Russia’s hybrid warfare campaign against Baltic Sea states has escalated well beyond intelligence operations, according to a new white paper from the Polish Institute of International Affairs. Sabotage of physical infrastructure, systematic GPS jamming, cyberattacks on government systems, and coordinated influence operations now form an interconnected toolkit that Moscow deploys with increasing frequency and sophistication.
The paper, authored by PISM analysts Filip Bryjka, Anna Maria Dyner, and Aleksandra Kozioł, maps Russia’s hybrid activity across Estonia, Latvia, Lithuania, Poland, Finland, and Sweden. It identifies a clear strategic logic: the operations are calibrated to stay below the threshold that would trigger a NATO Article 5 response, while maximising the cumulative cost imposed on targeted societies.
Physical infrastructure has become a primary target. Bryjka, Dyner, and Kozioł document a series of incidents — suspected deliberate damage to undersea cables, interference with pipeline monitoring systems, and disruption of maritime navigation signals — that individually might be dismissed as accidents but collectively constitute a pattern of deliberate pressure.
Russia’s shadow fleet has played a central role. Vessels with obscure ownership structures and switched-off transponders have been tracked near critical Baltic undersea infrastructure, operating in ways analysts assess as reconnaissance or sabotage preparation rather than commercial shipping. NATO’s Baltic Sentry mission, launched in January 2025 to monitor and deter such activity, represents the alliance’s formal acknowledgment that the threat is real and ongoing.
GPS jamming has become a near-daily occurrence across parts of Finland, Estonia, and Latvia. The disruptions affect civilian aviation, maritime navigation, and agricultural machinery — creating economic friction and eroding confidence in critical systems without provoking a military response. The PISM analysts note that jamming frequency has increased since Finland joined NATO, suggesting the disruptions are partly intended as a demonstration of Moscow’s reach into the Nordic-Baltic zone.
Influence operations targeting Baltic populations run alongside the physical campaign. The paper documents efforts designed to amplify social divisions, undermine confidence in NATO, and portray Baltic governments as subordinate to Western powers rather than independent actors. The targeting has grown more sophisticated, with content calibrated differently for Russian-speaking minority communities than for majority populations — a strategy aimed at fragmenting social cohesion from within.
The PISM analysis arrives as the question of how NATO responds to sub-threshold aggression moves from academic discussion to policy urgency. The alliance has deterrence frameworks built for conventional conflict; the infrastructure for deterring, attributing, and retaliating against hybrid attacks is considerably less developed.
Bryjka, Dyner, and Kozioł focus their recommendations on three areas: improving intelligence sharing between Baltic states on hybrid incidents; developing common attribution standards so that individual countries do not have to bear the political cost of accusing Russia alone; and building resilience into critical infrastructure rather than relying solely on deterrence. The last recommendation is the most actionable — and the most expensive. Without new funding streams, it risks becoming the kind of advice that appears in every policy paper and changes almost nothing on the ground.
