The UK is facing a new era that’s “forcing the biggest shift” in the intelligence agency’s mission since 9/11, the head of MI5 said in October.

“In the last year, we and the police have disrupted a steady stream of surveillance plots with hostile intent – aimed at individuals Russian leaders perceive as their enemies,” director general of MI5, Ken McCallum said.

“And we’re seeing Russia-based figures continuing to use online platforms in wider attempts – largely unsuccessful – to sow the seeds of violence, chaos and division here in the UK.”

One of the most pressing threats is covert tactics used by Russia to intimidate, cause chaos and death across the country without triggering a full-blown war across Europe. In other words, a grey war, a conflict in between peace and armed warfare.

But hybrid warfare – such as cyber attacks, espionage, disinformation – is not a new tactic used by the Kremlin.

This week, the inquiry into the 2018 Salisbury poisonings found that Vladimir Putin had authorised the operation to use the deadly nerve agent Novichok to assassinate former Russian spy, Sergei Skripal.

Skripal, his daughter Yulia, and police officer, Nick Bailey, all fell ill following the poisoning. Dawn Sturgess died three months later in June, after accidentally spraying herself with perfume loaded with the poison.

Since the war in Ukraine has raged, Russia’s hostile actions have taken a more undercover approach. Drones have been spotted across multiples countries, sabotage attacks on logistical hubs have occurred, and mysterious ships have been accused of transporting agents or carrying out surveillance, as revealed by The i Paper.

While no foreign state has been identified, Russia has been accused of being behind the hybrid attacks.

Research by The International Institute for Strategic Studies published in the summer revealed there had been 11 instances of hybrid warfare attacks in Europe in the first half of 2025.

Drones

Mysterious drones were spotted flying last November near top-secret military bases in Suffolk, Norfolk and Gloucestershire. While it was not clear who was operating the aerial devices, The i Paper revealed that three individuals with links to Russian military and intelligence sites had stayed near the strategic RAF bases, which are home to vital defence technology.

Unidentified drones breached no-fly areas by entering the flight path of Ukrainian President Zelensky who was travelling to Dublin this week. The devices are understood to have been launched from cargo ships in the Irish Sea.

Russia’s “research” ship, Yantar, came into conflict with British forces as it was thought to have deployed drones near under the sea comms cables between the UK and Ireland.

Emily Ferris, Senior Research Fellow at defence think-tank the Royal United Services Institute, told The i Paper: “It could be that plenty of things. Plenty of destruction, is actually caused by Russia at a low level, but it’s really hard to attribute.

“Even this stuff with Novichok. The inquiry has only just happened, and [it happened] in 2018. There might be plenty of examples that we actually just don’t know about.”

Recruiting ‘local idiots’

Keir Giles, research director at the Conflict Studies Research Centre, explained that Putin has resorted to hiring third parties online and paying them with cryptocurrency to carry out attacks in the UK.

He told The i Paper: “We’ve seen for more than a decade now things that have been described as warlike acts. Up until 2022 these were being carried out by Russian military officers.

“Since those people were removed from Europe they’ve turned to recruiting proxies and organised criminals, and disorganised criminals as well – local idiots – to do their work for them.”

Last year, industrial units in Leyton, east London, containing aid for Ukraine were set on fire by a group of British men. It was later confirmed that they were acting on behalf of the Russian state.

Similarly in Poland last year, a huge blaze destroyed a shopping mall in Warsaw. It was confirmed a year later that the arson was commissioned by Russian officials.

In May, six Bulgarian nationals who were motivated by a handsome financial reward were jailed for spying for Russia in the UK and Europe.

Ferris said sometimes proxies don’t know they’re working for Putin. She said: “I would say we’ve got quite a high burden of proof in this country and in Europe more broadly. So it’s actually quite difficult to attribute things to Russia for lots of different reasons, and the big reason is that they tend to use third party proxies and recruit local people to do it.

“A lot of these people don’t even know that the Russian state is their ultimate benefactor. They just think they have been recruited by an organised criminal gang.”

Ships

In January, the Yantar was tracked by the Royal Navy after it was spotted potentially mapping the UK’s subsea communication cables that carry 99 per cent of internet data, calls and financial transactions to the rest of the world.

Examples of key alleged ‘grey’ warfare attacks on the UK in 2025

21 January – Russia spy ship Yantar enters UK waters passing through the English Channel and North Sea. It is believed to be tracking critical subsea power and communication cables.

17 April – A cyber attack hits M&S suspending online sales and affecting some stores leading to empty shelves.

12 May – Six Bulgarian nationals were sent to prison for spying for the Kremlin in the UK and Europe.

8 July – Three men were found guilty of the arson attack on an industrial unit in Leyton, east London, which was housing aid for Ukraine. They were working on behalf of Wagner, a private military organisation acting for Russia, which is a proscribed terrorist group in the UK.

31 August – Major cyber attack shuts down car production at Jaguar Land Rover.

20 September – Ransomware attack on software used to board passengers and check in luggage causes delays at Heathrow Airport.

7 November – A man from Essex, Howard Phillips, was jailed for seven years after he was found to have been working with undercover Russian agents.

19 November – Russian cyber crime group Media Land sanctioned after it has been found responsible for facilitating cyber-attacks on UK-based companies.

November – Yantar returns to Britain, north of Scotland, and shines lasers at RAF pilots in an attempt to confuse them.

Things escalated recently, when for the first time lasers on the ship were pointed towards RAF jets in an attempt to confuse them. The jets had been flying north of Scotland track the ship’s activity. After the incident, the UK announced its navy would carry out joint patrols with Norway to protect north Atlantic undersea infrastructure.

Giles said this was an “arbitrary hostile act”, which has been normalised.

“But it has become normalised in much the same way as other things which should have been completely unacceptable, have been normalised through this process of Russia pushing boundaries,” Giles said.

Cyber attacks

Car manufacturer Jaguar experienced a similar data hack to M&S, thought to have been linked to Russia, which became the costliest event in UK history. Production halted in factories in the UK, Brazil, India and Slovakia for five weeks in September. The delays to production cost the company an estimated £1.9 billion.

A ransomware attack – where malware is used on software in return for money – on a third-party check-in and baggage system used at Heathrow Airport led to major delays over a weekend in September. Staff had to check passengers in manually.

Cancelled flights and delays were experienced across European airports from Berlin to Brussels. A man was arrested in West Sussex in connection to the crime.

While it is not totally clear that Putin is behind the incidents, Nato has said it’s possible that Russia could be behind them.

Media Land, a significant Russian cybercrime syndicate, was sanctioned by the UK in November.

A pro-Russian hacking group called NoName057(16) claimed on social media in May that it had suspended websites in the UK, including local councils and the Association for Police and Crime Commissioners. But its success appears to have been limited, with some local authorities stating their website had been unaffected.

Space satellites

The head of UK space command told the BBC that Russian military satellites had been “stalking” British military satellites by orbiting them to try to collect information.

The space chief also said that Russia had attempted to “jam” the satellites on a weekly basis by sending out signals on the same frequency to intentionally disrupt them.

Maj Gen Paul Tedman told the BBC: “We’re seeing our satellites being jammed by the Russians on a reasonably persistent basis.

“They’re interested in what we’re doing and flying relatively close.

“They’ve got payloads on board that can see our satellites and are trying to collect information from them.”

Your next read

Could these tactics escalate to a war?

While Putin has said it’s “ready” for war with Europe, Giles thinks it is currently unlikely that Russia would step up covert tactics. Armed conflict would breach Article 5, where one attack on a Nato state is considered an attack on all.

Giles said: “They’re not going to risk an overt attack. It is only when they are confident that it would destroy Nato instead of uniting Nato, that they would do so.

“But in the meantime, everything they’ve done has expanded the boundaries of what they think they can get away with without crossing that line into something that’s considered overt warfare.

“There’s been a significant shift that we’ve seen just over the course of the last week, where suddenly Nato is willing to point the finger at Russia. It is now saying ‘these are ongoing attacks, and we need to be more proactive in deterring Russia from doing it’.”