Fake videos and sabotage: What Russia is aiming for with its hybrid attacks

Russian hybrid attacks have escalated with a series of coordinated disruptions targeting Germany’s political stability and infrastructure, according to multiple reports. The tactics include deepfake videos, sabotage campaigns, and cyber-enabled disinformation aimed at undermining public trust in democratic institutions. These actions, attributed to Russian operatives, have been linked to efforts to deepen societal divisions and weaken confidence in governance ahead of key elections. The latest wave of interference began in late 2023, with the deployment of AI-generated videos designed to spread false allegations against political figures. According to the German Federal Interior Ministry, these videos contain fabricated claims of corruption, addiction, populism, clientelism, and antisemitism. One notable case involves Eric Stehr, a candidate for the Left Party in Saxony-Anhalt, who was falsely accused in a deepfake video of murdering his grandmother. The video used logos and designs from well-known German media outlets to mimic authenticity, making the content appear credible to viewers. In addition to digital manipulation, physical sabotage has also emerged as a tool in Russia's hybrid strategy. From May 2023 through July 2024, the Bavarian Office for Constitutional Protection recorded over 2,250 such campaigns, which were clicked more than 250,000 times. While these numbers reflect only two identified servers, experts suggest the actual scale of these operations could be significantly larger. The campaigns often feature misleading information intended to sway public opinion and create confusion among voters. Beyond online disinformation, real-world sabotage has targeted critical infrastructure. In December 2024, shortly before the federal election, more than 270 vehicles across four German states had their exhaust pipes blocked with foam. Initially suspected to be the work of climate activists, the perpetrators were later identified as low-level agents operating under Russian influence. These individuals, typically young men with pro-Russian leanings, are recruited via messaging apps like Telegram and paid in cryptocurrency. Their actions are part of a broader effort to disrupt public life and sow unrest. Another form of disruption has involved the deliberate damage of underwater cables connecting Germany and Finland. In early 2024, several data and power lines in the Baltic Sea were sabotaged, affecting communications and energy flows. Finnish authorities detained an oil tanker named Eagle S, which had departed from Saint Petersburg under the flag of the Cook Islands. They alleged that the crew intentionally dragged the anchor across the seabed to damage cables. However, a Finnish court dismissed the charges in October 2025, citing the applicability of international maritime law rather than domestic criminal statutes. The case highlights the legal complexities surrounding state-sponsored sabotage and the challenges of holding foreign actors accountable. These incidents underscore a pattern of low-profile, yet impactful, operations carried out by Russian-backed networks. By using untrained agents and indirect methods, Moscow aims to avoid direct attribution while still achieving its goals of destabilization. This approach aligns with broader strategies observed in other regions, where hybrid warfare blurs the lines between conventional conflict and subversion. As investigations continue, the focus remains on identifying and countering the mechanisms through which these attacks are executed.