Stably Unstable: The Architecture of Russia’s Hybrid War in the Western Balkans (2026)

Russia’s hybrid war in the Western Balkans in 2026 reflects a mature strategy. Rather than seeking escalation, Moscow seeks position. It is a case study in a long‑term, managed, condition. And, for Moscow, a favourable one.

Western Easter is approaching, which in Sweden serves as a reliable signal that spring has finally arrived. At long last. Spring, in turn, marks the moment to sitta på husknuten — an informal Swedish expression referring to sitting by the sun‑facing side of the house and absorbing the first sustained warmth of the season. Having just returned from Serbia, this ritual shall be accompanied by plum brandy. The pairing seems appropriate.

Opposition to NATO enlargement has remained a constant in Russian foreign policy from the collapse of the Soviet Union to the present day. What was articulated formally in 2008, and codified in Russia’s 2010 Military Doctrine as NATO expansion constituting the primary “external military danger,” continues to shape Moscow’s strategic posture[1].

The Western Balkans increasingly illustrate the continued effectiveness of legacy Soviet and Russian Active Measures (Активные мероприятия), adapted to modern operational environments. Rather than representing a fundamentally new form of warfare, Moscow’s approach reflects continuity: political influence, economic leverage, proxy actors, information operations and institutional obstruction[2]. Such operations exploit ethnic tensions, historical grievances and institutional mistrust, raising the political cost of integration and reinforcing domestic veto players[2].

Crucially, Russia’s objective in the Western Balkans is not limited to influence or what might be termed soft‑power dominion. Moscow simultaneously pursues strategic denial. The objective is not merely to shape political outcomes, but to prevent NATO and European Union expansion into the region as part of a single operational logic. This dual logic — influence combined with denial — reflects the enduring nature of Active Measures. Moscow cultivates political allies, reinforces identity narratives and embeds economic dependencies, while sustaining unresolved disputes and encouraging institutional paralysis[2]. The aim is not dominance, but friction. Not control, but position.

While the war in Ukraine has absorbed much Western attention, Russian operations in the Western Balkans have quietly intensified rather than diminished. The region functions as a comparatively low‑cost arena in which Moscow generates disproportionate strategic friction. Instability remains contained, yet persistent. Integration slows. Alignment becomes conditional. Influence accumulates. Although the Western Balkans remain secondary to Russia’s “near abroad,” Moscow has for over two decades pursued a sustained campaign designed not to dominate the region militarily, but to prevent its consolidation within Euro‑Atlantic structures. The objective is therefore not expansion, but denial — and through denial, influence.

Serbia: The Central Node

Serbia remains the central node of Russian influence in the Western Balkans. Through Belgrade, Moscow projects influence into Republika Srpska in Bosnia and Herzegovina, northern Kosovo, and, to a lesser extent, Montenegro. This influence rests on political alignment, media penetration, energy dependence, religious networks and security cooperation.

Russia’s earlier successes were primarily economic and political. The most consequential was the consolidation of influence in the Serbian energy sector. Russian state‑controlled entities acquired majority ownership in Naftna Industrija Srbije (NIS), while Gazprom and affiliated entities gained control over Srbijagas and strategic pipeline infrastructure. This created structural dependence rather than temporary leverage[3]. By 2026, this dependency remains significant despite growing Western pressure. Serbia sources 85–90 % of its gas from Russia and NIS, the country’s largest oil and gas company, remains majority‑owned by Russian firms[3]. Diversification initiatives such as the Bulgaria–Serbia interconnector provide access to Azerbaijani gas and liquefied natural gas (LNG)[3]; however, the structural legacy of Gazprom’s ownership of NIS continues to shape Belgrade’s energy policy, acting as a powerful veto player even as new supply routes emerge[3]. Serbia therefore remains dependent on Russian gas supplies, and infrastructure tied to Russian supply continues to shape strategic decision‑making[3].

Where overt conflict produces mobilisation and resistance,

Active Measures generate gradual alignment and cumulative leverage.

The Kosovo issue remains a central political lever. Moscow reinforces the narrative that NATO membership would require Serbian recognition of Kosovo, linking national identity to geopolitical alignment. Military neutrality is presented as sovereignty; alignment as concession. At the same time, Moscow continues to support the preservation of frozen disputes. Backing for Republika Srpska leadership, particularly secessionist rhetoric and institutional obstruction within Bosnia and Herzegovina, aligns with Russia’s broader strategy of sustaining unresolved tensions. The objective is not immediate destabilisation, but durable paralysis.

The 2026 Hybrid Toolkit

Russian hybrid tactics in the Western Balkans extend far beyond traditional energy leverage. The contemporary toolkit reflects a layered, low‑cost architecture designed to shape political behaviour, slow institutional convergence and raise the political cost of Euro‑Atlantic integration.

• Disinformation Networks. Russian influence operations rely on layered dissemination pipelines combining state‑linked media, local proxy outlets and social media amplification. Russian‑aligned narratives portraying NATO as hostile, the EU as weak and Russia as a defender of sovereignty are widely disseminated across regional media ecosystems[2]. These narratives are frequently amplified by domestic actors, creating a hybrid ecosystem in which domestic political discourse and external influence increasingly converge. Such operations exploit ethnic tensions, historical grievances and institutional mistrust, raising the political cost of integration and reinforcing domestic veto players[2]. The layered structure allows Moscow to shape perceptions indirectly, increasing persistence while reducing attribution.
• Political Proxy Support. Russia relies heavily on local political actors to advance its strategic objectives. Pro‑Russian political parties, nationalist movements and sympathetic leadership figures function as amplifiers of Moscow‑aligned narratives and policy preferences[2]. Republika Srpska remains particularly significant: its leadership has repeatedly pursued positions aligned with Russian strategic interests, including institutional obstruction and resistance to NATO integration[2]. This proxy architecture enables Moscow to exert influence without direct intervention while preserving plausible deniability.
• Ecclesiastical Influence. Ecclesiastical networks form an enduring pillar of Russian influence. The Serbian Orthodox Church and related institutions possess deep societal legitimacy and broad community reach. Orthodox priests frame geopolitical loyalty as a moral duty, and sympathetic politicians invoke Moscow’s blessing to resist Western norms[2]. These networks reinforce identity narratives centred on shared Orthodox heritage, traditional values and historical grievance, shaping cultural alignment rather than immediate policy outcomes[4, 5, 6, 7].
• Cyber Espionage. Cyber operations across the Western Balkans primarily focus on intelligence collection, institutional mapping and long‑term positioning rather than immediate disruption. Russian‑linked hacking groups such as Fancy Bear (APT28) infiltrated Serbia’s Ministry of Defence, Military Academy and Military Medical Academy, collecting data from email addresses of these institutions[8, 9]. Cybersecurity analysts concluded that the attack’s purpose was espionage rather than sabotage, and that the hackers aimed to monitor communications and agreements between Serbia and other partners[8, 9].
• Legislative Mimicry. A more recent development is the gradual emergence of governance models reflecting Russian legislative frameworks. In February 2025, the government of Republika Srpska enacted a “foreign agents” law modelled directly on Russian legislation to limit independent media and non‑governmental organisations[2]. This legislative convergence constrains Western‑aligned actors, reduces transparency and institutionalises political friction, making alignment with EU governance standards progressively more difficult.

This approach reflects what Russian General Valery Gerasimov described in 2013 as the ‘blurring of the lines between war and peace,’ where the objective is to win without ever firing a shot.

War is unlikely, but as long as Russian hybrid activities remain at their present level, the region will never fully be at peace.

Strategic Setbacks and the Ukraine Factor

Russia has faced setbacks. Montenegro and North Macedonia joined NATO, while EU and NATO presence remains significant through KFOR and EUFOR Althea. Yet Moscow’s strategy does not require dominance. It requires friction. By sustaining unresolved disputes, Russia preserves the Western Balkans as a zone of strategic ambiguity. The war in Ukraine sharpened this dynamic. Ukraine imposed military and economic costs on Russia, but also degraded Moscow’s hybrid capabilities: intelligence coordination tightened, disinformation networks came under scrutiny and covert financing narrowed. The operational environment became less permissive. This, in turn, reinforced the attractiveness of low‑cost, influence‑based strategies. Where overt conflict produces mobilisation and resistance, Active Measures generate gradual alignment and cumulative leverage.

Moscow does not require loyalty in the Western Balkans. It requires hesitation.

The Managed Condition
Russia’s hybrid war in the Western Balkans in 2026 reflects a mature strategy. Rather than seeking escalation, Moscow seeks position. Frozen conflicts, energy dependency, political proxies, information warfare and institutional fragility together form a durable, low‑cost environment favourable to Russian interests — and resistant to Western response. The region is as Moscow has sought it to be: stably unstable. Stability is not the objective. Predictable instability is. War is unlikely, but as long as Russian hybrid activities remain at their present level, the region will never fully be at peace. Not aligned, not integrated, and therefore persistently susceptible to external influence.

In this sense, Russia’s hybrid activities in the Western Balkans do not represent a campaign with a decisive end state. It is a case study in a long‑term, managed, condition. And, for Moscow, a favourable one.

Happy Easter.

[Main image: Belgrade Serbia Skyline by Michael Tompsett]

References

1. Russian Military Politics and Russia’s 2010 Defense Doctrine (Strategic Studies Institute) – A monograph on Russian military politics and the 2010 defence doctrine published by the U.S. Army Strategic Studies Institute (March 2011) describing how the doctrine identifies NATO expansion as a primary external danger. Available at: https://www.clingendael.org/sites/default/files/pdfs/20110300_haas_doctrine.pdf
2. “Moscow Leverages Extremism in the Balkans” – Eurasia Daily Monitor (Jamestown Foundation) – Blerim Vela’s article in the Jamestown Foundation’s Eurasia Daily Monitor (2 March 2026) explaining that Russia exports an illiberal governance model to the Western Balkans using extremist movements, Orthodox networks and sympathetic political elites. Available at: https://jamestown.org/moscow-leverages-extremism-in-the-balkans/
3. “Energy Resilience in the New Era: Serbia’s Path to Diversification” – Pupin Initiative – Analysis by Vuk Velebit, Petar Ivić and Aleksa Jovanović (1 October 2025) detailing Serbia’s heavy dependence on Russian gas and the limited impact of diversification projects like the Bulgaria–Serbia interconnector. Available at: https://www.pupin.org/analysis/energy-resilience-in-the-new-era-serbia-s-path-to-diversification
4. “Serbian and Russian Orthodox Churches Unite Against West” – Foundation for Defense of Democracies – Ivana Stradner and Marina Chernin’s op‑ed (4 May 2025) describing how the Serbian and Russian Orthodox Churches emphasise shared traditional values and frame Western liberal norms as antagonistic. Available at: https://www.fdd.org/analysis/op_eds/2025/05/04/serbian-and-russian-orthodox-churches-unite-against-west/
5. “Soft, Sharp, and Evil Power: The Russian Orthodox Church in the Russian Invasion of Ukraine” – Occasional Papers on Religion in Eastern Europe – Alar Kilp and Jerry G. Pankhurst (2022) argues that the ROC has transitioned from an instrument of “soft power” to one of “sharp” and “evil” power. Their paper examines how the church leadership, specifically Patriarch Kirill (frmr) provides the moral and ideological justification for state aggression. The paper goes into detail how the church’s “Russian World” (Russkiy Mir) ideology serves the state’s territorial and geopolitical interests. Available at: https://digitalcommons.georgefox.edu/ree/vol42/iss5/2/#:~:text=%22Soft%2C%20Sharp%2C%20and%20Evil,5
6. “The Russian Orthodox Church as a Geopolitical Instrument of Russia’s Foreign Policy in the Black Sea Region” – Revista de Studii Interdisciplinare (Exc. 2024) – Tengiz Pkhaladze (10 October 2025) – Study places the ROC within Kremlin’s hybrid activities toolkit and provides empirical evidence to support the claim. Particularly interesting is the geopolitical usage of “religious diplomacy” and legitimacy creation. Available at: https://revista.excedinter.com/index.php/rtest/article/download/210/572?inline=1#:~:text=Detailed%20examination%20of%20these%20cases,adaptation%20in%20different%20regional%20contexts.
7. “How the Russian Orthodox Church Became a Weapon of Political Warfare” – FPRI October 2025.
8. “Espionage or Sabotage: Why Are Russian Hackers Targeting Serbia’s Ministry of Defence?” – The Geopost – The Geopost article (25 March 2026) reporting that the Russian hacker group Fancy Bear infiltrated Serbia’s defence institutions and collected data for espionage rather than sabotage. Available at: https://thegeopost.com/en/ballkan/spiunazh-apo-sabotim-pse-hakerat-ruse-po-synojne-ministrine-e-mbrojtjes-se-serbise/
9. “Cyber Warfare Now – Tales from the Digital Battlefield” – Lima Charlie News – John Sjoholm (2 July 2019) gives an overview of the digital battlefield and the Russian role in it. Available at: https://limacharlienews.com/cyber/cyber-warfare-now-tales-from-the-digital-battlefield/

John Sjoholm, for LIMA CHARLIE WORLD

[Subscribe to our newsletter for free and be the first to get Lima Charlie World updates delivered right to your inbox.]

John Sjoholm is Lima Charlie’s Middle East Bureau Chief, Managing Editor, and founder of the consulting firm Erudite Group. A seasoned expert on the Middle East, North Africa, Europe and the Balkans, he has a background in security contracting and has served as a geopolitical advisor to regional leaders. He was educated in religion and languages in Sana’a, Yemen, and Cairo, Egypt, and has lived in the region since 2005, contributing to numerous Western-supported stabilisation projects. He currently resides in Jordan.

Lima Charlie World provides global news, featuring insight & analysis by military veterans, intelligence professionals and foreign policy experts Worldwide.

For up-to-date news, please follow us on twitter at @LimaCharlieNews

In case you missed it: