Russia’s Hybrid Warfare Tactics Target the Baltics

We are publishing this piece because Ambassador Eitvydas Bajarūnas has a wide range of governmental experiences that give him unique insight into modern political warfare. Among his many overseas postings, Ambassador Bajarūnas served as the Ambassador of Lithuania to Russia and as Deputy Ambassador of Lithuania’s delegation to the North Atlantic Treaty Organization (NATO). He previously served as Ambassador-at-Large for Hybrid Threats and regularly provides analysis on Russian informational warfare against the Baltics. In 2016, when he finished his posting as the Lithuanian Ambassador to Sweden, the then-Minister for Foreign Affairs nominated him as Ambassador-at-Large for Hybrid Threats. His main tasks were, first, to serve as the focal point within the Lithuanian Ministry of Foreign Affairs on this topic, and second, to promote understanding of hybrid threats and the need to counter them among EU and NATO allies. 

Ambassador Bajarūnas participated in various EU and NATO working groups and initiatives (e.g., the NATO-Ukraine Hybrid Platform, the EU Working Group on Countering Hybrid Threats). He also negotiated and signed the memorandum establishing the European Center of Excellence for Countering Hybrid Threats on behalf of Lithuania. Additionally, Bajarūnas took part in numerous seminars and working meetings, wrote numerous articles, and gave interviews to promote understanding of this phenomenon. Ambassador Bajarūnas’s piece helps place these developments into a larger context and explains why Russian political warfare is a decisive threat to frontline states. This essay builds upon Beniamino Irdi’s previous Perspectives article “Hybrid Threats and Modern Political Warfare: The Architecture of Cross-Domain Conflict,” highlighting the themes of dispersion across domains and gradualness in timing. 

Executive Summary:

• Hybrid threats describe a complex strategy combining military tools with unconventional methods. Addressing hybrid threats in the Baltics is a continuous, never-ending process centered around developing resilience at the societal, national, European, and trans-Atlantic levels. 
• With Russia’s frontline in Ukraine nearly stagnant, Moscow’s efforts yielding limited results despite enormous casualty rates and physical destruction, and peace efforts so far have made no progress, the prospects of a prolonged conflict have become apparent.
• The Kremlin is now preparing for a long battle both on the frontline and beyond. Consequently, Russia’s use of hybrid strategies, alongside military ones, has become more evident.
• The Baltic States have effectively countered Russia’s continuously escalating hybrid threats through resilience and strategic cooperation with the European Union and NATO. Their ability to withstand pressure highlights their strength in defending democracy and resisting foreign interference.

​On May 9, 2024, a fire broke out at an IKEA warehouse in Vilnius, Lithuania (Lrytas, May 20, 2024). Subsequent investigations revealed that the arson was orchestrated by Russia’s military intelligence agency, the Main Directorate of the General Staff of the Russian Armed Forces (GRU), and that the suspects were also planning similar attacks in Latvia (LRT, March 17). The Lithuanian Prosecutor General’s Office classified the incident as an act of terrorism aimed at intimidating the societies of Lithuania and pressuring them to reduce support for Ukraine (LRT, March 17).

Russia’s hybrid warfare strategy extends beyond its war against Ukraine as it also targets other European frontline states through influence operations, election interference, and intimidation. The Baltic States—Estonia, Latvia, and Lithuania—are targeted by Russian hybrid tactics as a daily reality and direct challenge to their sovereignty.

Historically, Moscow has used political, economic, energy, and cyber tactics to undermine the Baltics. Recent efforts, however, are markedly more aggressive, particularly as they involve military pressure. Understanding the origins of Russia’s hybrid strategy is crucial to recognizing its evolving influence in the region.

Background on Russian Hybrid Warfare

Before Russia’s full-scale invasion of Ukraine on February 24, 2022, many observers anticipated that Russia’s pressure on Ukraine would resemble a form of Russian-led hybrid warfare, like that seen in 2014, which combined “little green men,” cyber weapons, influence operations, and military force (Official Website of Ukraine, January 20, 2024; Kuzio, Crimea: Where Russia’s War Started and Where Ukraine Will Win, July 8, 2024). The likelihood of conventional warfare was “relatively low” in Lithuania’s 2015 national security threat assessment (Ministry of National Defense of the Republic of Lithuania, 2015).  After February 2022, Western attention shifted to the conventional aspects of the war. This included supporting Ukraine with ammunition, weapons, and military training, strengthening the North Atlantic Treaty Organization’s (NATO) deterrence and defense posture, and increasing conventional national defense efforts (see Jamestown, February 24). As Moscow has failed to achieve its objectives in its war against Ukraine, with Russia’s progress severely limited despite heavy casualties and widespread destruction, Moscow’s reliance on hybrid strategies has become noticeably prevalent both in Ukraine and in the West.

The Baltic States are members of NATO, meaning a clear act of military aggression would trigger Article 5, which stipulates that an attack against one ally is considered an attack against them all (NATO, April 4, 1949). Hybrid threats, however, are designed to operate below this threshold, avoiding confrontation and allowing Russia to disrupt the Baltics without triggering a military response from NATO. Hybrid tactics, therefore, escalate slowly, often giving the perception of isolated incidents rather than coordinated attacks, which prevents a full-scale military response. Only in the 2024 NATO Washington Summit Declaration, however, were hybrid threats addressed as a key security concern for the Alliance. The declaration emphasized that hybrid operations could reach a level that might trigger Article 5 of the Washington Treaty (NATO, July 10, 2024).

Russian Hybrid Warfare Tactics in the Baltics Today

Russia’s hybrid tactics have evolved from Soviet-era “active” influence methods (Активные Mероприятия, Aktivniye Meropriyatiya) to prioritize non-military strategies alongside conventional warfare (see EDM, May 13, 2024). Moscow exploits globalization, digital technologies, and democratic freedoms to spread false information, destabilize societies, and undermine trust in institutions. These efforts include propaganda, cyber operations, proxy groups, and cultural diplomacy, all coordinated across multiple sectors (McDermott, 2022; see EDM, April 10, August 1, 2024, February 5, 27, March 5, April 9). In 2018, this author, together with Lithuanian analyst Vytautas Keršanskas, comprehensively assessed the hybrid threats facing Lithuania (Bajarūnas and Keršanskas, December 9, 2018). We found that hybrid threats in the Baltic States can be understood by categorizing them into several areas, as presented in the following sections: 1) information warfare and propaganda, 2) subversion, covert violent action, and conventional aggression, 3) societal weakness, 4) influencing elections, 5) cyber activity, 6) energy, and 7) illegal migration. 

Information Warfare and Propaganda

Russia has intensified its information warfare and propaganda against the Baltics to sow fear and disrupt institutions (LRT, February 27). Propaganda efforts target the political process, historical narratives, NATO membership, and support for Ukraine, with social media platforms such as Telegram and TikTok playing a key role (LRT, August 5, 2024; see Jamestown Perspectives, May 2). Additionally, sophisticated AI-driven misinformation and deepfake technologies further enhance its informational warfare efforts (LRT, November 14, 2023). Groups such as ethnic minorities, Soviet nostalgics, and lower-income communities are primary targets (Equal Times, October 8, 2024). Investigations reveal Kremlin-backed narratives aimed at undermining Baltic security and Western alliances (VSQUARE, April 25, 2023). More coercive tactics are observed in Estonia and Latvia, where Russian media and diplomatic channels push aggressive disinformation using Russian-speakers (GLOBSEC, February 2022). 

Subversion, Covert Violent Action, and Conventional Aggression

Experts have identified various hybrid warfare tactics Russia could use against the Baltic States: from non-violent subversion, covert violent action, to conventional aggression with political subversion.

Since late 2023, Russia has ramped up sabotage, vandalism, and intelligence activities in the Baltic States, increasingly relying on locals with criminal or financial vulnerabilities after mass expulsions of Russian agents across Europe (Hybrid CoE, May 2024). In Estonia, thirteen individuals were arrested for vandalizing Soviet-era monuments and attacking the Interior Minister’s car, and in Latvia, pro-Russian activists targeted national security sites, vandalized public spaces in Riga, and attacked the Museum of the Occupation of Latvia. 

​In July 2024, fires broke out at DHL logistics hubs in Leipzig, Germany, and Birmingham, United Kingdom, due to incendiary devices hidden in parcels. Investigations revealed that these parcels were sent from Lithuania (Delfi, November 5, 2024). The devices, camouflaged as everyday items such as massage cushions, contained magnesium-based incendiaries designed to ignite during air transport, posing significant risks to aircraft and cargo.​ Western security officials suspect that the GRU orchestrated this operation as part of a broader campaign to test vulnerabilities in Western logistics and aviation security. The use of Lithuania as a dispatch point suggests an attempt to exploit the country’s logistical infrastructure without direct attribution (LRT, November 5, 2024).

While non-violent and covert actions have limited destabilization potential, Russia employs aforementioned sabotage, assassinations, and support for extremist groups to create internal chaos (Leiden University, January 20). Intelligence agencies such as the Russian Federal Security Service (FSB), GRU, and Russian Foreign Intelligence Service (SVR) focus on espionage and disinformation to weaken NATO and EU influence.

Russia has been using GPS jamming as part of its hybrid warfare tactics in the Baltic States, particularly since the start of its war in Ukraine (see EDM, May 15, 2024). Both Estonia and Lithuania have accused Russia of jamming GPS navigation near their airports, causing airplanes to lose GPS signal, thereby endangering passengers and crews (LRT, May 12, 2024). The Lithuanian government suspects that Russian GPS jamming is aimed at testing the resilience of the EU and undermining strategically important communications (Ministry of Transport and Communications, March 27).

In the Baltic Sea, Russia is increasingly suspected of conducting sabotage operations and targeting critical undersea infrastructure such as internet and power cables while also employing Russia’s “shadow fleet” for transporting sanctioned oil products (see EDM, February 5).

Targeting Societal Groups

Russia’s hybrid operations seek to undermine democratic stability by exploiting vulnerabilities in civil infrastructure, governance, and societal cohesion. Cyberattacks on critical sectors such as energy and finance further test resilience, often in coordination with other hybrid threats (State Security Department of the Republic of Lithuania, February 15). In the Baltic States, Russia strategically manipulates Russian-speaking minorities and diasporas to amplify influence, often through media control and cultural institutions such as the Russian Orthodox Church (see EDM, February 13, 2024). The Kremlin has also sought to destabilize regional support for Ukraine, weaponizing refugee-related tensions (see EDM, October 2, 2024). 

Influencing Elections

Russia’s election interference in the Baltic region relies on information operations rather than direct cyberattacks. It exploits ethnic and political divisions on traditional and social media, in turn undermining trust in institutions (Posttimees, January 8, 2019; Propastop, February 19, 2019). Cyber operations, while secondary, amplify these efforts by leaking sensitive data. The real threat lies in manipulating public perception and fragmenting society, as vulnerabilities often stem from weak digital hygiene among media and political actors (Defense Intelligence and Security Service Under the Ministry of National Defense of Lithuania, February 15, 2024) 

One of the most notable examples of Russian interference in Lithuania’s political process was the case of former President Rolandas Paksas. During the 2003 Lithuanian presidential election, Paksas’s campaign received significant financial support from Yuri Borisov, a businessman with ties to Russia’s military-industrial complex. This connection was viewed as an attempt by Russian-linked actors to influence Lithuania’s internal political decisions. The scandal ultimately led to Paksas’s impeachment and removal from office in 2004 (LRT, April 4, 2024).

Cyber Attacks

Lithuania’s Annual National Threat Assessment highlighted Russia as a major source of hostile cyber activity, with groups linked to the GRU conducting aggressive attacks (State Security Department of Lithuania, 2025). Private sector information technology (IT) firms supporting critical infrastructure have been prime targets due to their access to sensitive data. For example, the 2023 NATO Summit in Vilnius faced cyber disruptions, including Distributed Denial-of-Service (DDoS) attacks and publishing false information (LRT, July 13, 20, 2024). 

Targeting Energy Infrastructure

The Baltics face persistent Russian hybrid threats to their energy security, particularly toward critical infrastructure (CEPA, December 9, 2024). In 2022, Ignitis, Lithuania’s state-owned energy group, suffered “the biggest cyber attack in a decade” (LRT, July 7, 2022). The attack, known as a DDoS, affected the Ignitis website’s operation and digital services. In 2024, hackers stole personal data and financial details of 20,000 Ignitis customers using the group’s electric car charging service (Delfi; LRT, February 12, 2024).

Russian-backed Killnet hackers have claimed responsibility for most of Lithuania’s cyber attacks (LRT, July 7, 2022). Disinformation campaigns aim to undermine trust in alternative energy sources such as liquefied natural gas (LNG). Lithuania has significantly reduced its reliance on Russian energy through projects such as the Klaipėda LNG terminal, enhancing regional energy independence (KN Energies, April 4, 2022). All three Baltic states strengthened their energy security by disconnecting from the Russian BRELL system and integrating into the European grid in February. This marked a departure from reliance on Russia to a “second independence” for the Baltics (see EDM, February 20).

Illegal Migration

In 2021, Belarus, with Russia’s support, initiated a mass illegal migration crisis against Latvia, Lithuania, and Poland by exploiting migrants from third countries (mostly from Iraq) and facilitating illegal border crossings (see EDM, June 17, 2021; LRT, July 15, 2021). Migrants were transported to Belarus and escorted to the borders with Latvia, Lithuania, and Poland (Lithuanian Ministry of National Defense, September 13, 2021). This operation aimed to overwhelm these countries’ border security and asylum systems and exert political pressure on the European Union while creating a humanitarian crisis (LRT, July 15, 2021). Lithuanian authorities worked together with NATO experts to monitor the crisis and counter any threats to Lithuanian security (Lithuanian Ministry of National Defense, September 13, 2021).

Conclusion

Russia ultimately views the Baltic region as a key battleground in its broader conflict with the European Union and NATO, a stance reinforced by, but not limited to, its war against Ukraine. With military superiority in Kaliningrad and Pskov, Moscow can pressure NATO while exploiting political, economic, and cyber tactics to weaken the Baltic States. Thus far, the Baltic States have limited Russia’s success, despite intensified hybrid threats, with strong societal resilience and strategic coordination. As the Baltics withstand these pressures, these frontline states serve as a model for democratic resistance to foreign influence.