In an unpopular response to the retreat of Russian forces in the Ukraine war, President Vladimir Putin ordered the mobilization of hundreds of thousands of reservists. Putin’s order essentially doubled down on a warfighting strategy characterized by high levels of attrition and widespread damage to Ukrainian forces and infrastructure. Russian strikes, actions, and retaliations have caused over $108 billion in damage to Ukrainian infrastructure and left 3.4 million people homeless. Shortly after issuing the mobilization order, Putin signed four treaties to annex Russian-controlled regions of Ukraine following sham referendums orchestrated at gunpoint to join Russia. Kremlin spokesman Dmitry Peskov stated that “any attack by Ukraine on the territories incorporated into the Russian Federation would be viewed as an attack on Russia.” In a televised speech, Putin also hinted at his willingness to use nuclear weapons: “We will protect our lands with every means we have at our disposal.” He noted that the United States was the only nation to use nuclear weapons and claimed that the bombings of Hiroshima and Nagasaki “set a precedent.”  

The annexation of the Donetsk, Luhansk, Kherson, and Zaporizhzhia regions—which is a violation of international law—and the use of nuclear threats are a sharp escalation beyond the application of conventional force. However, Russia’s actions align with the North Atlantic Treaty Organization (NATO) 2022 Strategic Concept’s recognition that “the Russian Federation ... uses conventional, cyber and hybrid means against us and our partners.” NATO defines the hybrid threat as a type that “combines conventional, irregular and asymmetric activities in time and space.” The NATO Strategic Communications Center of Excellence describes hybrid threats as a wide array of measures including but not limited to threats of force; manipulation of international law; disinformation; cyberattacks; economic pressure, energy dependency; and sabotage. 

There is no doubt Russia is fighting a conventional war in Ukraine with concentrations of ground troops and heavy firepower bent on destroying its enemy. Yet, Putin is using every hybrid playbook technique in an appalling attempt to achieve his goals. 

Cynical Disinformation  

Russia has used asymmetric means to multiply psychological effects while claiming its strikes are exclusively aimed at military targets. After major battlefield defeats, for example, Russia lashed out with a campaign of missile attacks that have no immediate military benefit. The United Kingdom’s ministry of defense said the aim is to “undermine the morale of the Ukrainian people and government,” raised by recent offensive successes. A Russian missile exploded near the South Ukraine Nuclear Power Plant, creating a huge fireball that blew out windows, damaged a hydroelectric power station, and caused power outages for thousands of citizens. Another missile strike on a dam in Kryviy Rih, the hometown of Ukrainian president Volodymyr Zelensky, caused the waters of the Inhulets River to rise and prompted evacuations. The strike included Russian Kinzhal missiles, which fly at hypersonic speed and are difficult to defeat. Russia retains the capacity to launch more than a dozen missile strikes daily to degrade critical functions as winter sets in. 

Disinformation routinely follows strikes on obvious civilian targets. After Russia bombed a maternity hospital in Mariupol in March, killing three civilians, Russian foreign minister Sergey Lavrov said it was empty of patients and being used as a Ukrainian militia base. The Kremlin claimed images of an injured pregnant woman wearing polka-dotted pajamas evacuating the maternity hospital was a staged scene. A week later, a military strike destroyed the Drama Theater in Mariupol which was being used as a shelter by several hundred residents. The head of the regional administration said that “The Russians are already lying, [saying] that the headquarters of the Azov Regiment was there.” Yet the most egregious instance of disinformation occurred when a fire broke out at the Olenivka Detention Center in Russian-held territory in July, killing over fifty Ukrainian prisoners. Moscow claimed that Ukraine used a U.S.-supplied HIMARS rocket to stop its own soldiers from confessing to war crimes and even showed the serial number of a HIMARS rocket at the scene. Ukraine blamed the detonation on the irregular Wagner group, a private military company run by one of Russia’s oligarchs. 

Cyber Disruptions

Russian cyber actors—another source of disinformation—have also sought to undermine Ukrainian will and their ability to continue the fight. A week before the invasion, Ukrainian residents received fake SMS text messages intended to cause alarm by claiming Automated Teller Machines (ATMs) were malfunctioning. Shortly after, distributed denial of service (DDoS) attacks occurred on government and banking institutions, knocking out ATMs for an hour. Based on technical information, the White House blamed Russia’s Main Intelligence Directorate, or GRU, for flooding their websites with high volume traffic. The day prior to Russia’s invasion, wiper malware called Hermetic was launched by a Russian military unit, known as Sandworm, against the Ukrainian government and other critical infrastructure entities. Concurrently, website defacements posted a threatening message with an offer to sell databases containing the personal data of Ukrainian citizens.

During its invasion, Russia has also launched cyberattacks against the ViaSat commercial satellite broadband service. U.S. intelligence officials attributed the hack to the GRU. The attack on ViaSat KA-SAT receivers probably interfered with Ukrainian military communications. It spread beyond the country, knocking thousands of wind turbines offline in Germany. Since those initial cyberattacks, Microsoft has detected eight distinct and destructive malware programs used against forty-eight different entities. The most significant attempt to disrupt the lives of citizens occurred in April when Sandworm penetrated a high-voltage power station and installed Industroyer2 malware to shut down electric substations. If not prevented, two million people would have lost electricity supply on a Friday night when returning home from work.

Crisis Generation    

In addition to these hybrid tactics, White House spokesman John Kirby proclaimed that “Putin is literally weaponizing food.” In July, Kyiv and Moscow agreed to a deal to unblock Black Sea ports to allow millions of tons of grain to be exported and help alleviate a global food crisis. Yet only a day later, Russian warships fired Kalibr missiles at the Odessa port infrastructure. Following the attack, the Russian ministry of defense claimed that “US-supplied missiles were stored in the grain facilities.”  

In September, Putin used misleading figures to claim developing countries were only getting 3 percent of the grain being exported from Ukraine and threatened to restrict Ukrainian grain exports to Europe. However, the United Nations (UN) said that 30 percent of grain has been shipped to low-middle-income countries. Days later, Russia executed the same coercive routine and attacked Odessa with waves of Iranian Shadid-136 kamikaze drones.

Putin has also deployed energy as a weapon. He cut natural gas supplies through the Nord Stream 1 pipeline to inflict pain on the European population in the hope of arousing opposition to government policies for sanctions and support for Ukraine. The impact of the Russian gas shutoff has been harsh on many manufacturing businesses. In the energy-intensive metals sector, some are shutting factories and imperiling jobs. For example, in Slovakia, a seventy-year-old aluminum factory stopped production and laid off 300 workers. Yet, Putin’s gamble looks to have backfired as governments work together to bolster their energy supplies. Germany has seen a surge in liquified natural gas (LNG) imports from the Netherlands and Belgium, with two new LNG import terminals under construction. In a dramatic shift, Germany has restarted or extended past closure dates for at least twenty coal-fired power plants to survive the winter. Earnings from burning more coal will be invested in wind turbines and solar panels. However, in the near term, there is still a severe risk of energy shortages if the winter is unusually long and cold. 

Uncertain Sabotage 

Most recently, the Nord Stream 1 and 2 natural gas pipelines under the Baltic Sea were ruptured by two explosions late last month. Kyiv was quick to accuse Russia; Ukrainian presidential advisor Mykhaylo Podolyak said that “Russia wanted to cause pre-winter panic.” Reportedly, Russian navy support ships had been spotted nearby before the explosions. Kremlin spokesman Dmitry Peskov blamed the United States, saying “American natural gas suppliers were reaping huge profits from increased sales to Europe.” Russian news outlets showed clips of President Joe Biden vowing that if Russia invaded, “then there will be no longer Nord Stream 2.” Marie Agnes Strack-Zimmermann, the head of the German Bundestag’s defense committee, believed Russia was the most “plausible” culprit and noted that “This is classic hybrid warfare.”  

The North Atlantic Council didn’t name a culprit but said “the military alliance would be prepared to defend its infrastructure from attacks by both foreign governments and individuals acting without explicit state backing.” Norwegian police have reinforced security around their oil-and-gas installations but physical sabotage is not the only way to disrupt energy security. In late January, a ransomware attack by the criminal group BlackCat crippled seventeen oil port terminals in Western Europe. BlackCat is a rebrand of the Russia-based DarkSide group that caused the Colonial Pipeline shutdown. As Strack-Zimmermann said, “Putin is going to use every hybrid measure at his disposal to fluster Europeans.”