War doesn’t always look like war anymore. Hybrid non-kinetic warfare is an increasingly popular means for threat actors to orchestrate prolonged campaigns aimed at achieving political and security objectives by destabilizing the adversary, eroding its strength and social cohesion, while avoiding the creation of a pretext for military retaliation. The goal is to wreak chaos with invisible hands from an anonymous cloak, absent a military, uniforms or declaration of war.
The Iranian conflict is a real-time case study in how warfare is being reshaped. In recent weeks, Iran-linked hackers have targeted critical infrastructure in the US, disrupting multiple oil, gas and water facilities. Tehran-linked hackers likewise disrupted operations at a major US medical device maker – among other things, they hacked into an emergency system that first responders use to communicate patient data to hospitals. A high-ranking US security official saw his personal email hacked and exposed by Iranian affiliates. Iranian hacktivists celebrated efforts like this with – of all things – Lego propaganda.
Hybrid non-kinetic warfare is not confined to the physical battlefield and has no regard for borders. Hybrid tactics are low-cost, low-risk and hard to trace. These tactics are effective where traditional firepower isn’t, and they’re quietly reshaping the future of conflict.
They’re also exposing how unprepared many governments remain for threats that don’t arrive with missiles or tanks. Modern warfare and defense preparedness hinges on our ability to adapt to the new realities of hybrid non-kinetic warfare. The technologies used to combat these threats must likewise adapt.
AN AMORPHOUS ARSENAL
The tools of hybrid non-kinetic warfare are varied and very dangerous in and of themselves – especially so when applied in concert.
High-impact sabotage operations are a frequent, favored tactic. Russia, for example, is known to target civilian infrastructure via hybrid pressure campaigns intended to influence Ukraine war outcomes. In Poland, these attacks include an arson attack on a massive shopping center that gutted 1,400 shops, and more recently, an orchestrated railway explosion. Dozens of these vandalism, arson and sabotage attacks have been mounted and documented since the February 2022 Russian invasion into Ukraine.
Disinformation and propaganda are likewise commonly employed. We see this in coordinated campaigns – online and offline – to spread false narratives, divide societies and support politicians who align with the attackers’ goals. Sounding the alarm, Italy’s Defense Minister has urged the European community to protect itself from Russian disinformation tactics seen recently in Italy.
“We are under attack, and the hybrid bombs keep falling,” he said.
Cyberattacks play a role too. These can target critical infrastructure – power grids, hospitals, transportation systems, government websites – and they’re often timed to sow confusion or weaken public trust.
In a recent twist, cyberattacks have been blended with traditional warfare – investigations have uncovered Iran’s use of "cyber-enabled kinetic targeting" before and after real-world missile attacks against ships and land infrastructure. By hacking into CCTV cameras, among other methods, Iranian advanced persistent threat (APT) groups have successfully gathered intelligence on real-world targets.
Irregular or engineered migration is increasingly employed in hybrid non-kinetic campaigns. In some cases, governments deliberately funnel large numbers of migrants toward their adversary’s borders – not to help the migrants, but to overwhelm border systems and create political tension. We’ve seen this tactic used at the Belarus-Poland border, and between Russia and Finland, and it works because it creates pressure from every direction – on border patrols, on social services, on local communities and governments and beyond.
Political interference is another established tactic that’s gained new relevance in contemporary hybrid non-kinetic warfare. Russia’s known interference in the states of Ukraine, Georgia and Moldova is aimed at preventing them from shifting allegiances toward the West. This interference often peaks during election seasons.
These tactics on their own are often regarded as isolated threats. In combination, they comprise a potent, long-term war campaign – a strategy to reshape a community or region without ever sending in troops.
THE ART OF HYBRID WAR
Hybrid non-kinetic warfare looks disorganized on its surface, but there’s a logic behind it – a playbook. In plain terms, these are the core principles.
Be flexible and move fast. These operations are constantly evolving. If threat actors see an opportunity – like a protest, an election, a scandal – they join the fray and make it worse. The goal is to stir the pot, to cause unrest.
Destabilize from within. These attackers seek to weaken the glue that holds communities and countries together – trust, unity, stability. They want people to feel divided, unsafe and unsupported.
Use every tool available – military and civilian. Physical sabotage, cyberattacks, media campaigns, migrant flows and financial pressures are all part of the hybrid non-kinetic playbook. Shadowy attacks spur dark rumors that metastasize into fear. Anything that causes confusion or disruption is fair game.
Think long-term. These aren’t one-off attacks. They’re slow, strategic campaigns – sometimes unfolding over months or years. They’re designed to wear a country down, applying constant stress.
Make it hard to know what’s really happening. There are no uniforms, no flags, no announcements to make sense of – just a series of “incidents” that seem disconnected – until you step back and connect the dots.
HOW TO CONNECT THE DOTS
Combatting hybrid non-kinetic warfare requires closer security and intelligence collaboration, and a coordinated, systematic, multi-agency response that extends across borders. It requires a fresh approach to defense spending that prioritizes continuous intelligence monitoring and analysis in parallel with conventional battlefield weaponry.
Resilience doesn’t just come from defense. It comes from understanding, and this clarity can only be achieved with a holistic view of the threat landscape and the ability to surface patterns from the chaos.
At the technology layer, homeland security and intelligence organizations will benefit from a centralized architecture that unites border protection, financial investigations, tactical operations and cyber intelligence in a single cohesive view. The advent of data fusion technology, AI investigative analytics and decision intelligence automation makes it possible to sift mountains of disparate data streams to gain immediate, actionable insights.
Warfare is no longer measured in terms of physical destruction and territorial command because the boundaries of warfare are blurring. Acts of hybrid non-kinetic warfare may look like random crimes and provocations to the untrained eye – their amorphous nature is what makes them so insidious and effective.
To help investigators understand how and why these seemingly random acts intersect and identify the proxy groups responsible, it’s essential to employ an early warning system that invites and unites intelligence from diverse disciplines and geographies. In this way, we can equip intelligence agencies to recognize acts of hybrid non-kinetic warfare in real-time and anticipate them before they happen again.
The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.
Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.
Read more expert-driven national security insights, perspective and analysis in The Cipher Brief
