Understanding Russia’s Sub-Threshold Operations: A European Perspective

The collapse of the Soviet Union in the early 1990s reshaped the geopolitical map of Europe. Former Soviet satellite states embraced democracy and aligned with the European Union and NATO. While this shift was viewed as a positive step toward freedom and democracy in the West, Moscow viewed it as a direct encroachment on its sphere of influence. This perceived loss of buffer zones explains much of Russia’s contemporary strategy, particularly in regions like Ukraine and Belarus, which Moscow sees as vital to its security. Populist politicians have embraced this sense of imminent danger from the West to justify military engagements in the Caucasus and central Asia, as well as in Ukraine, and to ferment sub-threshold operations across Europe. 

The overarching goal of Russia’s sub-threshold operations is to weaken and divide Europe while undermining NATO and the EU. This strategy is executed through a range of measures designed to exploit political, social, and economic vulnerabilities. In recent years, these efforts have targeted everything from democratic institutions to key infrastructure.

Election interference has been a prominent feature of Russia’s tactics. By spreading disinformation and providing financial support to sympathetic candidates and political parties, Russia seeks to influence electoral outcomes across Europe.

Assassinations and acts of sabotage are another hallmark of Russian sub-threshold operations. High-profile incidents, such as the killing of defectors abroad, have highlighted the lengths to which Russia is willing to go. Sabotage of critical infrastructure—ranging from power grids to transportation networks—has become increasingly common.

Economic manipulation also plays a significant role in Russia’s strategy. By leveraging energy dependence and engaging in financial corruption, Moscow exerts significant influence over certain European countries. For instance, nations with deep economic ties to Russia, such as Hungary and Italy, often experience less overt interference, as these relationships serve Moscow’s interests in other ways. 

An essential element of Russia’s operations is the cultivation of influence within European societies. This influence can take many forms, ranging from outright allies to unwitting enablers. In some cases, prominent politicians openly align with Moscow’s agenda, providing a certain level of legitimacy to its actions and propaganda. Others may serve as apologists, justifying or downplaying Russian aggression. Still others, often referred to as "useful idiots," may use Russian money or backing to advance their own careers, without considering that their actions effectively “launder” the reputations of those in the Russian hierarchy.  

This dynamic is particularly evident in the media, where figures across the political spectrum sometimes adopt positions that align with Russian interests. By fostering such divisions, Moscow not only undermines political consensus but can also create broader mistrust of Western institutions. 

The language used to describe Russia’s actions can obscure the true nature of these activities. Western governments are reluctant to label certain acts—such as sabotage or assassination—as terrorism, which reflects the political and legal challenges in the zone of deniable operations. This serves Russia’s interests by creating doubt and delaying decisive responses.

Such acts of arson, sabotage, and targeted killings, for example, would typically be classified as terrorism if carried out by non-state actors. However, when perpetrated by a state like Russia, they are framed in less definitive terms. This discrepancy not only complicates efforts to hold Moscow accountable but also highlights the importance of clear and consistent language in addressing sub-threshold threats. 

The landscape of Russian sub-threshold operations is evolving rapidly. Over the past year, there has been a noticeable increase in the frequency and intensity of these actions, particularly in areas like cyberattacks, infrastructure sabotage, and disinformation campaigns. As Europe approaches a series of critical elections in 2025, including those in Germany, Poland, and Albania, the potential for interference is high. In the US, President Donald Trump has returned to office for a second term, and the impacts on relations with Moscow and Europe will take time to become clear.

At the same time, Russia’s actions carry risks for Moscow itself. Overreach, such as assassinations, could provoke a backlash among countries that are traditionally more neutral. It could also strengthen the resolve of European states to counter Russian aggression collectively, in the way that the full-scale invasion of Ukraine was counterproductive as it prompted Finland and Sweden to join NATO. The first several months of 2025 will be crucial in determining whether Europe can effectively respond to these challenges or whether Moscow will continue to exploit divisions and vulnerabilities.

Russia’s sub-threshold operations represent a complex and multifaceted threat to European security. Addressing this challenge requires a coordinated and proactive approach, including stronger cyber defenses, greater transparency in political financing, and robust countermeasures against disinformation. It also demands a clear-eyed understanding of the historical and geopolitical factors driving Moscow’s actions. The pace and scope of these operations is unpredictable, and therefore, the international community must remain vigilant.  

Learn more about leveraging our industry-leading regional and subject matter experts for intelligence that helps your organization stay ahead of geopolitical risks that could impact your people and operations.