Russia's ability to carry out hybrid attacks suffered a setback in 2022 when European countries expelled spies operating under diplomatic cover. Now, Russia is actively rebuilding that capability and employing new tactics, Kohv said.

"Russia is now recruiting people with criminal backgrounds as well as ordinary people on social media," the research fellow said.

Kohv said the damage caused by individuals recruited in this way is often significantly greater than that done by traditional spies.

"These people generally lack specialized training in firearms or explosives. When people without knowledge of explosives set fire to certain targets, the damage to civilians — casualties and injuries — can be significantly higher," he said.

Attribution and legal proceedings can also be complex.

"Very, very often these recruited individuals do not actually know they're working for Russian intelligence services, and in such cases a trial can be more complicated because it might not be possible to prove a direct connection with Russian special services," the researcher said.

Estonia has increased its capabilities and tightened up legislation to block attacks.

"The law within the Internal Security Service's area of responsibility has been changed so that it is now possible to punish a person for the intent to cooperate with Russian intelligence services. Previously, this cooperation had to be proven, but now the intent is sufficient. I think that is an important change," Kohv said.

More attacks expected

Igor Gretskiy, another research fellow at the International Center for Defense and Security, said Russia is likely to intensify its hybrid attacks in the coming year. He believes Moscow will use all available means to stir up conflict and division in countries that support Ukraine.

Gretskiy said European countries are now significantly more aware of the threats emanating from Russia.

"At the beginning of the year, it would have been unthinkable for someone to suggest shooting down aircraft violating a country's airspace. Now, that is no longer off the table," he said.

"Threat perception is key, because Russia knows very well that a portion of Europe's political elite fears escalation, Russia is a nuclear power, and so on. Putin is clearly aware of this and exploits it. That is why he keeps raising the stakes. I predict that next year we'll hear more nuclear blackmail messages from Russia. Russian authorities have always done this in extreme situations, trying to seize the initiative,"  Gretskiy outlined.

Critical infrastructure sites

Kohv noted recent reports that Russia is monitoring and mapping various critical infrastructure sites in Europe.

"We are talking about railways, bridges. If you look back in history, to the Cold War era and the Soviet Union's sabotage doctrine, the parallels are striking," Kohv said.

To better protect underwater critical infrastructure, Kohv said international agreements need to be updated. Cooperation with other countries is essential.

"The legal framework governing international waters is outdated. It was not designed to respond to these kinds of actions," the researcher said.

"It is also important for all Baltic Sea countries to synchronize and revise their laws. We must cooperate closely on physical response as well, because Estonia's and the Baltic states' naval capabilities are more limited than those of other countries bordering the Baltic Sea," Kohv said.

Earlier this week, the head of Estonia's Foreign Intelligence Service, Kaupo Rosin, said in an interview with ERR that Russia is not planning to attack the Baltic states at the moment. He also said NATO's move to counter Russia's attacks had been effective.

--

Follow ERR News on Facebook and Twitter and never miss an update!