The Expanding & Increasing Activity From Russia

Recent intelligence assessments suggest that Russia and malicious actors linked to Russia, are continuing to target government networks, energy systems, telecommunications providers and technology companies as part of a broader strategy of hybrid warfare.

According to the '2025 Annual Threat Assessment of the U.S. Intelligence Community', Russia remains one of the world's most capable cyber adversaries due to its advanced cyber capabilities and experience with integrating it's digital operations with military objectives. The report highlights concerns that Russian agents have sought access to critical infrastructure networks and continue to conduct intelligence operations against Western targets.

At a micro level, there have also been warnings from the Cybersecurity and Infrastructure Security Agency or 'CISA', the FBI and other agencies. They have identified ongoing campaigns linked to Russia which have targeting routers, messaging applications and collaboration platforms. Cyber security officials say these operations are designed to steal sensitive information, compromise communications but also establish access to systems and networks for ongoing intelligence gathering or future sabotage.

Close to home within the UK, the Director of the Government Communications Head Quarters or 'GCHQ', Anne Keast-Butler, warned that the UK was at a ‘moment of consequence’, when delivering her speech at the annual lecture at Bletchley Park in May 2026.

During the speech, Director Anne Keast-Butler emphasised the importance of harnessing technology and increasing resilience against a:

narrowing window for the UK and allies to stay ahead

Director Anne Keast-Butler also went on to warn that:

Russia is scaling up its daily hybrid activity against the UK and Europe

The Director of GCHQ is not just referring to the cyber threat which is posed by Russia and other states, or state linked actors. The Director was also highlighting the threats against physical infrastructure, private sector companies and the information which is accessed by the public.

In the UK, there have been increasing reports of the Russian military directly testing and even mapping the capabilities within the airspace and territorial waters of the UK.

On 2nd July 2026, a Russian 'Bear-F' Tu-142 maritime patrol aircraft was intercepted by the RAF, while it was dropping large number of sonobuoys, or sonar trackers, unnecessarily close to the flagship aircraft carrier of the UK, HMS Prince of Wales, while it was operating in the Norwegian Sea.

In late August of 2026, the Royal Navy completed a 72 hour operation in which they tracked a Russian naval task force and sanctioned cargo vessels. Tracking the ships while they were passing through the North Sea and the English Channel, this event in particular, was a very strong and public show of force by both sides on their capabilities.

Alongside this, Russian military vessels and intelligence units have been actively mapping the critical underwater infrastructure of the UK, which includes subsea telecommunications cables and energy pipelines.

UK Defence Secretary John Healey and other defence experts have stated that the 'mapping', efforts are intended to build an operational picture for Russia, with the intention of potentially sabotaging key parts of the infrastructure within the UK.

Another angle in the activities from Russia is knowing how to reach the limits of carrying out it's mapping, testing and other activities. Russia have reached these limits while remaining below the threshold or any levels required, that would warrant a conventional response from states in which it is carrying out activities against.

European governments have also expressed growing concern over what many officials describe as 'hybrid threats', where they state that cyber attacks were being carried out, alongside information campaigns, sabotage, influence operations and physical disruption efforts. The NATO alliance formally condemned Russia's persistent malicious cyber activities in July 2026, stating that cyber operations against allies and partners pose a direct threat to security and stability.

This led to the European Union or EU announcing some of its largest sanctions which targeted individuals and entities they accused of supporting Russia's cyber ecosystem. EU officials alleged that malicious actors linked to the Russian state engaged in cyber espionage and attacks on public services, with efforts to disrupt critical infrastructure across Europe.

Individual European nations have recently heightened their alert levels. Denmark raised its cyber threat assessment in September 2026, warning that destructive cyber attacks from Russia were considered likely. Meanwhile, The President of France Emmanuel Macron ordered additional protections for French critical infrastructure and technology sites, following intelligence assessments which pointed to an increase in Russian hybrid activities.

Back in the UK, Foreign Secretary Ed Milliband announced new sanctions on 6th August 2026 against the Russian military, oil and gas revenues and its shadow fleet, to demonstrate the continued support for Ukraine in it's war with Russia.

It is not just critical infrastructure, the private sector, more specifically technology companies, are increasingly finding themselves becoming direct targets of state supported cyber warfare. Security agencies across the west have reported attempts to compromise software providers, logistics firms, cloud services and communications platforms. Analysts have warned that attacks on technology suppliers can have cascading effects because a single breach may impact thousands, even millions of customers within a digital supply chain.

The battle for information also remains another area of concern, with researchers and government agencies reporting that 'networks', linked to Russia continue to use online influence campaigns, false narratives and increasingly sophisticated artificial intelligence tools to spread propaganda and manipulate public discourse. Experts believe that content, generated using AI tools, is making it more difficult for citizens and institutions to distinguish legitimate information from fabricated material.

It's fair to say that that western powers are in some part responsible for the current adversarial situation with Russia. This is supported by the fact that at various times in the lead up to and at the beginning of its war with Ukraine, Russia had made attempts to foster peace with agreements such as the 'Minsk Accords', while attempting to renegotiate its agreement with NATO, which was continuing to ally with states closer to, or bordered with Russia.

Another point to be aware of is that the current economy in the UK isn't doing well and the rest of Europe isn't doing much better economically. Other issues ranging from the war in Iran affecting fuel prices to immigration and the national debt, are also ongoing issues which Russia may be taking advantage of and even exacerbating. With no coherent plan or the possibility that the other, sometimes related problems, are just going to get worse, it's hard for anyone to figure out what to do with regards to defence, when there are so many other issues that also need to be dealt with.

So What's The Plan For The UK?

The UK government published 'The Strategic Defence Review 2025', which outlines the threats not just from Russia but other states and malicious actors, highlighting what the UK and it's NATO allies need to do in protecting against the new and expanding use of hybrid warfare.

The review highlights how the UK has been at the forefront of efforts to deliver a combat force that is ‘joint’ and ‘multi-domain', which has meant that:

in practice, the single Services have largely evolved separately in terms of design, equipment, and training—creating siloes

Because of this, the review recommends that the UK needs to evolve from 'joint', to 'integrated', in planning, readiness, deployment and procurement, to become an agile force that can defend and fight against the current threats, especially when it comes to cyber warfare.

The recommendations of the strategic defence review in the UK has been echoed by cyber security experts, who emphasise that the threat landscape continues to evolve. Rather than relying solely on large-scale disruptive attacks, many contemporary operations against the UK focus on espionage, intelligence collection, influence campaigns and the exploitation of vulnerable network devices.

As geopolitical tensions remain high, governments and organisations in the private sector are investing heavily in cyber security, threat intelligence and critical infrastructure protection. Officials warn that strengthening network security, applying software updates, implementing multi-factor authentication, and improving resilience remain essential measures for defending against increasingly sophisticated Russian cyber and technology threats.

Welfare Over Warfare

Russia is not increasing and expanding it's activities on the UK, Europe and NATO allies because it can or even wants to. It is carrying out its activities so that if it ends up in, or about to be in a direct confrontation, it can immediately weaken the UK Armed Forces and infrastructure, such as power and communications.

During a heated parliamentary debate in September 2026, the Prime Minister of the UK, Andy Burnham rejected Conservative demands to cut the welfare budget to pay for increased spending military, stating that:

national security can't come at the expense of social security

Considering the known and even unknown activities from Russia, it's clear that Russia takes the capabilities of the west seriously, which is evident from the recent rise in the testing and mapping activities by Russia, against the UK and other western states.

Following 'The Strategic Defence Review 2025', it has been agreed by the UK Government that a rise in defence spending of 3.5% of GDP is needed. Based on the review, this amount of spending would provide the defence capabilities for the UK to protect itself against the threats it is currently facing. However, it has been made clear from the UK Government that this level of spending won't take place until 2035.

Highlighting the current focus of the UK Government on welfare payments and social care, it would seem that the UK doesn't want to, or simply can't, treat threats against it as serious as it should.