1. Executive summary
Insikt Group (Recorded Future) published an assessment on 24 September 2026 that Russia has escalated New Generation Warfare (NGW) tactics across Europe beyond the former Soviet Union, and assesses further escalation over the next two years, potentially reaching a full-scale NGW campaign. The tactics named are influence operations, airspace and territorial-water incursions, undersea cable targeting, physical sabotage of civilian and dual-use critical infrastructure, and access-oriented offensive cyber operations against internet-facing firewalls, VPNs, email services and web portals. Insikt states that Europe-based public and private sector entities are very likely at risk and that critical infrastructure is at high risk of data loss, physical damage, or injury and death of personnel. EMEA financial services sits inside the critical infrastructure set the source describes, but the source names no financial-sector victim, no CVE, no CISA KEV entry and no atomic indicators, so this is a strategic warning rather than an incident report. The assessment is single-sourced and the attribution to Russia has no MITRE ATT&CK profile in our reference data, so we treat it as unconfirmed.
2. Regulatory framing
No specific DORA/NIS2 article is directly engaged by this item.
The item is a forward-looking threat assessment. It reports no incident at a named entity, no failure or concentration issue at an ICT third-party provider, and no testing activity, so the reporting, testing and third-party articles in the regulatory reference do not attach. DORA Art. 18 (classification of ICT-related incidents and cyber threats) is the nearest fit because the item is a cyber threat assessment, but the reference scope for that article covers classification, not a notification duty, and we have not listed it as engaged. Treat this advisory as an input to an existing Art. 18 classification process, not as a trigger for a regulatory notification.
3. Technical analysis & attack chain
This is a strategic assessment, not a technical incident report. There is no exploited component, no malware sample, no command-and-control infrastructure and no victim named in the source. What follows is how the campaign is described as operating, at the level of detail the source provides.
Insikt Group describes NGW as a Russian military strategy named by Valeriy Gerasimov, Chief of the General Staff of the Russian Armed Forces, in a 2013 article in Military-Industrial Kurier. The source states three aims: test the adversary's defensive capabilities to inform a decision on escalating to formal kinetic conflict, degrade the adversary's critical infrastructure, and sow fear in the adversary's government and population to degrade its ability to respond. Insikt assesses that Russia began using these tactics in Ukraine around the February 2014 annexation of Crimea, and that since the February 2022 full-scale invasion the use has spread across Europe well beyond the former Soviet Union, where Russian aggression had historically been concentrated.
The source groups the activity into five lines.
Influence operations have targeted public opinion in the states Moscow likely views as Kyiv's core European supporters: the UK, France, Germany and Poland. Insikt names four campaigns, Doppelgänger, Operation Overload, Operation Undercut and CopyCop, and states they have often involved impersonating national and pan-European media outlets to disseminate Kremlin propaganda.
Airspace incursions rose sharply. Insikt tracked 30 suspected violations of NATO airspace between September 2025 and January 2026, against 23 suspected or confirmed violations between March 2022 and August 2025. Poland and Romania were the most commonly targeted countries, with violations also recorded in Germany, the UK, Denmark and Norway. The source attributes the incursions to what are likely Russian drones or jets.
Territorial waters violations and undersea cable targeting are described as a means to test NATO resilience, collect intelligence, and keep NATO in a reactive, defensive posture.
Physical sabotage operations are attributed to Russia-nexus individuals and entities, a hedge the source uses rather than a formal state attribution. The stated targets are civilian or dual-use critical infrastructure that directly or indirectly supports European collective defence or Europe's material support for Ukraine. The stated purposes are to degrade that infrastructure, to propagate a narrative that Western states cannot protect their populations, and to harm NATO's ability to respond collectively.
Offensive cyber operations directed at European targets have emphasised access-oriented activity rather than disruption. The source names internet-facing firewalls, VPNs, email services and web portals as the targeted surface, and assesses the intent as intelligence collection, operational reach and long-term access rather than immediate disruption. Insikt describes the cyber activity as broad in scope, spanning multiple regions and sectors.
Confidence and gaps. Every claim above rests on a single source, the Insikt Group blog post, and the primary item and the related source are the same URL. The source's own probability language ("likely", "very likely", "potentially") is its assessment, not ours, and we have not re-scored it. The attribution to Russia has no MITRE ATT&CK profile in our reference data, so it is unconfirmed at the actor level; the physical sabotage line is attributed only to "Russia-nexus individuals and entities". The source provides no malware family, no tooling, no infrastructure, no victim organisation, no sector-level breakdown and no technical indicators. The published text is also truncated mid-sentence in the airspace incursions section, so the detail that follows that point is not available to us. Nothing in the source indicates ransomware, data theft or extortion, and we do not characterise it as such.
4. Mitigation & containment
There is no CVE and no vendor fix in this item. The actions below address exposure to, and detection of, the access-oriented activity the source describes, plus the physical and dependency risks it names.
P1, within 24 hours
- Inventory every internet-facing firewall, VPN concentrator, email gateway and web portal. These are the four surfaces the source names as the emphasis of Russian cyber activity against European targets. Confirm each runs a supported version and that management interfaces are not reachable from the internet.
- Enforce phishing-resistant MFA on all remote access and webmail. The source describes access-oriented operations, so credential compromise is the assumed path rather than exploitation of an unpatched flaw.
- Turn on and retain authentication, configuration-change and session logging on those edge devices. The stated intent is long-term access, which surfaces in log review rather than in alerts.
P2, within 72 hours
- Hunt for long-dwell access on edge devices and identity providers: unexplained administrative accounts, new local users, altered VPN or firewall profiles, changed split-tunnel settings, and scheduled tasks or services created outside a change window. Extend the lookback to at least 12 months, consistent with the source's description of access held for reach rather than immediate effect.
- Restrict outbound management access from edge devices and segment them from the core network so that a compromised appliance is not a pivot.
- Map dependency on undersea cable routes and third-party network providers for critical payment, settlement and market-data paths. The source names undersea cable targeting, and this is the point where it touches financial infrastructure directly.
P3, within 7 days
- Review physical security at sites hosting critical infrastructure, including datacentres and backup sites, with facilities and local law enforcement. The source describes physical sabotage against civilian and dual-use infrastructure.
- Run a tabletop that combines simultaneous cyber and physical disruption of a critical service, since the source presents the tactics as a kit used together rather than in isolation.
- Add the four named influence campaigns (Doppelgänger, Operation Overload, Operation Undercut, CopyCop) to brand and domain monitoring, with attention to impersonation of national and pan-European media outlets.
5. Indicators of compromise
No indicators of compromise available in the source material.
The source describes campaign-level behaviours but no atomic indicators, so there is nothing to place in a machine-pivotable block. The behaviours below are observable in enterprise telemetry; the airspace, territorial-water and physical sabotage lines are not, and are tracked through national authority reporting instead. All rows are single-sourced from Insikt Group and are campaign-level descriptions rather than confirmed observations against a financial-sector target.
Behavioural indicators
| behaviour | where to observe | confidence |
|---|---|---|
| Access-oriented intrusion attempts against internet-facing firewalls, VPNs, email services and web portals, with no immediate disruptive payload | edge device authentication and configuration logs, VPN session records, mail gateway logs | low, single-sourced and campaign-level |
| Long-dwell access maintained without disruptive action | identity provider logs, edge device admin audit trails, over a multi-month window | low, single-sourced and campaign-level |
| Impersonation of national or pan-European media outlets in content aimed at UK, French, German and Polish audiences | brand monitoring, social media, newly registered domain feeds | low, single-sourced and campaign-level |
6. Detection
Insufficient indicators to author detection rules.
7. Sources
- Recorded Future, Insikt Group, "Russia Escalating Hybrid Attacks Across Europe", https://www.recordedfuture.com/blog/russia-new-generation-warfare, published 2026-09-24. This is the only source for this advisory; the primary item and the related source supplied are the same URL.
8. Adverse Trace position
No CVSS score, severity rating or CISA KEV state applies to this item: it contains no CVE, so there is nothing to score and we have not assigned a severity. Our assessment is that the item is a credible strategic warning from a single vendor, with unconfirmed actor attribution and no technical indicators, and that its practical value to an EMEA financial services client is as a driver for edge-device exposure reduction and long-dwell access hunting rather than as an incident response trigger. The client impact we see is indirect but real: the source names internet-facing firewalls, VPNs, email services and web portals as the targeted surface, and those are the same appliances most financial entities expose for remote access and customer-facing services. We will track NATO and national CERT reporting for corroboration, watch for the access-oriented activity described here against edge devices in client telemetry, and reissue this advisory if a second source corroborates the assessment, if a financial-sector victim is named, or if technical indicators emerge. Clients who want the edge-device exposure review in §4 run against their estate should contact their Adverse Trace handler to schedule it.
Published via PulseTrace — Adverse Trace threat intelligence.