Hybrid threats span both hardware and politics, said Colonel Sönke Marahrens. The list of methods includes overflights, the cutting of undersea cables, and a concerted disinformation campaign. It also reaches into political and judicial systems, including what he called the "disposable agent" model —civilians recruited online for one-off sabotage or surveillance. As a model for how the state should respond, Colonel Marahrens pointed to Finland. Authorities there detained a suspected sabotage vessel within an hour of Baltic Sea cable damage.

Russian hybrid attacks: a political shift acknowledged late

Recognition had arrived slowly, Marahrens told the New Age Defence forum in Berlin on 8 June, Ukrinform reported. "Germany recognized rather late that we are being attacked by such hybrid methods," the colonel said. "But I would say that in the last year and a half to two years, we see a shift at the political level as well."

The colonel heads a department at the Bundeswehr's Center for Digitalization and Capability Development. The center reports to the Cyber and Information Domain Command in Bonn. German intelligence services and state institutions are increasingly informing citizens of the changing security environment, he said.

Drones, cables, and courts

Russian pressure now reaches beyond physical sabotage, Marahrens said. "It's not just drones and not just undersea cables, it's also disinformation within our society. It's the use of the political and judicial systems, the concept of 'disposable agents,'" he said.

Unidentified drones over European critical infrastructure, including German sites, had a primarily psychological effect, the colonel said. The impact was not military. Germany's National Security Council should receive real powers for rapid decision-making, he argued. The colonel cited Finland's response time of less than an hour after the Baltic Sea cable damage.

"Creating societal resilience is something we in Germany have yet to learn." — Col. Sönke Marahrens, Bundeswehr Center for Digitalization and Capability Development

Kyiv's resilience is something Berlin lacks

Germany draws on Ukrainian wartime experience through financing, joint training, and front-line exchanges, Marahrens said. "We support Ukraine financially," he said. "We also adopt the experience gained from the battlefield. We provide training for them, and we also adopt experience from them during joint exercises at our training grounds."

The most important Ukrainian lesson, the colonel said, is societal resilience under wartime conditions. "Creating societal resilience is something we in Germany have yet to learn," Marahrens said. The Kremlin coordinates large-scale hybrid operations across Europe, the agency added. These campaigns aim to discredit Kyiv and inflame internal conflicts in EU states amid Russia's war on Ukraine.

"No country in Europe is off Russia's target list since its invasion of Ukraine," Kallas said.

Pro-Ukrainian partisan movement ATESH says its agents carried out a sabotage operation at a railway station in Russia’s Voronezh Oblast, destroying a rare heavy-duty rail recovery crane used by Russian Railways.

The group said the target was an EDK-300/5 rail recovery crane, a specialized system used for large-scale emergency rail restoration work. ATESH claims the equipment is no longer in production and exists in only limited numbers across Russia’s rail network.

According to the statement, the crane was designed for heavy railway accident response tasks, including lifting derailed rolling stock, clearing damaged infrastructure, and restoring traffic on key lines. It reportedly had a lifting capacity of up to 300 tons.

“Even in the deep rear, critical equipment is not safe from destruction”

ATESH said the loss of the crane would reduce Russia’s ability to rapidly repair damaged rail infrastructure, particularly at major transport junctions where recovery speed is critical for maintaining logistics flows.

The group added that the impact of the loss would be long-lasting, saying: “Replacement of the destroyed crane will require significant time and resources. While Putin’s army searches for a replacement, the railway hub and regional logistics are operating with limited recovery capacity.”

“Even in the deep rear, critical equipment is not safe from destruction,” they added.

The report has not been independently verified.

ATESH: sabotage network operating inside Russia

ATESH is a clandestine resistance network operating inside Russian-controlled territory and within Russia itself. The group says it focuses on reconnaissance and sabotage operations against military, transport, and communications infrastructure that it considers to be supporting Russia’s war effort against Ukraine.

ATESH statements are typically released via Telegram and often include claims of damage to rail assets, depots, and logistical hubs. The group also claims to have agents operating inside the Russian armed forces, which it says helps it gather intelligence and identify targets.

Wider campaign targeting Russian logistics infrastructure

The operation is part of a wider campaign aimed at disrupting Russian transport infrastructure, which the group says supports both civilian logistics and military supply chains.

ATESH has increasingly focused on rail assets inside Russia, arguing that even limited damage to specialized equipment can create disproportionate delays across tightly connected transport networks.

Previous claimed strike in Saint Petersburg

In a previous claimed operation in May, ATESH said its agents set fire to a locomotive in Saint Petersburg used for oil transport, taking it out of service and disrupting rail operations in Russia’s northwestern logistics network.

The group said the locomotive had been part of fuel transport routes linked to industrial supply chains and export corridors in the northwest of the country, including areas connected to port infrastructure.

A locomotive used in oil transport was set on fire in Saint Petersburg, Russia, according to claims from the partisan network ATESH.

The group says its agents carried out the sabotage operation, taking the engine out of service and disrupting rail logistics tied to fuel and… pic.twitter.com/2c6ChkG7TR

— Euromaidan Press (@EuromaidanPress) May 21, 2026

Russia "intends to harm" the UK through economic disruption, sabotage, and "dark arts", and the evidence is clear, former UK Chief of the Defense Staff Stuart Peach told The Independent. His claims came in a joint interview with the chair of the House of Lords Select Committee on National Resilience, Baroness Coussins, who called for greater urgency from government and citizens.

The intervention is one of the most direct public warnings from senior UK figures on Russian hybrid operations against Britain. Peach is now making the case publicly that the threat has shifted from speculative to operational.

Baroness Coussins, whose committee was appointed in January 2026 and is due to report in November, framed it more bluntly: "It is not a question of 'what if?’ It's a question of 'these things are happening now.' We know we’re under cyber attack daily." 

"The evidence is clear"

“The fact that Russia intends us harm – whether it's economic disruption or the ‘dark arts’, as you might call them – I think the evidence is clear," Peach said.

He warned that the UK is not prepared for the scale of scenarios that could result, including widespread power cuts and full-scale war. 

Baroness Coussins added that British intelligence services regularly identify and disrupt potential violent threats inside the country and pointed to the activities of so-called proxy structures linked to Russia and Iran. 

Undersea cables and European pattern

Peach said the threat to the UK posed by undersea cable disruption, which carries internet connectivity, financial transactions, and essential data, was an issue he had raised as Chief of the Defense Staff and one that has only sharpened since.

He pointed to a politically motivated arson attack in Berlin in January 2026 that caused a widespread power cut affecting 45,000 households and 2,200 businesses, including internet and heating.

The recent fire at an electrical substation that forced the closure of London's Heathrow Airport, causing mass flight cancellations and power disruption, was raised as a UK precedent showing how single-point sabotage can cascade across critical systems.

Lord Peach warned that malicious attacks “can have real damage.”