growing sophistication and democratization of tools used by hostile foreign states, particularly Russia, to conduct information warfare and hybrid attacks targeting critical infrastructure and democratic institutions. She highlighted recent examples of Russian disinformation campaigns, such as the Doppelgänger operation and attempts to undermine political stability in Moldova and Africa through fake news and deepfakes. The UK government is urging European partners to strengthen collaboration and resilience against these persistent and complex threats to national and regional security.
Jun 29, 2026
European Commission President Ursula von der Leyen publicly warned that Russia is conducting a coordinated hybrid warfare campaign against Europe, combining cyberattacks, sabotage, and disinformation to destabilize the European Union and weaken its support for Ukraine. In a speech before the European Parliament in Strasbourg, von der Leyen cited a surge in security incidents attributed to Russian state-backed actors, including the violation of Estonian airspace by Russian MiG jets and the appearance of drones over critical infrastructure in Belgium, Poland, Romania, Denmark, and Germany. The United Kingdom, though not an EU member, also reported drone incidents near civilian and military sites, prompting the deployment of a counter-drone unit to Denmark during major European summits. Von der Leyen highlighted that these incidents are not isolated but part of a deliberate and escalating campaign designed to test the EU’s resolve and unity. She referenced specific examples such as undersea cable cuts, cyberattacks that paralyzed airports and logistics hubs, and malign influence campaigns targeting European elections. The European Commission president emphasized that these actions are calculated to remain in a "grey zone" of deniability, making attribution and response more complex. She called for urgent action, urging EU leaders to develop a strategic plan in close coordination with NATO to counter these threats. The blueprint for a pan-European security response was presented to EU leaders at a recent summit in Copenhagen. Von der Leyen stressed the need for greater vigilance, technological readiness, and unity among EU member states to deter further aggression and protect European sovereignty. The campaign is seen as a direct attempt to divide the EU and undermine its support for Ukraine amid ongoing conflict. The speech marked a significant escalation in the EU’s public stance on Russian hybrid threats, moving from isolated incident response to recognizing a systematic and strategic campaign. The European Commission’s warning comes amid increasing evidence of Russia’s use of both physical and cyber means to disrupt European stability. The call to action includes enhancing countermeasures against cyberattacks, protecting critical infrastructure, and strengthening information resilience against disinformation campaigns. The EU’s response is expected to involve both defensive and offensive cyber capabilities, as well as closer intelligence sharing with NATO allies. Von der Leyen’s remarks underscore the seriousness with which European leadership now views the hybrid threat landscape, and the necessity for a unified and robust response.
Jun 29, 2026
New analysis warns Russia is likely to escalate its opportunistic hybrid activity in Europe into a more coordinated campaign consistent with **New Generation Warfare (NGW)** doctrine, integrating cyber operations, influence activity, and sabotage across a broader geographic footprint and at higher tempo. The assessment anticipates more synchronized, multi-domain actions designed to degrade NATO cohesion and readiness—such as pairing physical disruption (for example, airspace violations affecting critical infrastructure like airports) with cyberattacks (for example, **DDoS** against communications) to amplify operational and psychological impact. Ukrainian officials are simultaneously pushing for tighter regulation of **Telegram**, citing its repeated use by Russian intelligence to recruit locals for sabotage and terrorist attacks; the calls followed a deadly incident in Lviv that Ukrainian leadership attributed to Russia and said involved recruitment via Telegram. Separately, polling across major NATO countries indicates strong public support for treating severe hybrid actions—such as cyberattacks that shut down hospitals or power grids and sabotage of undersea cables or energy pipelines—as **acts of war**, highlighting a growing gap between public sentiment and NATO governments’ typically restrained responses to hybrid aggression.
Jul 12, 2026