Russia’s Covert and Hybrid Warfare: The Gerasimov Doctrine in Action

Russia has, for years, employed a form of warfare that blurs the lines between open military conflict and covert operations. This hybrid warfare often operates below the threshold of conventional war and poses a serious challenge to Western nations. In particular, the so-called Gerasimov Doctrine, named after Russian Chief of Staff Valery Gerasimov, describes a strategy where military and non-military means are integrated to achieve geopolitical goals. Russia’s military intelligence service, the GRU, and its elite Unit 29155 play key roles in executing these operations. This article will explain the origins and contents of the Gerasimov Doctrine, the role of the GRU, the covert operations of Unit 29155, Russia’s global influence efforts, and how Russia is already, in effect, at war with the West—albeit in a covert, hybrid manner.

The Gerasimov Doctrine: Blurring the Lines Between War and Peace

The “Gerasimov Doctrine” emerged from a 2013 article by General Valery Gerasimov, in which he argued that the traditional boundaries between war and peace were becoming increasingly unclear. Conflicts no longer required formal declarations of war, but rather unfolded through a blend of military and non-military means  . Gerasimov observed that political, economic, informational, and other non-military tools were becoming increasingly important for strategic objectives, sometimes even surpassing the effectiveness of conventional military force . States, he argued, could destabilize a rival country through disinformation, cyberattacks, economic pressure, and the exploitation of social divisions without ever officially declaring war. Only in the final stages of such a conflict would open military engagement occur, to secure the final victory .

This doctrine proposes a fusion of military and non-military means. Asymmetric methods—ranging from guerrilla tactics and terrorism to targeted disinformation and diplomatic pressure—are combined to thwart a superior adversary  . Central to this strategy is the role of information warfare and propaganda: By spreading fake news, stoking social tensions, and carrying out “active measures” (a term from Soviet times for subversive interference), the society of an adversary is weakened from within. Gerasimov emphasized that, given the technological and conventional military superiority of the West, Russia would need to find alternative ways to safeguard its own security . The hybrid methods of combining soft (political/economic) and hard (military) power could serve to offset any power imbalance . The annexation of Crimea in 2014 is a key example of this strategy: Russian soldiers, wearing green uniforms with no insignia—referred to in the media as “little green men”—suddenly appeared on the Crimean Peninsula, seizing strategic locations  . These masked troops operated covertly, allowing Moscow, at first, to plausibly deny the invasion. It was only later that President Putin admitted they were Russian forces. The Crimea case demonstrates the principle of the Gerasimov Doctrine: A mix of disinformation (initially denying the intervention), unmarked special forces, support for local “self-defense” groups, and subsequent diplomatic assurances. Through these hybrid methods, Russia achieved its goals without formally declaring war.

The GRU: Russia’s Military Intelligence as a Tool of Hybrid Warfare

The GRU (Main Directorate of the General Staff of the Armed Forces of the Russian Federation) is Russia’s military intelligence service and one of the central players in covert warfare. Founded during the Soviet era, the GRU operated alongside the KGB and, after the collapse of the USSR, continued its operations as part of Russia’s military apparatus alongside the FSB (Federal Security Service) and the SVR (Foreign Intelligence Service) . The GRU’s role spans military intelligence gathering for the armed forces, but it also controls Spetsnaz special forces that carry out sabotage and special operations in enemy territory . Additionally, the GRU is responsible for electronic surveillance, recruiting agents abroad, and increasingly, cyber espionage and hacking .

Historically, the GRU has been involved in various military adventures by the Soviet Union, such as the interventions in Hungary in 1956 and Czechoslovakia in 1968, and was instrumental in the Afghan coup of 1979 . After the collapse of the USSR, the agency underwent several reforms. Following the lackluster performance during the Georgia war in 2008—where military objectives were achieved but significant weaknesses became evident—the Kremlin modernized its forces, including the GRU . Experts believe that, during this period, specialized units for covert operations were created . Since 2018, the GRU has been under the leadership of Admiral Igor Kostyukov, who reports directly to the Chief of Staff, Gerasimov, and Defense Minister Shoigu . This indicates that major operations with political implications—such as the use of banned nerve agents abroad—likely require approval from the highest levels in Moscow .

The structure of the GRU is secret, but it is known that it operates independently of the civilian intelligence agencies and is attached to the General Staff of the Armed Forces. Many of Russia’s aggressive foreign operations in recent years have been attributed to the GRU, giving it a notorious reputation in the West. Unlike the FSB, which is primarily responsible for domestic and “near abroad” operations, the GRU operates globally, unafraid of taking risks . The GRU combines military discipline with intelligence methods, making it ideally suited for hybrid warfare—it can operate both on the battlefield, provide intelligence, and carry out cyberattacks or plan covert sabotage operations.

A particular focus of the GRU has been offensive cyber operations: GRU hacker groups such as “Fancy Bear” have been responsible for breaking into Western institutions’ networks (including the German Bundestag in 2015 and the US Democrats in 2016) . At the same time, the GRU directs disinformation campaigns and unconventional actions. The willingness to also use paramilitary means during peacetime makes the GRU a central tool in Putin’s strategy of confrontation against the West.

Unit 29155: The Kremlin’s Shadow Warriors

Within the GRU, there are elite units tasked with particularly sensitive and covert operations. One such unit has gained notoriety in recent years: Unit 29155. This unit operates in the shadows and has been linked to sabotage, destabilization, and assassination missions . Western intelligence agencies only became aware of Unit 29155 in 2018/2019, although its operations had been ongoing for years  . Experts like Mark Galeotti have described it as the “group you send when you want to break something”  . Officially, little is known about Unit 29155—it is believed to be under the command of Russia’s special forces in Senezh near Moscow, with General Andrei Averyanov as its commander  . The unit likely receives its orders directly from the military leadership; many of its operations, especially those with international ramifications, are probably approved by the highest Kremlin authorities.

Here are some of the well-known operations of Unit 29155, which have caused shockwaves across Europe and beyond:

• Montenegro Coup Attempt (2016): On election day in October 2016, GRU agents attempted to overthrow the government of the small Balkan country, Montenegro. Their goal was to seize the parliament in Podgorica and assassinate pro-Western Prime Minister Milo Đukanović, preventing the country from joining NATO  . Two GRU officers, posing as Russian diplomats (Eduard Shishmakov and Vladimir Popov), were later convicted in absentia . Although the coup failed, it clearly demonstrated Russia’s willingness to even orchestrate a regime change in a foreign country using force.

• Sergei Skripal Poisoning (Salisbury, 2018): In March 2018, former Russian double agent Sergei Skripal and his daughter were nearly killed in the British town of Salisbury with the rare nerve agent Novichok. While Skripal and his daughter survived, an innocent British woman later died from the same chemical. British and international investigations identified two GRU agents (operating under the aliases “Ruslan Boshirov” and “Alexander Petrov”) as the perpetrators . Investigations by Bellingcat revealed their true identities as Anatoly Chepiga and Alexander Mishkin—members of Unit 29155 . This incident was a blatant violation of international norms: it marked the first time since the Cold War that a military-grade nerve agent was used in an assassination attempt on Western soil. The message behind it was clear—Russia is willing to eliminate its adversaries, even on foreign soil.

• Emilian Gebrev Poisoning (Bulgaria, 2015): In 2015, Bulgarian arms dealer Emilian Gebrev fell seriously ill after dinner—he too was poisoned with a nerve agent (similar to Novichok). Years later, investigations suggested that the same GRU cell responsible for Salisbury had been behind the attack . Unit 29155 is believed to have targeted Gebrev because he had supplied weapons to Ukraine. Gebrev narrowly survived, and the case remained unresolved for years, but today it is considered one of the first known international assassination attempts by this GRU group.

• Bounty Program on US Soldiers in Afghanistan: Perhaps the most insidious operation involved Russia allegedly paying the Taliban to kill NATO soldiers—particularly Americans—in Afghanistan . This bounty scandal came to light in 2020 through reports from The New York Times, based on information from Afghanistan’s National Directorate of Security (NDS). The NDS had discovered the network of couriers who were transporting money and instructions for the bounty program . One key figure in the network was Rahmatullah Azizi, an Afghan businessman who acted as a courier. During a raid, authorities discovered over $650,000 in cash at his home, but Azizi had already fled to Russia  . Although both the Trump administration and later President Biden dismissed the allegations due to insufficient evidence, investigative journalists (including Christo Grozev of Bellingcat) eventually confirmed the involvement of GRU Unit 29155  . They uncovered that a senior GRU officer, Lieutenant General Ivan Kasyanenko, stationed in Kabul from 2015, was likely the head of the program . This program may have been running as early as 2010, meaning there were far more attacks funded by Russia than previously acknowledged .

• Further Operations in Europe: Unit 29155 has also been linked to a series of sabotage and destabilization efforts across Europe. In 2014, they are suspected of causing an explosion at a munitions depot in Vrbětice, Czech Republic, killing two Czech nationals—likely to sabotage weapons shipments to Ukraine  . This led to a diplomatic row between Prague and Moscow in 2021. The unit is also believed to have interfered in Moldova in 2015, supporting pro-Russian groups, and even in Spain, where GRU agents were suspected of involvement in the Catalonian independence referendum in 2017  . These seemingly unrelated events were, in fact, part of a coordinated effort by Unit 29155 to destabilize Europe, prevent NATO expansion, eliminate adversaries, and generally sow chaos.

Overall, Unit 29155 operates like a Swiss Army knife for the Kremlin: the same players appear in coup attempts, poisonings, bombings, and other subversive operations. Their existence confirms that Russia views state-sponsored assassinations and sabotage as legitimate tools of foreign policy.

Russian Methods of Influence: Cyber, Disinformation, Energy, and Infiltration

Russia’s hybrid warfare extends far beyond hard sabotage operations—it is a multi-faceted strategy with numerous non-military tools at its disposal. Moscow has a wide-ranging toolbox of influence to destabilize democratic nations and advance its own interests:

• Cyberattacks and Hacking: Russian hacker groups, often associated with the GRU or FSB, have conducted numerous cyberattacks in recent years. Notable examples include the attack on Ukraine’s power grid in 2015, the global NotPetya ransomware attack in 2017, and breaches into parliamentary and ministry networks across Europe. The most high-profile case was Russia’s interference in the 2016 US election, where GRU hackers stole and leaked emails from the Democratic Party . Western intelligence services have consistently confirmed Russia’s involvement . Cyberattacks offer Russia the advantage of plausible deniability, as the perpetrators often remain difficult to identify definitively. Still, many attacks have been traced back to Moscow, showing that Russia views cyber warfare as integral to its strategy.

• Disinformation and Troll Factories: Russia also employs disinformation as a powerful tool to influence public opinion. State-run media outlets like RT and Sputnik spread propaganda in multiple languages. Even more insidiously, Russia has established troll farms, such as the infamous Internet Research Agency in St. Petersburg, which uses fake online identities to spread polarizing messages on Facebook, Twitter, and other platforms. During the US election of 2016, these fake accounts reached millions of Americans with divisive, often inflammatory content. Similar campaigns were observed during the Brexit referendum in 2016 and in elections in France, Germany, and other countries. The aim is to undermine trust in democratic processes, erode faith in the media, and amplify extremist movements.

• Political Influence and Infiltration: Russia has also directly supported certain political factions abroad. In Europe, Moscow has often favored populist, EU-skeptic parties on both the far-right and far-left. For example, Marine Le Pen’s Rassemblement National in France received loans from Russian banks; Austria’s FPÖ sought close ties to Putin; and in Italy, the Lega party under Matteo Salvini had strong connections to Moscow. These political connections create influence channels that Russia can exploit for its own benefit, such as opposing sanctions or recognizing the annexation of Crimea. Russia has also funded pro-Russian think tanks, “cultural organizations”, and lobbying groups to shape European policies in its favor. Furthermore, Russia has attempted to infiltrate the political elite through espionage—seeking to place informants in government positions across NATO states.

• Economic Pressure and Energy Dependency: Russia has long used its natural resources, particularly oil and gas, as a geopolitical tool—often referred to as “energy as a weapon”. Many European nations depend heavily on Russian gas, making them vulnerable to Moscow’s economic leverage. For example, in 2009, Russia shut off gas supplies to Europe during a dispute with Ukraine, causing major disruptions. Moscow also uses long-term contracts, pipeline projects (such as Nord Stream), and acquisitions of energy infrastructure to create dependencies. Sanctions or political decisions can then be influenced by the threat of supply cuts. Following the Ukraine invasion in 2022, Russia drastically reduced gas exports to Europe, using the energy sector to pressure Western governments to reduce support for Kyiv. In addition to energy, Russia leverages other economic tools—targeted investments, purchasing companies, and corruption of political figures or institutions to build influence.

• Infiltration of Society and Institutions: Russia also conducts cultural and information policy operations. Through organizations like Rossotrudnichestvo or the Russian Orthodox Church, Moscow maintains contact with Russian-speaking communities abroad, seeking to ensure their loyalty. In countries of the former Soviet Union, such as Latvia or Estonia, Russia uses minorities as leverage (the so-called “protection of Russian-speaking citizens”). In Western countries, Russia has supported radical groups or conspiracy theorists if they align with its narrative. One well-known example was Russia’s involvement in spreading fake news about the refugee crisis in Germany, known as the “Lisa case”, in 2016. These gray-zone activities are difficult to attribute directly to Russia but contribute to its broader goal of destabilization. Russia exploits freedom of speech in liberal democracies, using it as a tool to spread lies and incite unrest.

In sum, Russia’s strategy relies on a thousand cuts approach: no single attack is significant enough to trigger a NATO response, but collectively they undermine Western stability  . The principle of plausible deniability remains central: many of Russia’s actions remain in the shadows, and while their impact is clear, Moscow often denies direct involvement. However, as several cases in recent years have shown, the Kremlin’s fingerprints are unmistakable.

Russia vs. Other Authoritarian Actors: More Aggressive Than China, Saudi Arabia, or Turkey

Russia is not the only authoritarian regime expanding its global influence—but it does so in a particularly aggressive and ruthless manner. Comparing Russia with China, Saudi Arabia, and Turkey highlights the differences:

• China focuses primarily on economic influence, technological penetration, and diplomatic power projection. China’s strategy is long-term and focused on stability—it seeks to reshape the international system in its favor, but without creating chaos. China’s influence operations—such as supporting political sympathizers abroad, massive investments (the Belt and Road Initiative), or technology exports with hidden backdoors—are typically subtle. While China does engage in cyber espionage, its primary focus is on industrial espionage and surveillance, rather than sabotaging elections . Open aggression is avoided by Beijing, which prefers a subtle, legitimacy-based approach, while Russia thrives on direct

  destabilization and disruption. China’s tactics, though assertive, are calculated and measured; Russia, in contrast, is more reckless and unrestrained, employing covert tactics that border on the aggressive.

  • Saudi Arabia wields its influence mainly through economic power (petrodollars) and religious sway (through the promotion of Wahhabism). While Saudi Arabia employs soft power tactics to secure its regime and regional interests, it generally avoids violent methods. The murder of journalist Jamal Khashoggi in 2018 was an extreme anomaly, not part of Saudi Arabia’s usual approach to power. In comparison to Russia, Saudi Arabia’s influence is more discreet, and its foreign interventions are typically regional, focusing on securing its political interests in the Middle East, rather than challenging Western democracies globally. Russia, on the other hand, is involved in global destabilization efforts, often using covert violence, such as assassinations and sabotage, to achieve its aims.

  • Turkey, under President Erdoğan, has a strategy that blends regional power projection with efforts to influence diaspora communities. Turkey’s operations are often more overt than Russia’s and typically center on geopolitical maneuvering in the Middle East and Europe. Turkey’s efforts include providing military support to allies in regions like Libya or the South Caucasus, and influencing the Turkish diaspora in Europe. Erdoğan’s Turkey also uses a mix of diplomacy, economic leverage, and covert operations to advance its interests. However, Turkey does not engage in the high-risk, global sabotage and assassination operations typical of Russia. It is primarily focused on asserting its regional power rather than launching a global hybrid offensive. Turkey’s actions are more predictable and contained compared to Russia’s unpredictable and highly aggressive hybrid warfare.

  In summary, all of these states pursue influence, but Russia goes the furthest. Moscow does not shy away from political murders on foreign soil or from engaging in risky military actions without official insignia or from carrying out large-scale hacking and leaking of government secrets abroad. Russia’s approach is a full-scale offensive on multiple fronts, while China focuses on long-term economic entanglement, Saudi Arabia uses economic clout, and Turkey seeks regional influence. Russia’s aggressive hybrid warfare occupies a unique position—it combines the hardness of a military adversary with the cunning of a spy. No other authoritarian actor intervenes so aggressively and shamelessly in the internal affairs of Western democracies, and Russia’s tactics represent an existential threat to the international order.

  Covert War with the West?

  Given this broad array of hostile actions, one must ask: Is Russia already, in effect, at war with the West—just without the formal declaration of war? Many security experts now speak of a “gray zone conflict” or an undeclared war: Moscow’s hardliners seem to view the confrontation with the West as a permanent state of affairs. For the Kremlin, the line between war and peace is blurred—it is a conflict continuum where one can turn up the intensity when needed and dial it back when appropriate. Western democracies struggle with this concept because they traditionally distinguish clearly between times of peace and war. Putin’s Russia, however, has geared itself up for confrontation: society, intelligence services, and the military are in a kind of permanent alert, psychologically always at war. In many ways, the Kremlin has treated the West as an adversary for years, using hybrid warfare as a tool of ongoing, low-intensity conflict.

  The 2022 large-scale invasion of Ukraine, though a conventional military act, was also accompanied by continued covert operations: Russian hackers attacked Western allies of Ukraine, disinformation campaigns tried to erode Western public support for sanctions and arms deliveries, and Gazprom was used as a leverage tool to pressure governments. It is thus a multi-dimensional conflict, where Russia fights on all fronts—from the information space to the battlefield.

  In fact, Russia’s behavior toward the West could be described as “war without a declaration of war”. The sum total of its hostile acts—disinformation, cyberattacks, sabotage, assassinations—suggests a deliberate strategy aimed at weakening the West. While no formal declaration has been made, many of Russia’s actions over the last few years can be interpreted as acts of war: interfering with elections, cyberattacks on critical infrastructure, attempted regime changes, and murders on NATO territory. These actions are designed to destabilize Western democracies, weaken their unity, and create the conditions for future Russian geopolitical gains.

  Experts have warned that Russia’s actions represent an ongoing strategic conflict with the West, waged covertly rather than openly. Some analysts compare it to a “Cold War 2.0”, but with new methods and an asymmetric distribution of power. The reality, however, is that Russia’s approach is much more unpredictable and ruthless than that of the Soviet Union during the original Cold War. Russia today is more inclined to use direct subversive action, rather than relying on diplomacy or long-term political maneuvering.

  Conclusion: A Stark Warning

  Russia’s covert and strategically long-term hybrid warfare represents a massive threat to Europe, the West, and liberal democracy. The Gerasimov Doctrine—whether official doctrine or not—clearly shapes Russia’s actions: war is no longer separated from peace; it permeates every facet of our peacetime. Disinformation, cyberattacks, economic coercion, and covert military operations have become Putin’s arsenal of tools. The West must recognize that it is already engaged in a war with Russia, albeit one that operates beneath the threshold of open conflict. This covert war poses a threat not only to national security but to the very foundations of our democracies.

  This approach appears to be part of a broader strategy to revise the post-Soviet order, and perhaps even to restore or expand the Russian sphere of influence once controlled by the Soviet Union and the Warsaw Pact. Putin has himself described the collapse of the USSR as “the greatest geopolitical catastrophe” and is clearly seeking to revive Russia’s former dominance. The hybrid activities outlined above could be aimed at undermining the West’s unity, weakening its resolve, and ultimately expanding Russia’s power over neighboring countries.

  The free world must be vigilant and united in response. Russia is waging war, even if it has not formally declared it. The time to act is now—before the covert operations of the Kremlin destabilize Europe, compromise the democratic fabric of the West, and set the stage for further geopolitical aggression. The threat is real, and the danger is acute. Europe and the West must wake up to this new form of warfare, and they must act decisively to counter it before it’s too late.

  The liberal democracy we cherish is under direct attack, and only through cooperation, vigilance, and adaptation can we hope to defend it against Russia’s relentless hybrid warfare. This is the ultimate test for the West in the 21st century, and it is a challenge we must face together. The threat is already at our door. It’s time to rise to meet it.