Russia’s War Beyond the Battlefield: Europe’s Hybrid Threat Wake-Up Call

Tamara Kaňuchová (VSquare)
Photo: Shutterstock 2026-02-19

Interviews

February 24 marks four years since Russia’s full-scale invasion of Ukraine in 2022. The war has tested Ukraine’s resilience while exposing Europe’s lack of preparedness. It has revealed serious gaps in Europe’s awareness of hybrid threats and created new openings for Russian interference in politics and information far beyond Ukraine. In this interview, Mykola Balaban — an information integrity specialist focused on countering foreign information manipulation and interference (FIMI) and hybrid threats — reflects on how narratives have evolved since the invasion began. Currently deputy head of Ukraine’s Center for Strategic Communications and Information Security, he has worked with government institutions, civil society and international partners to strengthen the country’s information resilience.

This interview has been lightly condensed and edited for clarity.

Support for Ukraine across Central and Eastern Europe is mixed according to the latest Globsec Trends report (2025). Some countries are seeing growing support for narratives claiming that backing Ukraine will drag them into war, while others argue that Ukraine should give up territory to end the conflict. Looking back over the past four years, do you see these trends as originating from Russia?

Let’s begin with what we observed in Ukraine over the past year. Russian information warfare is closely aligned with Moscow’s strategic objectives on the battlefield. One of the central narratives pushed within Ukrainian society — as well as across Europe and the United States — is that a Russian victory is inevitable: that Russia can continue fighting for another 10 to 15 years, steadily seizing more territory. There may be setbacks and slow progress, but the overarching message is that Russia will ultimately prevail. This has been the core narrative, with other messages branching out from it. The idea that Ukraine should concede territory emerged later from this central claim and was far less visible in 2022 or 2023.

The second narrative — that continued European support for Ukraine will draw countries directly into the war — dates back to 2022. It has since evolved into several variations tailored to different audiences, particularly in Europe and Central and Eastern Europe. One prominent version taps into war fatigue. Societies that do not face an immediate threat have gradually become less engaged with developments in Ukraine, and sentiment analyses from across CEE reflect this shift.

Russia did not expect the war to last this long. Do you think the narratives emphasizing its strength also reflect a need to preserve its image at any cost?

Image is crucial for Russia. There is even a Russian proverb that says, “it’s meant to look like, not to be.” In cognitive and psychological warfare, deterrence plays a central role — and it comes in different forms. It works much like the fear surrounding the mafia: the power lies in the aura, in the belief that they can reach you anywhere and do whatever they choose. Today, however, Russia needs increasingly aggressive rhetoric to sustain that aura and to have any real impact on how its narratives are perceived across Europe.

These narratives are also being used by far-right parties in Europe. Do you see this as a politically significant narrative in terms of fueling Euroscepticism?

Russian cognitive warfare against Ukraine and Europe is not played on a single chessboard — it unfolds simultaneously on dozens. Even before the full-scale invasion, the Kremlin supported far-right and far-left movements across Europe to advance its strategic goal of fragmenting the EU, because a divided Europe is far easier for Moscow to influence. The next step is leveraging these anti-EU political forces to amplify Kremlin narratives within their own countries.

In some reported cases of FIMI, certain operations are treated as “testing” the information space in Europe. What can we expect from Russia strategically — how is the Kremlin planning to expand its information operations? When does something stop being a test and become a serious information operation, especially given that this “testing” has already been used to interfere in elections? How much further can it escalate?

Here we can look at Ukraine as a playbook for understanding the testing phase and then the escalation. They work on a classic business model: you do the testing, and after that you push as far as your understanding of the audience allows.

The line between testing and real information war is blurred — and it’s blurred intentionally. It’s a political play, a fight between far-right and far-left parties, framed as a legitimate societal debate. It’s also very similar to conventional military tactics: you try out new technology, improve it, scale it up, and then at the moment you see it useful, you deploy it at full scale.

In the Ukrainian case, before the 2014 Euromaidan revolution and the annexation of Crimea, the Russians first did the testing: assessing how many pro-Russian forces they had in Ukraine to support and facilitate an anti-Ukrainian movement. They framed the conversation as a legitimate political debate. They thoroughly analyzed the Ukrainian information space in the months before the annexation of Crimea, and then assessed the sentiments in the US, Slovakia, Czech Republic, and Poland. The same pattern Russia applied to its information activities in Ukraine is now occurring in other European countries.

After that comes decision-making: when is the country weak enough to take the next step — some conventional action, such as blowing up critical infrastructure or a military plant? When they need to achieve something with hard power, they act based on what the testing phase reveals. They tried to do the same in 2022 in Ukraine [hoping that their information operations had paved the way for a swift military campaign that would allow them to seize control of the country quickly] but they failed.

So they analyze the atmosphere in the countries around Ukraine and tailor their tactics based on what might work best?

Yes, and with a focus on the political goals they want to achieve at any given moment. For example, they need the fracturing of Central Eastern Europe over the Russian-Ukrainian war. They work on creating ambiguity and misunderstandings to prepare the ground for the next level of operations — all the way to supporting shifts toward governments that are extremist, anti-European, and anti-Ukrainian.

A couple of days ago, a report on attributing Russian information influence operations, which you collaborated on with the NATO Strategic Communications Centre of Excellence, came out. Can you tell us about the main conclusions of the report?

The main idea behind the report was to bring together the conceptual expertise that NATO and its allies have in analysis with Ukrainian practical materials — what we find, what we see, and how we respond. The idea was to join those two areas of expertise.

There is a different level of involvement on our side, because in Ukraine we are already a step ahead of Europe and NATO in terms of the severity of the threat. And sometimes we don’t fully understand each other methodologically, because Western colleagues will say, “You are not thinking clearly because you are part of the war. We need a more thorough methodology of attribution, because we are an open society. We can’t simply say these people are working against this country — they are part of a legitimate political debate.” So in that sense, we have a different experience in Ukraine.

This report showed that a systematic and legitimate approach to attribution, grounded in Ukrainian materials, is sound and can be refined by combining it with Western expertise. It showed that it works, and that thinking together is a good path forward. It’s one of the building blocks in the system that Ukraine and the EU want to construct to defend against Russian information influence operations.

How is the attribution process developing at the moment? The scope and volume of FIMI have likely increased — how are we doing in terms of attribution?

Attribution is a crucial tool for governments and security institutions. It helps expose malign activities and convince the public that certain actors are working against national interests and public security. In a democratic society, it is one of the most effective instruments for countering foreign interference.

Russian information operations across Europe are expanding, and their methods are becoming increasingly refined and sophisticated. It’s a constant contest — a fight between the sword and the shield. Russia develops new techniques, tests them, launches mirror websites, opens new Telegram channels, and experiments with new formats. Attribution methodologies must evolve just as quickly to remain effective for governments and law enforcement.

What potential do these tools have when it comes to social media platforms?

One important branch of attribution focuses on narrative analysis in social networks. These tools can help lawmakers and decision-makers as debates intensify over platform regulation and the responsibilities of tech companies.

I agree with Emmanuel Macron’s remarks at the Munich Security Conference regarding elections and young Europeans. It would be a serious mistake to simply surrender to the algorithm — to allow opaque platform logics to shape the outcome of elections or other critical political processes. Each social network operates according to its own internal logic that determines what information users see. Democratic societies should not cede control of that space.

This report contributes to that broader conversation — the one Macron referred to in Munich. It is one element of what could become a much larger toolbox for European democracies seeking to protect their information environments.

Is there anything important we haven’t covered?

I want to emphasize one key point. Since the full-scale invasion, Ukraine has consistently warned its European partners that Russia is waging a large conventional war against Ukraine — but Ukraine is not its only objective.

The fragmentation of Europe has particular importance for Central Eastern European countries because Russia wants to reinstate the Soviet bloc of influence and its status as an empire. It perceives Ukraine as an integral part of Russia, but it also perceives Poland, the Czech Republic, Slovakia, and Hungary as belonging to that Soviet bloc. That’s why it’s very important for each country and each society not to fall into the illusion that Putin only wants Crimea or Donbas and that everything will be fine after that. Because the day after, they will want to destroy Ukraine — which I think will never happen. And the day after that, it would be the next neighboring country. This pattern of empire restoration — or renovation — follows its own internal momentum.

Tamara Kaňuchová

Tamara is a journalist from Slovakia, currently based in the Netherlands. Besides VSquare, she writes for The European Correspondent.