In February 2024, Romanian intelligence services uncovered a sophisticated influence operation that had manipulated nearly 800,000 social media accounts to promote far-right presidential candidate Călin Georgescu through TikTok’s algorithm. The operation, attributed to Russian actors, combined artificial intelligence-generated content, coordinated inauthentic behavior, and precisely targeted messaging to thrust an unknown candidate from 5% to first place in Romania’s presidential election—before the Constitutional Court ultimately annulled the results. This incident exemplifies the evolution of hybrid warfare into what experts now term “Hybrid Warfare 2.0”: a sophisticated blend of disinformation campaigns, cyberattacks, economic coercion, and proxy conflicts that operates below the threshold of conventional war while achieving strategic objectives traditionally requiring military force.
Unlike traditional warfare’s clear battle lines and uniformed combatants, hybrid warfare exploits the gray zone between peace and war, targeting democratic institutions, social cohesion, and decision-making processes. Russia’s interference in Western elections, China’s economic coercion campaigns, and Iran’s proxy network across the Middle East demonstrate how state and non-state actors now wage conflicts through information manipulation, cyber operations, and plausibly deniable activities. The challenge for policymakers lies in recognizing these hybrid threats while developing proportionate responses that don’t inadvertently escalate conflicts or undermine the very democratic values they seek to protect.
Evolution of Hybrid Conflict
Hybrid warfare concepts trace back to ancient strategies of deception and subversion, but the digital age has exponentially expanded their scope and effectiveness. Soviet-era “active measures” provided early blueprints for information warfare, while China’s “Three Warfares” doctrine—psychological, media, and legal warfare—established frameworks for comprehensive influence operations that avoid direct military confrontation.
The 2014 Russian annexation of Crimea marked a watershed moment, demonstrating how hybrid tactics could achieve territorial conquest with minimal conventional military engagement. Russian forces operated without insignia while information operations created confusion about events on the ground, and cyber attacks disrupted Ukrainian communications. This template has since been refined and exported globally, from election interference operations in Western democracies to influence campaigns in Africa and Latin America.
Modern hybrid warfare differs from earlier forms through its exploitation of digital connectivity, social media algorithms, and the speed of information flow in democratic societies. Where Cold War-era influence operations required years to shape public opinion, today’s hybrid actors can amplify divisions and manipulate perceptions within weeks or even hours of major events.
Four Pillars of Hybrid Warfare 2.0
Information Operations and Cognitive Warfare
Contemporary information warfare transcends traditional propaganda by leveraging big data analytics, artificial intelligence, and behavioral psychology to target specific audiences with precision-crafted narratives. Russia’s Internet Research Agency, exposed following the 2016 U.S. elections, demonstrated how small teams could achieve massive reach through coordinated social media manipulation, generating millions of impressions with relatively modest resources.
The concept of “cognitive warfare,” now formally recognized by NATO as the seventh domain of warfare, targets human cognition itself rather than merely spreading false information. These operations exploit cognitive biases, emotional triggers, and existing social divisions to reshape how populations perceive reality. China’s influence operations during the COVID-19 pandemic exemplified this approach, promoting conspiracy theories about U.S. biological weapons while positioning China as a responsible global leader providing medical assistance.
Artificial intelligence has revolutionized information operations by enabling the creation of synthetic media—deepfakes, AI-generated text, and fabricated audio—that can be produced at scale and distributed across multiple platforms simultaneously. The Russian state media outlet RT reportedly invested heavily in AI-generated content capabilities, allowing small teams to produce massive volumes of tailored disinformation for different regional audiences.
Cyber Operations and Digital Infrastructure Attacks
Cyber warfare has evolved from isolated hacking incidents to sustained campaigns targeting critical infrastructure, democratic processes, and economic systems. The 2015 and 2016 cyber attacks on Ukraine’s power grid, attributed to Russian actors, demonstrated how digital weapons could achieve physical effects comparable to conventional military strikes while maintaining plausible deniability.
The SolarWinds hack, discovered in 2020 and attributed to Russian intelligence services, compromised over 18,000 organizations globally, including U.S. government agencies and Fortune 500 companies. The operation’s sophistication and scope illustrated how cyber capabilities now enable intelligence collection and influence operations at previously impossible scales, with effects lasting years after initial penetration.
Ransomware attacks have become a preferred tool for both criminal organizations and state actors seeking to generate revenue while disrupting adversary capabilities. The Colonial Pipeline attack in 2021, which temporarily shut down the largest fuel pipeline system in the United States, demonstrated how cyber operations against private infrastructure can achieve strategic effects without directly targeting government systems.
Economic Coercion and Supply Chain Manipulation
Economic warfare has become increasingly sophisticated, moving beyond traditional trade disputes to encompass supply chain manipulation, technology transfer coercion, and financial system weaponization. China’s restriction of rare earth element exports to Japan following the 2010 Senkaku Islands incident illustrated how control over critical materials could be leveraged for geopolitical advantage.
The weaponization of economic interdependence accelerated during the COVID-19 pandemic, as nations discovered their dependence on single-source suppliers for critical goods. China’s initial restrictions on medical equipment exports, combined with widespread shortages of semiconductors and other manufactured goods, highlighted vulnerabilities in globalized supply chains that could be exploited during crises.
Digital currencies and financial technologies have created new vectors for economic warfare. China’s development of a central bank digital currency (CBDC) aims to reduce reliance on the U.S.-dominated SWIFT financial messaging system, while cryptocurrency ecosystems provide new mechanisms for sanctions evasion and illicit finance that complicate traditional economic pressure tactics.
Proxy Conflicts and Plausibly Deniable Operations
Proxy warfare has evolved beyond traditional arms transfers to include comprehensive support packages encompassing training, intelligence, logistics, and technological capabilities. Iran’s support for the Houthis in Yemen demonstrates this evolution, providing not only weapons but also targeting intelligence, maintenance support, and operational planning that enables asymmetric capabilities against better-equipped adversaries.
The Wagner Group’s operations across Africa, Eastern Europe, and the Middle East illustrate how private military companies serve as instruments of state policy while providing plausible deniability. These organizations can conduct operations that would be politically or diplomatically costly if attributed directly to state actors, while generating revenue through resource extraction and security contracts.
Non-state actors have gained unprecedented capabilities through technology diffusion and state sponsorship. Hezbollah’s precision missile program, developed with Iranian support, has evolved from crude rockets to guided munitions capable of striking specific targets throughout Israel, fundamentally altering regional deterrence dynamics without direct Iranian military involvement.
Modern Hybrid Warfare
Ukraine: The Complete Hybrid Campaign
The ongoing conflict in Ukraine represents the most comprehensive example of hybrid warfare in practice, combining all elements of modern gray-zone tactics with conventional military operations. Beginning in 2014, Russian hybrid operations included cyber attacks on Ukrainian infrastructure, information campaigns designed to legitimize separatist movements, economic pressure through energy cutoffs, and the deployment of “little green men”—unmarked special forces that enabled territorial seizure while maintaining deniability.
The 2022 escalation to full-scale invasion was preceded by months of hybrid operations designed to weaken Ukrainian resistance and fracture Western support. Cyber attacks targeted government communications and financial systems, while information operations promoted narratives about Ukrainian corruption and Western abandonment. Simultaneously, Russia positioned conventional forces along Ukraine’s borders to create psychological pressure and complicate Western decision-making.
Ukraine’s response has demonstrated both successful adaptation and ongoing vulnerabilities to hybrid tactics. The government’s rapid mobilization of civilian volunteers for cyber defense, combined with partnerships with international technology companies, helped maintain critical digital infrastructure despite sustained Russian attacks. However, Russian disinformation campaigns continue to exploit political divisions within Ukraine and among its international supporters.
China’s Gray-Zone Campaign in the South China Sea
China’s approach to territorial disputes in the South China Sea exemplifies sophisticated gray-zone tactics designed to achieve strategic objectives without triggering military responses from regional powers or the United States. The campaign combines infrastructure development on disputed features, coordinated operations by fishing vessels and coast guard units, legal warfare through international forums, and information operations promoting historical claims.
The construction and militarization of artificial islands in disputed waters illustrates how hybrid tactics can create irreversible facts on the ground. China’s use of civilian fishing vessels—supported by maritime militia forces—creates complex scenarios for adversary responses, as defensive actions against ostensibly civilian vessels risk escalation while inaction enables continued encroachment.
Chinese information operations supporting South China Sea claims demonstrate coordination across state media, academic institutions, and social media platforms to promote narratives about historical sovereignty while portraying other claimants as aggressors threatening regional stability. These campaigns target both domestic Chinese audiences and international opinion, seeking to normalize Chinese control over disputed territories.
Russia’s African Expansion Through Hybrid Means
Russia’s growing influence across Africa demonstrates how hybrid warfare tactics can achieve strategic objectives in regions where direct military intervention would be costly or politically unfeasible. Russian operations combine private military contractors, disinformation campaigns, resource extraction deals, and diplomatic initiatives that collectively challenge Western influence while avoiding the responsibilities of formal military commitments.
Wagner Group operations in the Central African Republic, Mali, and Sudan have provided security services to local governments while securing access to mineral resources and military bases. These arrangements create mutual dependencies that serve Russian strategic interests while providing host governments with capabilities they cannot afford through traditional military procurement.
Russian information operations across Africa exploit legitimate grievances about colonial history and contemporary Western policies, promoting narratives that position Russia as a partner offering security and development assistance without political conditionality. These campaigns utilize local media partners, social media influencers, and cultural programs to build favorable perceptions of Russian involvement.
NATO and Western Responses
Western responses to hybrid warfare have evolved from reactive measures to proactive strategies designed to deter, detect, and counter gray-zone activities. NATO’s recognition of hybrid threats as Article 5 challenges—potentially triggering collective defense obligations—represents a significant doctrinal evolution, though the alliance continues to grapple with attribution challenges and proportional response dilemmas.
The establishment of NATO’s Counter Hybrid Support Team and the European Union’s East StratCom Task Force demonstrates institutional adaptation to hybrid threats. These organizations focus on early warning, rapid response, and building resilience among member states while coordinating responses to identified hybrid activities.
However, Western responses face inherent challenges in democratic societies that value free speech, open markets, and transparent governance. Measures designed to counter disinformation risk censorship accusations, while efforts to secure critical infrastructure must balance security concerns with economic efficiency and civil liberties.
The development of “active defense” concepts—preemptive responses to identified hybrid threats—raises questions about escalation and the rule of law. Western democracies struggle to match the speed and deniability of authoritarian hybrid operations while maintaining democratic accountability and legal constraints on government action.
Strategic Implications for Global Security
Hybrid warfare’s proliferation creates several challenges for international stability and existing security frameworks. The blurring of peace and war complicates alliance obligations, as partners struggle to determine when hybrid activities warrant collective responses and what forms those responses should take.
The success of hybrid tactics in achieving strategic objectives below the threshold of conventional conflict creates incentives for their proliferation among state and non-state actors. As costs decrease and effectiveness increases, hybrid warfare capabilities may become standard tools of international competition, potentially destabilizing regions where conventional deterrence mechanisms remain effective.
The targeting of civilian populations and infrastructure through hybrid means raises questions about the protection of non-combatants in modern conflict. Traditional laws of armed conflict provide limited guidance for information operations designed to manipulate democratic processes or cyber attacks that temporarily disrupt civilian services without causing permanent damage.
The global nature of hybrid threats requires unprecedented international cooperation, yet such cooperation is often hindered by the same divisions that hybrid actors seek to exploit. Building effective responses requires sharing intelligence, coordinating policies, and maintaining unity of purpose among allies who may have different threat perceptions and strategic priorities.
Building Resilience in the Hybrid Age
Defending against hybrid warfare requires comprehensive approaches that address vulnerabilities across multiple domains simultaneously. Media literacy programs, cybersecurity investments, supply chain diversification, and institutional reforms can build societal resilience against hybrid attacks while preserving democratic values and open societies.
The challenge for policymakers lies in developing responses that are both effective against hybrid threats and sustainable within democratic frameworks. Success will require not only defensive measures but also positive visions for international cooperation that can compete with authoritarian alternatives in the global marketplace of ideas.
As hybrid warfare continues to evolve, the test for democratic societies will be whether they can adapt their institutions and responses quickly enough to counter these threats while maintaining the openness and freedom that make them worth defending. The future of international security may well depend on this balance between security and liberty in an age of persistent competition.
