Balloons, bombs and cryptocurrencies: Russia's new form of hybrid warfare - and how to defeat it

By: Peter Pomerantsev / The Telegraph
Translation: Telegrafi.com
To the untrained eye, a large weather balloon might not seem like an obvious weapon to launch an invasion. But the nature of war is changing - and changing rapidly. It's time for the West to keep up.
Since October, Lithuania has been forced to close Vilnius Airport more than a dozen times due to a steady stream of balloons violating its airspace. Flying up to four kilometers high, they cross the border with Belarus with large packages tied to the base - packages that police later identified as being filled with smuggled cigarettes.
Looking at the cargo, the balloons appear to be the work of smugglers, an act of international crime.
But the Lithuanian government insists that this is an attack by Belarus itself and has declared a state of emergency. Since Belarus is, to a large extent, a proxy for Russia, it is assumed that Moscow is actually directing these actions. And these episodes are part of a pattern of hybrid warfare. Across the continent we are seeing a significant increase in sabotage, cyberattacks, disruptive drone flights, assassinations and disinformation campaigns.
Each of these may seem small in itself, and each may be difficult to attribute, but together they constitute a Russian strategy to undermine Europe. Friedrich Merz, the German chancellor, recently declared that Europe is “no longer at peace with Russia.” But what is this strange state of quasi-war aimed at, how seriously should we take it, and, most importantly, how can we defeat it?
It is worth remembering that Lithuania is one of the most active supporters of Ukraine - and one of the countries most vulnerable to a possible Russian invasion and, therefore, one of the countries most dependent on American defense through NATO. There is even an evacuation plan for the capital in case of invasion.
So what is this alleged Russian operation trying to achieve?
First, it tests the social reactions within Lithuania. Sometimes, such hybrid operations only strengthen a country’s resolve. But when coupled with long-term propaganda campaigns that work to undermine unity, the results can be startling. Take Poland as an example. Last month, Polish authorities discovered explosives on a civilian railway line that also transports weapons and aid to Ukraine. As is often the case, Russia used intermediaries — paid Ukrainian hooligans — to carry out the attack. While the Polish government was clear in identifying Russia as the culprit, over 40 percent of online comments blamed Ukraine. Radoslaw Sikorski, the Polish foreign minister, was clear: “Those who blame Ukraine for Russia’s actions in Poland are political saboteurs ... Russia spends billions to feed such sentiments — on disinformation and propaganda.”
In the case of Lithuania, there is frustration with the government’s inability to handle the situation, particularly with flight delays. Polls this month show that 38.5 percent of Lithuanians feel their lives are more at risk because of the balloons. In the long run, this could weaken the population’s willingness to support Ukraine, as it comes to be associated with danger and confusion. In the case of Lithuania, however, the most important polarization that the Russians are looking for is between the hard-line Baltic states and other European countries that feel less threatened by Russia. For decades, the Baltic states, like Estonia, have been accused by other Europeans of “hysteria” about the Russian threat. That has changed since the full-scale invasion of Ukraine in 2022, but as more peaceful sentiments spread across Europe after years of grueling war, the Russians want to know where everyone stands.
More importantly, however, is how the Americans react. These hybrid operations call into question the viability of Article 5 of the NATO charter, which stipulates that “an armed attack against one member shall be considered an attack against all members and shall activate the obligation of assistance on the part of each of them.” Do balloons qualify as an “armed attack”? What about sabotage? Or assassination? Or bombs on airplanes — like the ones Russia is suspected of planting on DHL planes last year? After all, how will the Americans react to the appearance of soldiers without uniforms, as we saw in Crimea in 2014?
For countries like Lithuania, which is heavily dependent on American resolve, the White House’s response to similar attacks should be deeply troubling. This year we have seen drones enter Polish airspace, others close airports in Denmark, Sweden, Germany, Belgium and the Netherlands. Donald Trump simply shrugged and questioned whether the incursions into Poland could have been accidental.
This month, Treasury Secretary Scott Bessent casually announced that “Putin has begun to make inroads on NATO’s borders. What I can tell you for sure is that the United States is not going to get involved with troops or anything like that.” The comments come as Trump has announced that he will cut $200 million a year in defense support for the region. Meanwhile, Russia is massively increasing its defense spending, producing more tanks, artillery systems, and drones than Europe. Putin is clearly preparing for a potentially protracted conflict and is expanding military recruitment.
This is the trick of hybrid warfare: a cigarette smuggling operation in balloons becomes part of a systemic threat - but you can only understand it if you look at it in the bigger picture.
So how should states respond? How can we, on the one hand, avoid doing Russia's job by overreacting to every act and making Moscow appear more powerful than it really is - and, on the other, put everything into context so that we have a clearer understanding of the threat?
The first step is to look at the totality of the operations and explain their purpose to the public. We currently have a strange situation where figures like Merz declare that we are in conflict with Russia - and then give no examples to explain how. Governments are often reluctant to reveal everything they know because it compromises their own resources, but they should be more bold in attributing responsibility to Russia. Take the attacks aimed at undermining Germany's defense industrial base as an example. Some are well-known, like the attempted assassination of the CEO of Rheinmetall-it, Armin Papperger, in 2024.
Others have never been attributed to Russia but seem too suspicious to ignore, such as fires and explosions at a company arms factory. Diehl in May 2024. German intelligence believes it was the work of experienced professionals, possibly criminals recruited online and paid for in cryptocurrency. A media investigation revealed internet searches conducted by Russia before the attack, which linked to the plant's fire protocols, including where firefighters would come from. Several other facilities linked to arms production for Ukraine - including another factory in Diehl-it - have also caught fire. But until these patterns are explained to the public, it is difficult to understand the scale and scope of the threat.
If attribution of the attack is the first step, the next step is to make sure you respond to the ultimate goal of an attack — and, in a way that shows the Russians the futility of their approach. If part of the purpose of the Lithuanian balloons is to expose the weakness of Article 5 and the lack of American interest in the region, then it is up to European countries to show their resolve together.
A positive example came after the poisoning of defector Sergei Skripal by Russian agents in Salisbury. The British acted quickly to identify the perpetrators, and immediately joined European countries in expelling an unprecedented number of Russian spies from across the continent. Meanwhile, the punishment may be even more aggressive than is commonly thought. After Russia hacked American defense systems, the United States responded with its own cyberattacks.
At the same time, we must develop our own democratic version of hybrid operations to compete in this new world. As Russia undermines the European defense industry, we can bring together civil society, business knowledge, and the power of governments to crack down on the Russian defense sector. Independent researchers can now conduct open-source intelligence investigations faster than governments can use this data for targeted sanctions. This type of collaboration has led, for example, to a reduction in Russia’s supply of chromium—a crucial material for making artillery barrels.
By March 2025, a major Russian plant, NZHS, which met 20 percent of Russia’s domestic chromium needs, was forced to close due to targeted sanctions. The plant supplied at least 12 defense industry manufacturers involved in the production of artillery barrels, ballistic missiles and more. A new report from the Royal United Services Institute uses open-source data to describe in detail the vulnerabilities of Russian air defense systems to surgical disruptions of electronic circuit supply chains. We need to focus on this.
And while Russia is targeting Europe and the UK with disinformation, we should be using factual information campaigns to undermine their war aims. Russia is trying to build an army of 1.5 million soldiers by the end of the decade, which would be large enough to threaten Europe. Moscow’s plan requires far more money than it is currently spending, and potentially a massive mobilization of the civilian population. The latter is dangerous for Russia – when it attempted to mobilize at the start of the war, chaos erupted and nearly a million people fled the country.
But Moscow’s plan poses a clear challenge to the West. We need to use our own hybrid pincer-style movement to stop them. On the one hand, we need to put more pressure on their cash resources, which are heavily dependent on vulnerable oil exports. And, at the same time, we need to develop our own information campaigns to undermine military recruitment within Russia.
Russia loves to wage hybrid warfare - but it is also very vulnerable when this war boomerangs on it. /Telegraph





















































