Hybrid Threats and Drone Disruptions in the Nordics

Russia is under growing pressure in Ukraine, with Ukrainian forces regaining some ground and targeting Russian oil refining capacity, further straining Russia’s economy. Recent shifts in US policy, signaling a more positive view of Ukraine’s chances in the war, are likely informed by intelligence on these developments. At the same time, the reduction of American security commitments in the Baltic region has created a perceived window of vulnerability, which Russia appears intent on exploiting through provocative maneuvers and incursions near critical infrastructure.

The rise in drone disruptions and cyberattacks targeting critical infrastructure, including European airports, is likely a result of these developments. While Russia is not publicly named, Russia is highly likely responsible for these intrusions too. These incidents are designed to destabilize societies and erode public confidence in the ability of states to protect vital services. The ultimate goal is likely to coerce Europe into scaling back the military support from Ukraine.

Assessment

Truesec threat analysis confirm that politically motivated actors are increasingly using sabotage, hacktivism, and coordinated cyber operations as instruments of geopolitical competition. The Russian invasion of Ukraine marked a turning point, with an observable increase in cyberattacks against European critical infrastructure and a clear integration of physical attacks, information operations, and cyber activities.

The drone disruptions will likely continue, as they have been effective in generating headlines and fear, but Truesec assesses that there is also an increased risk of cyber attacks currently, especially against critical infrastructure.

At the same time Truesec assess that this wouldn’t necessarily involves highly sophisticated cyber attacks, but rather attacks of medium sophistication, supported by social media campaigns to maximize the psychological impact of the attack, rather than actual physical impact. A measured and resilient response, focused on robust cybersecurity, cross-sector collaboration, and clear communication, is essential to countering these hybrid threats without amplifying their intended psychological effects.

Truesec is now strengthening our preparedness and closely monitoring developments related to potential Russian hybrid attacks in cyberspace. Our teams are coordinating across Incident Response, Threat Intelligence, and Managed Defense to ensure rapid detection of relevant threat actors, as well as offering clear guidance and support if needed. We are also monitoring communications from relevant authorities and partners and will update customers as the situation evolves.

If you experience a security incident or suspicious activity, please do not hesitate to contact us.