Russia's destabilization campaign across Europe will likely persist for the foreseeable future, even if there is a ceasefire in Ukraine, and would be more likely to escalate to more seriously threaten casualties and larger disruptions to critical infrastructure if European states make headway in sending peacekeepers or otherwise ramping up support to Kyiv, especially if outside of the framework of U.S.-Russia talks. On March 18, Europol, the European Union's law enforcement arm, released its quadrennial report on organized crime across the bloc, blaming Russia for working via criminals and other proxies to carry out a campaign of hybrid warfare, including cyberattacks, vandalism, arson, harassment and targeted violence. Europol's report was merely the latest in a long series of accusations by European officials, revelations in media reports and other publicly-available information blaming the Kremlin for an ongoing destabilization campaign across Europe. Among other recent developments, on March 17, Lithuanian prosecutors blamed Russia's military intelligence agency, commonly known by its acronym GRU, for overseeing an arson attack carried out by paid saboteurs against an Ikea location in Vilnius in May 2024. Just days earlier, on March 12, Polish prosecutors accused a supposed Belarussian refugee of being directed by Russian intelligence to set fire to a mall in Warsaw in April 2024. The same day, EU foreign policy chief Kaja Kallas and NATO deputy head James Apparthurai publicly characterized Russia's myriad actions as "state-sponsored terrorism."

The pace of Russian hybrid warfare in Europe dramatically accelerated after it invaded Ukraine, with Russia demonstrating a growing risk tolerance since 2024. Russia has long sponsored assassinations, acts of sabotage, cyberattacks and other asymmetric actions across Europe, but the Kremlin has significantly ramped up its efforts in recent years. According to a March 18 report from the Center for Strategic and International Studies, a U.S. think tank, the number of Russian kinetic attacks (I.e., those with a real-world impact) in Europe quadrupled from three in 2022 to 12 in 2023, and then nearly tripled to 34 in 2024. This significant year-on-year increase likely reflects Russia's adjustment following its invasion of Ukraine in February 2022. In response, European states expelled hundreds of suspected Russian spies posing as diplomats and more generally ramped up their counterintelligence activities, while Russia was forced to devote its attention and resources to Ukraine given that the invasion did not result in a quick victory as expected. These trends help explain the relatively few attacks in 2022 compared to their expansion in 2023 and then major leap in 2024, as Russian intelligence services not only progressively recovered their footing — ramping up their efforts to use criminals and other for-hire proxies — but also had growing incentives to carry out attacks in Europe given the strong military, financial and diplomatic support many European governments provided to Ukraine. As time has passed, Russia has also grown more risk-tolerant, likely reflecting both its intent to impose costs on Europe and its lack of perceived consequences as European states have largely struggled to respond beyond an increasingly public name-and-shame campaign. Russia's risk appetite reached its peak in 2024 when, among other things, Russian-backed proxies were accused of hiding incendiary devices in packages sent aboard cargo planes, plotting the assassination of European defense industry executives and repeatedly trying to sabotage military bases in Germany.

With many incentives and capabilities to continue its destabilization campaign, Russia will likely continue its hybrid activities, regardless of a potential ceasefire in Ukraine. With the United States putting significant efforts into trying to de-escalate the war in Ukraine, there is a rising likelihood that a ceasefire deal, even if only temporary, will be reached in the coming months. But even if one is enacted, and even if it were to be extended for a longer period of time, Russia would still have strong motives and capabilities to continue to sponsor its hybrid warfare campaign in Europe. Even if attacks occur at a slower pace than in 2024 and/or there are fewer incidents involving serious acts of violence, the Kremlin would likely still want to carry out various operations to achieve different ends, ranging from harassing, intimidating or even silencing its opponents; creating divisions within and between European states; and imposing costs on European governments for their ongoing support for Ukraine and sanctions on Russia. Russia would also have strong capabilities to continue to carry out its destabilization campaign as it increasingly refines its strategy of using proxies as low-cost, somewhat deniable means to facilitate attacks. Moreover, while European security services have been increasing their defensive measures — part of the reason why the number of attacks in 2025 may not match their 2024 peak — they face myriad challenges, including from resurgent terrorist threats across the ideological spectrum and growing pressure from Chinese intelligence activities, which are diverting scarce resources; these constraints are only worsened by the fact that the United States has wound down efforts to counter Russian threats.

• On March 19, Reuters reported that an effort across the U.S. federal government to counter Russian hybrid warfare has largely stopped operating. This is particularly notable because this effort was reportedly the main way in which Washington shared intelligence about Russian sabotage with its European allies, and meetings between the two sides have reportedly stopped occurring.
• Multiple top European security officials and publicly released intelligence assessments recently have warned about Russia's ongoing interest in targeting Europe with various forms of hybrid warfare. On March 4, Finland's chief intelligence agency, SUPO, warned that Russia would continue to target Europe even if the Ukraine war winds down, and Russian intelligence may even have more capabilities to do so if a de-escalation in Ukraine frees up Russian intelligence resources to be redirected to Europe.
• In recent weeks, especially as Washington and Moscow have begun to draw closer together, rhetoric from top Russian officials and state media has begun to emphasize Europe as Russia's primary adversary, indicating that the Kremlin foresees a long-term standoff with Europe, regardless of what happens in Ukraine.

If European countries ramp up support for Kyiv, particularly by deploying peacekeepers outside a framework agreed upon during U.S.-Russia talks, the Kremlin would be more likely to escalate its operations, in turn raising the likelihood of causing casualties and larger disruptions to critical infrastructure. With the Trump administration in the United States indicating that it expects Europe to take the lead in future assistance to Kyiv as the United States winds down assistance, European leaders are discussing many ways in which to continue supporting Ukraine. The most aggressive step under discussion is to deploy thousands of peacekeepers to Ukraine to provide a visible security guarantee against further Russian encroachment. For the foreseeable future, this idea appears unlikely as thus far Russia's refusal to entertain the idea and the U.S. insistence that it will not provide a "backstop" in the form of intelligence, logistics and other support. However, if European states move forward with such actions outside a framework agreed upon in U.S.-Russia negotiations — especially if they deploy troops — Russia will be more likely to escalate hybrid warfare against those countries. Even if the deployment never materializes, if European states increase military, financial and other assistance for Ukraine — potentially driven by the United States ending or significantly curbing its support — the Kremlin would also have strong motivations to escalate its targeting of European states. France and the United Kingdom are leading the effort to put together a peacekeeping force, making them particularly at risk, with Denmark, Lithuania and Sweden thus far also saying they would be willing to deploy soldiers — and thus are also at an elevated risk. Absent a deployment, other states that are particularly hawkish against Moscow and supportive of Kyiv, such as most Baltic and Nordic states, Germany, the Netherlands and Poland, would also be at higher risk. The Kremlin would still have reasons to avoid flagrant attacks resulting in mass casualties to avoid sparking more direct NATO intervention in support of Ukraine, but Moscow nonetheless would still be more likely to escalate its asymmetric actions in retaliation. These could include more frequent acts of targeted violence and more expansive types of property destruction, which would more seriously threaten to cause casualties. Moreover, Russia could increase the intensity of both its physical and cyberattacks against critical infrastructure — such as causing larger power outages or cuts to digital communications — threatening greater disruptions to business continuity and daily life, and potentially also eventually resulting in casualties depending on the scope and scale of critical infrastructure disruptions.

• Numerous Western cybersecurity firms and security officials have detailed Russia's efforts to probe the networks of critical infrastructure operators in Europe, but Russia could escalate its cyberwar against European targets by deploying new or activating previously pre-positioned malware to disrupt networks and potentially even cause physical damage.
• On Feb. 27, while addressing leaders of Russia's FSB intelligence service, President Vladimir Putin publicly warned "Western elites," widely believed to be a reference to European leaders, against trying to sabotage the country's emerging rapprochement with the United States. Putin then threatened to use "all possibilities when it comes to diplomacy and our intelligence services to disrupt such attempts," suggesting further, and potentially more aggressive, hybrid operations on European soil are on the table.
• Even if a European peacekeeping deployment to Ukraine does not occur, European countries are embarking on a massive process of military rearmament largely directed against Russia. This process will stoke Russian grievances in the coming years and will also incentivize the Kremlin to sustain, and possibly escalate, destabilization across Europe in response.