There is no one universally accepted definition of hybrid warfare.

Frank Hoffman helped popularize the term in 2007, when he argued that the United States would face a new kind of ‘hybrid’ threat in the 21st century, one where state and non-state antagonists would target US vulnerabilities using any and all tactics available to them. These earliest discussions focused on how irregular and hybrid tactics could be used to undermine US conventional military power.

Hoffman’s ideas were later taken up and built upon by Russian strategists. General Valery Gerasimov’s ‘New Generation Warfare’ (NGW). NGW develops themes that are now familiar in contemporary hybrid warfare; for example, the importance of information warfare in the Internet age, the utility of proxy forces, and employing cyberattacks and sabotage to target critical energy and financial infrastructure. And importantly: hybrid tactics are integrated into conventional military structures and deployed in times of war and peace.

In the contemporary context, NATO defines hybrid warfare as “threats combine military and non-military as well as covert and overt means, including disinformation, cyber attacks, economic pressure, [and] deployment of irregular armed groups… hybrid methods blur the lines between war and peace, and attempt to sow doubt in the minds of target populations. They aim to destabilize and undermine societies.”

This NATO definition captures the essence of hybrid warfare in the contemporary context: hostile acts that take place outside the scope of conventional inter-state conflict, with the intention of weakening an adversary, whether politically, economically, or militarily. Such operations can be performed by state or non-state actors, and they can serve as either a prelude or alternative to conventional war.

Hybrid Warfare in Practice

Cyberattacks

• China-backed Salt Typhoon. Salt Typhoon breached routers, switches, and lawful intercept systems containing law enforcement surveillance requests from 2022 (latest) to its discovery in 2024. It’s believed that the China state-backed group gained access to call records, message contents, and communication metadata, such that US Senator Mark Warner called the breach the “worst telecom hack in our nation’s history.” More information on Salt and the other China cyberattack ‘typhoons’ can be found here.
• Russia-backed Qilin. From January to November 2024, Qilin breached and published 135 databases, amassing over 32 terabytes of maliciously usable personal data. Targets have ranged from local governments, such as Upper Merion Township in Pennsylvania, USA, to multinational corporations. More information on Qilin and other hacking groups in the Russian space can be found here.

Sabotage

• Underseas Cable Sabotage. Several incidents of sabotage were reported involving underseas cables and pipelines in the Baltic Sea from 2022-2025. Though Russia-linked actors have been suspected in some cases, investigators have been unable to prove Moscow’s culpability. The incidents prompted a conventional military response in NATO’s ‘Baltic Sentry’ mission launched in early 2025.
• Europe Arson Attacks. Various arson and bombing attacks across Europe signal an escalation in hybrid warfare tactics after 2024. Two notable incidents are the burning down of the Marywilska 44 mall in Warsaw in May 2024 and the DHL package explosions in Birmingham, Leipzig, and Warsaw two months later. Notably, both incidents involved Russian military intelligence recruiting locals to carry out the attacks using financial rather than ideological incentives.

Disinformation

• Rise, Fall, and Reinvention of Russia Today. RT, or Russia Today, is a state-owned media company that broadcast Russian views around the world in local languages, until it was banned in most Western markets following Russia’s invasion of Ukraine. But as a previous Geopolitical Monitor article argues, RT content – much of which carries a distinct anti-West bias – continues to be disseminated through alternative channels. RT is not alone, and as a soft power tool is somewhat comparable to China’s Global Times or the United States’ Radio Free Europe, with a key and important distinction being their varying degrees of editorial freedom.
• Conflict Disinformation in Real-time. The brief military conflict between India and Pakistan in early 2025 saw another evolution in hybrid warfare, as state-linked entities on both sides sought to flood the online space with favorable narratives on how the war was progressing.