From the Baltic Sea to the Mediterranean, a new form of maritime conflict is reshaping Europe’s strategic landscape. Grey zone maritime threats—covert sabotage, clandestine surveillance, and deniable proxy operations—now challenge the stability of European waters without crossing into open warfare. As adversaries exploit the opacity of the seabed and the ambiguities of international law, NATO and its allies face a growing imperative: to detect, deter, and defend against hybrid operations that target critical undersea infrastructure. This evolving contest, largely hidden from public view, is increasingly central to the future of transatlantic security.
Table of Contents
- Hybrid Threats and the Battle with Maritime Ambiguity
- Systematically Targeting the Lifelines on Europe’s Seabed
- Fishing Boats and Research Ships Becoming the New Face of Grey Zone Conflict
- The Hidden Arsenal of Grey Zone Underwater Warfare
- Western Adaptation to Maritime Hybrid Threats
- Denying Adversaries the Shadows They Exploit
Hybrid Threats and the Battle with Maritime Ambiguity
Grey zone maritime threats increasingly define the strategic competition playing out in European waters. These threats occupy the murky space between routine peacetime operations and overt armed conflict, leveraging ambiguity, deniability, and the challenges of attribution to press adversarial aims without triggering conventional military responses. Typically, they appear as unexplained damage to critical infrastructure or unusual vessel behavior, calibrated to remain just below the threshold that would justify kinetic retaliation under international law.
This deliberate ambiguity is both a tactic and a strategic enabler. The maritime domain offers a uniquely permissive environment: international norms of free navigation, the density of civilian shipping, and the opacity of underwater operations create ample opportunities for low-cost, low-risk aggression. Would-be saboteurs can exploit crowded sea lanes, busy port approaches, and shallow coastal areas to clandestinely drag anchors, deploy devices, or tamper with seabed infrastructure while blending into the background of legitimate maritime traffic. When incidents occur, the question of whether they result from accidents or attacks is often irresolvable in real time. Even when foul play is suspected, forensic attribution remains inherently difficult, delaying or complicating response options.
Recent years have seen a steady uptick in grey zone incidents across European waters. The Baltic Sea, almost entirely bordered by NATO states, has emerged as a principal theater of covert maritime interference. The September 2022 Nord Stream pipeline explosions, which severed major gas pipelines linking Russia and Europe, remain the most dramatic example of undersea sabotage to date. This unresolved mystery underscored the vulnerabilities inherent in seabed infrastructure security. In the aftermath, a series of smaller but strategically significant incidents such as cable disruptions, pipeline damages, and unexplained vessel activities have heightened European navies’ vigilance and fueled concerns about systematic hybrid campaigns.
National security officials increasingly assess these episodes not as isolated mishaps, but as elements of a broader pattern: an adversarial strategy of hybrid warfare aimed at eroding European resilience and imposing strategic costs below the threshold of open conflict. NATO formally warned in 2023 of growing risks to undersea critical infrastructure, pointing to Russian activities that suggest active mapping and pre-positioning for potential attacks. By late 2024, U.S. defense officials publicly cautioned that Moscow was likely to escalate operations against seabed cables and pipelines, reflecting a doctrinal shift in Russia’s use of the maritime domain as an arena for grey zone competition.
Although China’s direct naval presence in European waters remains limited, Beijing’s activities are drawing closer scrutiny. Emerging evidence points to Sino-Russian coordination in grey zone maritime operations, with Chinese-flagged vessels implicated in incidents consistent with Russia’s hybrid tactics. China’s longstanding experience with grey zone strategies in the Pacific theater, including the deliberate severing of undersea cables around Taiwan, raises concerns that Beijing is adapting similar methods to European contexts, either in support of Moscow or as part of its own global expansion of hybrid capabilities.
U.S. and allied leaders now recognize Europe’s maritime domain as a contested space, a secondary theater of great power competition where rivals advance their objectives through clandestine means. Grey zone maritime threats no longer consist merely of occasional disruptions to communications cables throughout European waters. They encompass a full spectrum of non-standard activities: clandestine seabed surveillance operations, loitering by “civilian” vessels engaged in intelligence collection, covert deployment of divers and unmanned underwater vehicles (UUVs), suspicious port calls, anomalous navigation patterns, and other forms of subthreshold maneuvering. This mosaic of irregular maritime activity demands a fundamental recalibration of Western deterrence, domain awareness, and resilience strategies for the underwater battlespace.
Systematically Targeting the Lifelines on Europe’s Seabed
Perhaps the most strategically alarming evolution in the grey zone maritime threat landscape is the systematic covert sabotage of undersea critical infrastructure. Europe’s vast and indispensable network of submarine cables and pipelines are vital arteries for energy supply, data transmission, and economic connectivity that have become an increasingly attractive and vulnerable target for adversaries operating in the shadows. In the past several years, multiple underwater assets have been mysteriously severed or damaged across European waters. While accidents are a persistent reality at sea, the timing, concentration, and operational patterns surrounding these incidents strongly suggest deliberate hostile interference. The Baltic region, in particular, has emerged as the principal arena for this hybrid undersea campaign, coinciding with heightened geopolitical tensions between Russia and NATO.
Anchor Dragging as Sabotage: The Balticconnector Incident
In October 2023, the Balticconnector, a 77-kilometer gas pipeline linking Finland and Estonia, along with two adjacent telecommunications cables, suffered sudden ruptures. Investigations swiftly identified the Hong Kong-flagged cargo ship Newnew Polar Bear, which had transited from a Russian port, as the likely perpetrator. Evidence indicated the vessel dragged an anchor across the seabed, severing the infrastructure. The Newnew Polar Bear ignored naval radio hails and continued its voyage, forcing diplomatic inquiries with Beijing. While China pledged cooperation in November 2023, it was not until August 2024—nearly a year later—that Beijing admitted the vessel’s culpability. This delayed admission underscores how grey zone actors exploit flags of convenience, diplomatic inertia, and plausible deniability to frustrate early attribution and accountability.
Twin Cable Cuts: Arelion and C-Lion 1 Under Siege
In November 2024, when two additional submarine cables—the Arelion telecommunications cable linking Sweden and Lithuania and the C-Lion 1 cable linking Finland, Estonia, and Germany—were simultaneously severed. The Chinese-operated vessel Yi Peng 3 was operating suspiciously in the vicinity. In a coordinated multinational response, Danish, Swedish, Finnish, and German authorities shadowed and eventually detained the Yi Peng 3. Meanwhile, a Russian warship was detected nearby, raising suspicions of coordinated Sino-Russian operations. Investigators noted that the Yi Peng 3 bore hull and anchor damage consistent with underwater obstruction. Yet Beijing again shielded its vessel, refusing European investigators access to critical onboard systems and personnel, forestalling definitive conclusions about intent. This case demonstrates the layered complexity of hybrid grey zone maritime threats, where physical evidence is often insufficient without political will and intelligence access to establish hostile intent.
Russia’s Shadow Fleet Severs Estlink-2 Power Cable
On Christmas Day 2024, another major incident unfolded: the Estlink-2 undersea power cable connecting Finland and Estonia and two ancillary data cables were damaged. Finnish authorities rapidly intercepted the Eagle S, an oil tanker flagged under a convenience registry but operating as part of Russia’s illicit shadow fleet designed to evade Western sanctions. Investigators placed the crew under travel bans and launched an extended probe. While the vessel was eventually released in April 2025 alongside the lifting of travel bans for five of the eight crew members, the incident marked a critical turning point: the apparent use of sanctions-evading fleets not merely for economic survival, but as plausible platforms for strategic sabotage. This convergence of economic illicit activity and hybrid maritime operations demonstrates how non-traditional assets are being repurposed to challenge Western resilience asymmetrically.
Shadow Tactics in Swedish Waters Cause Gotland-Ventspils Cable Break
In January 2025, Latvia’s state operator LVRTC reported a sudden data outage on its Gotland to Ventspils fiber optic cable. Forensic analysis pinpointed the break approximately 130 kilometers inside Sweden’s exclusive economic zone. Satellite AIS records revealed that the Maltese-flagged cargo ship Vezhen, registered by Hong Kong’s Hai Kuo Shipping 2015B Limited, had veered erratically over the cable site, appearing to drag loose gear. Swedish Coast Guard vessels seized the Vezhen the next day near Karlskrona on suspicion of aggravated sabotage. Although Sweden ultimately determined the damage to be accidental and released the crew in February 2025, the case mirrored earlier anchor-dragging sabotage incidents, raising questions about whether Moscow-linked actors are systematically probing undersea infrastructure resilience, even through ostensibly accidental means.
Familiar Grey Zone Warfare Tactics
The recent cluster of sabotage incidents across the Baltic underscores a troubling reality: grey zone maritime operations in European waters against maritime infrastructure are no longer isolated acts of opportunism but represent a systematic campaign of strategic exploitation. Russia’s operational fingerprints are the most visible, with the timing and intensity of disruptions closely tracking pivotal moments of geopolitical pressure from the Ukraine conflict, escalating sanctions, or NATO’s northward expansion. Moscow has embraced grey zone sabotage as a deliberate cost-imposition strategy, aiming to demonstrate to Western leaders that Europe’s critical infrastructure and its political stability can be held at persistent risk while preserving plausible deniability.
China’s role in these operations, although less direct, is no less strategically significant. Beijing’s linkage to three of the four recent Baltic incidents reveals a growing willingness to operate within grey zone paradigms alongside Russia. China’s extensive experience in grey zone maritime operations, ranging from the activities of its maritime militia in the South China Sea to the repeated severing of undersea cables around Taiwan, has translated into threats highly adaptable to European waters. Furthermore, China’s ongoing investments in deep-sea technologies, including cable-cutting platforms and subsea surveillance systems, indicate a long-term strategic ambition to scale seabed sabotage into a global, persistent capability set.
The operational pattern emerging from these incidents reflects a deeper doctrinal evolution: the systematic repurposing of civilian maritime traffic from research vessels, trawlers, and merchant freighters as covert enablers of state power projection. This hybridization fundamentally blurs the lines between peacetime commerce and strategic competition, complicating the traditional frameworks of international law, maritime surveillance, and defense attribution. Left unaddressed, this deliberate exploitation of ambiguity will continue to erode deterrence and create windows of vulnerability across the transatlantic security architecture. Understanding and countering this hybrid maritime threat vector will be central to safeguarding global critical infrastructure and the credibility of Western deterrence in the contested waters of the coming decade.
Fishing Boats and Research Ships Becoming the New Face of Grey Zone Conflict
A rapidly evolving grey zone tactic across European waters involves the use of ostensibly civilian vessels such as fishing boats, research ships, and merchant freighters for espionage and strategic intelligence gathering. Both Russia and China now field state-affiliated fleets that maneuver in irregular patterns, positioning themselves to monitor and target critical maritime infrastructure and military movements. These vessels often present a veneer of commercial or scientific legitimacy, but closer scrutiny of their behaviors, equipment, and operational patterns reveals far more malign intentions.
This growing trend reflects a deliberate strategy to blur the traditional distinctions between civilian and military maritime activities. By leveraging vessels under civilian flags, adversaries exploit international norms of freedom of navigation to mask reconnaissance activities and establish a persistent presence in strategically sensitive waters. The grey zone nature of these threats complicates detection, attribution, and timely response, creating a permissive environment for future acts of sabotage or disruption to maritime infrastructure throughout European waters.
Undersea Reconnaissance Disguised as Oceanography
Western navies have documented a significant rise in so-called “ghost ships,” vessels that exhibit suspicious behavior such as disabling their Automatic Identification Systems (AIS), lingering without clear business in strategic maritime areas, or repeatedly approaching key undersea infrastructure like data cables and energy pipelines. One emblematic case involves the Russian Ministry of Defense ship Admiral Vladimirsky, officially registered as an oceanographic research vessel. Throughout 2022, Admiral Vladimirsky systematically operated near North Sea offshore wind farms and undersea power and data cables, raising alarms among European security services.
Investigative journalists and naval intelligence sources have confirmed that Admiral Vladimirsky, along with other Russian “civilian” ships, conducted detailed reconnaissance of offshore installations critical to Europe’s energy and communications resilience. The deliberate mapping of such targets suggests pre-operational battlespace preparation intended to facilitate future sabotage or disruption operations in the event of heightened conflict or political coercion.
NATO officials have warned that this pattern of undersea reconnaissance represents an active shaping of the maritime battlespace beneath the threshold of armed conflict. By operating within international waters or exclusive economic zones (EEZs), these vessels avoid direct violations of sovereignty, forcing Western navies to operate under the legal constraints of peacetime maritime law. As a result, unless malign activity is caught in the act, options for intervention remain limited to shadowing or monitoring, highlighting the legal and operational dilemmas grey zone maritime threats intentionally exploit.
The Militarization of Fishing Fleets
A dramatic escalation of these tactics came to light in April 2023 when Scandinavian authorities exposed a large-scale Russian maritime espionage network. Dozens of vessels, ostensibly operating as fishing trawlers or research ships, were identified as conducting covert intelligence collection on critical maritime sites throughout the North Sea. These ships carried specialized underwater surveillance equipment designed to locate and map the intersections of communication cables, offshore energy grids, and maritime logistics nodes—sites that, if sabotaged, could deliver devastating strategic effects on European economies and military readiness.
This program, directed by Moscow and assigned high strategic priority and resources, represents a systematic weaponization of commercial maritime traffic for covert state purposes. Its discovery shattered longstanding assumptions that the majority of undersea cable damage could be attributed to innocuous causes like fishing or anchoring. Instead, it exposed the degree to which adversaries have deliberately leveraged maritime industry infrastructure to mask strategic reconnaissance and battlespace shaping operations.
Of particular concern is the parallel militarization of China’s fishing fleet, which has long blurred the line between civilian and military actors in the Pacific. Beijing’s posture mirrors Russia’s approach in European waters, reinforcing the likelihood of coordinated, globalized hybrid maritime campaigns targeting undersea critical infrastructure. The deliberate ambiguity surrounding these vessels poses a profound challenge to Western frameworks of deterrence and defense, as traditional maritime security measures struggle to discriminate between legitimate commercial activity and strategic threat vectors hidden in plain sight.
Growing Sino-Russian Coordination in Grey Zone Operations
Evidence is mounting that Russia is increasingly leveraging China as a proxy actor in grey zone maritime operations. In the Baltic Sea, the Newnew Polar Bear and Yi Peng 3, both Chinese-registered vessels, were implicated in anchor-dragging incidents that damaged critical undersea infrastructure. Both ships had departed from Russian ports shortly before the attacks, suggesting a degree of coordination or operational collaboration with Russian authorities. The choice of Chinese-flagged vessels highlights an emerging tactic: using third-party actors to create additional layers of deniability and diplomatic complexity for targeted nations.
These Baltic incidents are not isolated phenomena. In early 2025, a Hong Kong-flagged vessel and a Russian-operated ship worked in tandem to sabotage Taiwan’s undersea internet cables, demonstrating the expanding reach and coordination of Sino-Russian hybrid maritime tactics. The parallel between operations in the Indo-Pacific and those in Europe strongly suggests that China’s merchant marine and affiliated commercial actors could be systematically leveraged as covert instruments of Russian strategic influence.
This evolving partnership poses a significant escalation risk. By distributing grey zone operations across aligned or “friendly” commercial platforms, adversaries complicate attribution efforts and force Western security services to contend with a wider and more ambiguous landscape of maritime threats. In the future, Chinese-registered vessels operating in European waters may serve not merely Chinese interests, but also act as operational proxies for Russian strategic aims—a development that demands urgent attention from Western policymakers and naval planners alike.
The Mediterranean: An Emerging Arena for Undersea Surveillance
The pattern of covert maritime operations is not confined to the Baltic or North Sea. The Mediterranean has increasingly emerged as another contested arena where foreign state-linked ships conduct undersea surveillance and intelligence-gathering operations under civilian covers. Prior to the fall of the Assad regime in Syria, Russia maintained a permanent naval presence in the eastern Mediterranean via its Tartus naval facility, providing a launch point for sustained intelligence activities across the region.
Since then, NATO navies have monitored Russian “research” vessels making unannounced stops near sensitive undersea cable landing sites or lingering suspiciously outside major Mediterranean ports. These maneuvers mirror the operational patterns previously observed in Northern Europe, suggesting a coherent strategic approach across theaters.
One particularly concerning episode occurred in late 2024 when the Russian vessel Yantar, officially designated an oceanographic research ship, was discovered operating unmanned submersibles in the Irish Sea near critical undersea telecommunications cables connecting Ireland and Britain. Irish naval forces were forced to escort Yantar out of national waters after it was observed patrolling directly above key infrastructure nodes.
The Yantar subsequently repositioned to the Mediterranean, where it was joined by the Viktor Leonov, a known Russian signals intelligence collection vessel. The pattern of operations, transiting from one strategic cable-dense region to another, suggests deliberate, coordinated grey zone maritime reconnaissance threats by mapping undersea infrastructure vulnerabilities in European waters for potential exploitation.
Each instance of a suspicious port call or prolonged anchorage by a state-affiliated vessel should now trigger immediate concern among European security agencies. What was once dismissed as benign maritime research is increasingly recognized as covert battlespace preparation, a strategic effort to identify, surveil, and potentially target undersea assets vital to Europe’s security and economic stability.
The Challenge of Policing an Invisible Battlespace
Loitering vessels operating under civilian cover exemplify the strategic ambiguity at the heart of grey zone maritime warfare. A trawler mapping the seabed can be dismissed as conducting routine fishing surveys; a research ship bristling with antennas can claim to be engaged in benign scientific study. Yet closer scrutiny often reveals deeper affiliations: state-owned vessels crewed by naval personnel or intelligence officers, executing missions calibrated to remain just inside legal boundaries while setting conditions for future operations.
Recognizing the scale of this threat, Western militaries have increasingly turned to sophisticated monitoring efforts. Analysts now routinely examine commercial shipping data for behavioral red flags such as vessels deviating inexplicably from normal routes, slowing without cause near critical infrastructure, or making irregular port calls. NATO has also invested in artificial intelligence tools capable of scanning vast volumes of maritime traffic data to identify suspicious patterns that might otherwise escape human detection. The objective is simple but urgent: to spot grey zone threats before they culminate in material attacks on maritime assets in European waters.
This proactive posture has begun to yield results. In 2024, during a NATO-led maritime surveillance operation, a Dutch naval team identified a suspect Russian tanker that had loitered suspiciously near a key pipeline. As the allied vessel approached, the tanker abruptly changed course and fled, likely foiling an intended operation. This incident underscored a critical dynamic: simply maintaining visible surveillance presence, much like a police cruiser deters casual infractions, can disrupt grey zone activities before they escalate.
Yet despite these advances in surface monitoring, a deeper vulnerability persists. While NATO and allied forces can increasingly track anomalous behaviors above water, what unfolds beneath loitering ships remains far harder to detect in real time. Vessels lingering near undersea cables or pipelines, particularly those operating under unclear commercial pretenses, create dangerous seams in situational awareness. These gaps are especially concerning as unmanned and sub-surface technologies continue to proliferate, enabling sabotage or reconnaissance actions that may unfold invisibly below the ocean surface.
The Hidden Arsenal of Grey Zone Underwater Warfare
Beneath the visible surface of maritime grey zone operations lies a deeper, less observable contest. Not all threats to Europe’s undersea infrastructure sail in plain sight. The maritime domain increasingly serves as a stealthy pathway for covert intrusions through combat divers, unmanned underwater vehicles (UUVs), and even trained marine mammals. These capabilities enable adversaries to conduct sabotage, reconnaissance, and disruption operations in ways that are far harder to detect and deter than surface-level activities. As Western navies focus on tracking suspicious shipping patterns above water, a more sophisticated threat is evolving below: a complex fusion of human, machine, and animal operations targeting the seabed battlespace. Understanding these submerged tactics is critical to grasping the full scope of grey zone maritime threats in European waters.
Frogmen and the Return of Underwater Sabotage
Among the oldest and most enduring grey zone threats to maritime infrastructure throughout European waters is the combat diver: a human operator trained to conduct clandestine sabotage, reconnaissance, and disruption beneath the waves. Long before unmanned systems extended the reach of maritime grey zone operations, specialized frogman units pioneered the art of stealth attacks on ports, cables, pipelines, and anchored vessels. Today, while technology has evolved, the core threat posed by covert human insertion remains potent, and in many ways more difficult to attribute than machine-based operations.
The Soviet Union invested heavily in developing naval Spetsnaz forces during the Cold War, deploying frogmen to probe, map, and, if necessary, attack critical maritime assets across Europe. These operations, often shielded by the cover of civilian vessels or midget submarines, created persistent vulnerabilities that NATO navies struggled to counter without triggering major escalation. Understanding this historic playbook is essential to recognizing the renewed threat today: modern Russian diver units, now enhanced with advanced insertion platforms and underwater technologies, continue to pose a serious challenge to European seabed security.
How Soviet Frogmen Pioneered Undersea Sabotage
The Soviet Union was an early pioneer in undersea grey zone operations, cultivating an elite cadre of naval Spetsnaz frogmen during the Cold War. These combat swimmers were trained to reconnoiter, tap, or destroy seabed infrastructure, often brushing up against NATO defenses without triggering overt military escalation. A series of open-source episodes between the 1950s and 1980s offers clear evidence of Moscow’s intent and specialized tradecraft, and provides vital historical context for today’s maritime hybrid threats against Europe’s critical infrastructure.
Buster Crabb and the Soviet Cruiser: A Deadly Encounter in Portsmouth (1956)
One of the earliest and most telling incidents occurred in 1956 at Portsmouth Harbour in the United Kingdom. Commander Lionel “Buster” Crabb, a decorated Royal Navy diver, disappeared while clandestinely inspecting the hull of the visiting Soviet cruiser Ordzhonikidze during a state visit. Subsequent British inquiries concluded that Crabb had likely been intercepted and killed by Soviet combat divers assigned to guard the vessel. The episode revealed that Moscow not only deployed protective frogmen on diplomatic voyages, but was also willing to neutralize perceived threats inside NATO territory without provoking open conflict, hallmarks of enduring grey zone behavior.
Silent Reconnaissance along Scandinavian Shores (1960s–70s)
Throughout the late 1960s and 1970s, Swedish naval hydrophones repeatedly detected anomalous activity along the nation’s coastline: unidentified swimmer deliveries, seabed crawler tracks, and other signatures of clandestine underwater operations. Swedish defense white papers from the period warned that Soviet mini-submarines and sabotage divers were systematically probing naval bases, communication lines, and cable routes across the Baltic Sea’s archipelagos.
These persistent incursions marked the Baltic littorals as an early contested underwater frontier, one where ambiguous intrusions eroded maritime sovereignty without escalating to declared conflict. The strategic logic behind these missions remains highly relevant today: testing defenses, mapping targets, and signaling presence without crossing the bright line into overt hostilities.
The “Whiskey on the Rocks” Incident: A Crisis Averted (1981)
In October 1981, Soviet submarine U-137 (S-363) ran aground deep inside Sweden’s Karlskrona naval base complex—an event that exposed covert sabotage intentions at a particularly tense moment in the Cold War. Swedish investigators who boarded the stranded vessel discovered diver lockers, specialized underwater gear, and indications that the submarine’s real mission may have involved deploying sabotage teams against coastal targets.
The diplomatic crisis that followed underscored how undersea grey zone operations could spark dangerous escalations even without a single shot fired. U-137 served as a case study in the risks inherent to covert maritime operations in contested waters, a dynamic that persists, and arguably intensifies, in today’s Baltic theater.
The Hårsfjärden Incident: Elusive Intruders in Swedish Waters (1982)
Less than a year after U-137, Swedish anti-submarine warfare (ASW) forces engaged in a month-long hunt for suspected Soviet mini-submarines operating inside restricted waters near undersea communication lines at Hårsfjärden. Sonar contacts returned signatures consistent with diver delivery vehicles, and multiple sightings of swimmers equipped with closed-circuit rebreathers further validated suspicions.
Although the intruders ultimately evaded capture, Stockholm took the extraordinary step of publicly accusing Moscow of preparing sabotage missions against national infrastructure. The Hårsfjärden Hunt was an early example of how ambiguous, difficult-to-attribute undersea intrusions could create serious security dilemmas for Western nations, setting precedents for the grey zone maritime contestations NATO navies now confront on a broader scale.
The Silent Threat of Modern Russian Frogmen
The Cold War record of Soviet frogman operations provides the critical foundation for understanding the resurgence of Russian undersea sabotage capabilities today. Moscow’s modern PDSS (anti-diver sabotage) and GUGI (deep sea research) formations draw heavily on decades-old doctrine, pairing civilian vessel covers with covert diver operations to project influence and contest critical infrastructure far below the threshold of conventional conflict.
Recognizing these historic precedents is vital: if Soviet frogmen could threaten NATO ports in the 1970s with relatively primitive equipment, today’s Russian operators—equipped with nuclear-powered motherships, advanced mini-subs, and unmanned systems—pose substantially more sophisticated and difficult-to-detect grey zone maritime threats to undersea networks across European waters.
Building a Layered Grey Zone Diver Force
Russia’s post-Soviet navy did not discard its Cold War frogman legacy; it refined and expanded it. Today, Moscow fields a layered undersea force composed of naval Spetsnaz brigades, anti-sabotage PDSS detachments, and GUGI-controlled deep-sea “research” units. These forces train year-round for underwater reconnaissance, cable tapping, and hard-kill sabotage missions—capabilities squarely aimed at exploiting Europe’s reliance on vulnerable seabed infrastructure.
This force structure reflects a deliberate strategy: sustaining grey zone capabilities that impose strategic risks while maintaining plausible deniability, a hallmark of Russia’s broader hybrid warfare doctrine.
Deep Ocean Missions and Strategic Reconnaissance Hubs
Following the Soviet Union’s collapse in 1991, Russia restructured its undersea sabotage forces into two complementary tracks. Surviving frogman units were folded into the Main Intelligence Directorate (GRU) and the newly formalized Main Directorate of Deep Sea Research (GUGI).
Fleet-level reconnaissance sabotage brigades continue to operate under GRU auspices, with prominent units like the 390th Special Purpose Reconnaissance Point (Northern Fleet) and the 42nd and 431st brigades (Black Sea and Pacific Fleets). Meanwhile, GUGI took responsibility for deep-ocean strategic missions, operating nuclear mini-submarines like Losharik and purpose-built vessels like Yantar from its Olenya Guba hub on the Barents Sea.
This bifurcated structure ensures Russia maintains both tactical undersea sabotage options close to home and strategic reach against critical seabed assets across the globe.
Where Russia’s Frogmen Are Trained
Russia sustains its diver capabilities through two dedicated training pipelines. The 907th Joint Training Centre near St. Petersburg runs a basic frogman and marine raider syllabus, graduating roughly 700 combat swimmers annually. Recruits assigned to PDSS anti-sabotage units receive further specialized training at the 313th Special Purpose Detachment in Baltiysk, a hub focused on underwater demolition, stealth infiltration, and defensive counter-diver missions.
Modern Russian frogman training also emphasizes Arctic operations, extended-range insertions, and clandestine sabotage missions, mirroring Cold War playbooks but now supplemented by advanced insertion platforms and modern equipment.
Research Ships as Launchpads for Covert Ops
Capabilities once limited to individual frogmen and midget submarines have now been massively extended by the advent of purpose-built motherships. Vessels like Yantar can deploy three-man submersibles such as Rus and Konsul, capable of operating at depths of up to 6,000 meters (20,000 feet). These ships also field unmanned underwater vehicles (UUVs) and seabed reconnaissance drones.
The nuclear-powered Belgorod submarine similarly acts as a strategic enabler, capable of deploying the Losharik deep-diving minisub or even the Poseidon nuclear-armed underwater drone. By pairing traditional diver operations with modern unmanned and deep-sea capabilities, Russia has expanded its capacity to contest seabed infrastructure without surfacing, and often without attribution.
This fusion of Cold War frogman doctrine and next-generation seabed warfare tools adds a dangerous layer of ambiguity to the evolving grey zone competition beneath Europe’s waters.
Uncrewed Systems and the Future of Undersea Sabotage
The motherships Russia now deploys across European waters do not operate alone. They serve as mobile launch pads for a rapidly modernizing family of unmanned underwater vehicles (UUVs) designed to scout, spoof, or strike undersea infrastructure without ever exposing a diver. These unmanned systems offer Moscow new means to contest the seabed battlespace while minimizing attribution risk and complicating NATO’s defensive calculus.
The most prominent of these systems is the Poseidon, a nuclear-powered, nuclear-armed autonomous torpedo capable of loitering at extreme depths before delivering either a strategic or non-nuclear seabed detonation. Trials conducted by the special-purpose submarine Belgorod concluded in early 2023. While primarily conceived as a strategic deterrent, Poseidon‘s virtually unlimited range and deep-running stealth profile confer additional strategic advantages: clandestine seabed mapping, psychological intimidation, and the persistent threat of infrastructure disruption far from Russian shores.
Beyond Poseidon, the Rubin Design Bureau has developed the Klavesin-1RE and Klavesin-2R-PM autonomous underwater vehicles, platforms deployable from both submarines and surface vessels. These AUVs can dive to depths of 6,000 meters and are equipped with sonar, electromagnetic sensors, and video reconnaissance systems, making them well-suited for seabed survey, cable detection, and clandestine reconnaissance.
Complementing these systems is the Okeanos bureau’s LI ANPA AUV, notable for its manipulator arm, which could allow operators to tamper with, sever, or sabotage undersea infrastructure. Meanwhile, Rubin’s Vityaz-D set a record 10,028-meter dive in 2020 and has since been upgraded with enhanced data link capabilities and payload modularity. In 2024, Rubin unveiled Surrogate V, an autonomous system capable of mimicking the acoustic signature of submarines, complicating NATO anti-submarine warfare efforts and masking the activities of real UUVs or combat divers operating nearby.
The operational deployment of these systems is no longer theoretical. Evidence suggests that Russia has already used UUV tactics: British authorities discovered Russian seabed sensors placed along the patrol routes of the UK’s Vanguard SSBNs, critical assets for nuclear deterrence. This discovery came after extensive loitering by the Yantar near sensitive British waterways, and amid reports that Russian oligarchs’ superyachts may have been repurposed to support covert underwater reconnaissance missions.
By integrating advanced UUVs with covert motherships like Yantar and Belgorod, Russia has effectively extended its Cold War-era frogman doctrine into the unmanned age. This evolution introduces a new and more complex layer of ambiguity into grey zone maritime operations, challenging traditional attribution mechanisms and complicating both European and U.S. decision-making below the threshold of open conflict.
Living Sensors: Russia’s Military Marine Mammals
The same drive that has propelled Russia toward increasingly advanced unmanned systems has also sustained its investment in an older, biologically based toolset: military-trained marine mammals. In the cluttered, acoustically noisy environment of naval bases and shallow coastal waters, living sensors—dolphins and whales—remain remarkably effective. From Cold War-era attack dolphins stationed in Crimea to modern-day surveillance belugas like Hvaldimir, Russia continues to field marine mammals as integral assets for undersea reconnaissance, mine clearing, and port security missions.
This program has deep historical roots. Originating during the Soviet period, Russia still maintains two primary marine mammal training centers: Olenya Guba in the Arctic north and Sevastopol on the Black Sea. Throughout the Cold War, bottlenose dolphins trained at these facilities were employed to detect enemy divers, locate mines, and defend naval bases. The strategic value of these capabilities has endured. During the conflict with Ukraine, Russia significantly increased the deployment of trained dolphins at Sevastopol, aiming to deter infiltration and protect against undersea sabotage attempts.
The case of Hvaldimir, a beluga whale likely trained at Olenya Guba and later spotted near Norway wearing a harness fitted with cameras, further underscores Moscow’s ongoing use of marine mammals for intelligence-gathering and reconnaissance missions. While often perceived as outdated, these programs offer operational advantages in environments where technological sensors can be compromised by ambient noise or environmental clutter.
Marine mammals perform a range of specialized roles. They can detect and track hostile divers and submarines, sweep harbors for mines and ordnance, and serve as mobile reconnaissance platforms, discreetly gathering information on undersea infrastructure without emitting the electronic signatures that betray mechanical systems. In a modern battlespace increasingly saturated with sensors, their organic stealth gives Russia a niche capability set that complicates traditional Western assumptions about how the seabed and littoral zones can be monitored and defended.
Western Adaptation to Maritime Hybrid Threats
Faced with a surge in grey zone maritime threats from shadowy cable saboteurs to loitering spy ships and covert diver teams, NATO and the United States have undertaken a multi-pronged effort to secure Europe’s vital undersea infrastructure. The Western response has been deliberately layered: combining deterrence through presence, investment in advanced surveillance technologies, stronger intergovernmental coordination, and more aggressive diplomatic signaling to strip adversaries of plausible deniability.
NATO’s New Coordination Cell for Seabed Security
Recognizing the strategic vulnerability of seabed assets, NATO established the Critical Undersea Infrastructure Coordination Cell in Brussels in early 2023. The Cell’s mission is twofold: first, to systematically map the vulnerabilities of the extensive web of maritime cables and pipelines throughout European waters; second, to improve cross-Allied coordination in detecting and responding to grey zone threats against them.
By May 2024, the Cell held the first Critical Undersea Infrastructure meeting, convening leading military, industry, and governmental stakeholders. This effort has elevated undersea infrastructure protection to a strategic priority on par with traditional military domains, which had never fully materialized even during the Cold War.
The institutional coordination now underway significantly shortens warning timelines. If a telecom operator, for instance, detects an anomalous cable pressure drop indicating a potential break, NATO maritime forces can be alerted almost immediately. This ability to move from commercial anomaly detection to military surveillance and response within hours, rather than days or weeks, fundamentally improves Europe’s resilience against undersea hybrid attacks.
Operation Baltic Sentry and Maritime Deterrence
On the operational front, NATO and partner nations have launched a new generation of maritime monitoring missions aimed squarely at countering grey zone threats. In January 2025v, the Alliance initiated Operation Baltic Sentry, a concerted effort to police the Baltic Sea against suspicious maritime activity, particularly threats to undersea critical infrastructure.
At any given time, Baltic Sentry deploys at least ten NATO warships or auxiliary vessels on patrol, divided into task groups supported by a broader constellation of ships and aircraft contributed by the eight NATO countries bordering the Baltic. These assets operate under a unified command structure, coordinated between NATO’s Maritime Command and the new Critical Undersea Infrastructure (CUI) center. This structure allows for real-time data fusion and faster operational responses to suspected grey zone activities.
Critically, Baltic Sentry integrates non-combat survey vessels equipped with advanced sonar arrays and submersibles to inspect seabed anomalies and monitor cable integrity. It also employs aerial surveillance, rotating assets like P-8 Poseidon maritime patrol aircraft, NATO AWACS, and other allied platforms to maintain an over-the-horizon view of the maritime domain. By turning the Baltic into a persistently watched environment, Baltic Sentry aims to impose psychological and operational costs on adversaries contemplating covert action.
Initial indicators suggest a deterrent effect. Since the operation’s inception, NATO forces have observed that Russian shadow fleet tankers and suspicious commercial vessels tend to alter course and cease irregular behaviors once NATO patrols or aircraft approach. This early success highlights the power of visibility and presence in countering grey zone tactics, where attribution is difficult but deterrence remains achievable through persistent engagement.
Planning Exercises for Hybrid Warfare Scenarios
Beyond real-time operations, NATO is investing heavily in exercises that prepare forces for hybrid grey zone scenarios. The UK-led Joint Expeditionary Force (JEF), which includes Northern European NATO members, conducted Exercise NORDIC WARDEN in mid-2024. This series of drills was explicitly designed to practice the protection of undersea infrastructure across the North Atlantic and Baltic Sea under contested conditions.
Warships, submarines, and maritime patrol aircraft from ten countries rehearsed scenarios such as monitoring vital undersea energy and communications routes, detecting anomalous maritime behavior, and intercepting vessels suspected of tampering with critical infrastructure. These exercises not only build readiness, but also send a strong strategic signal that NATO is systematically preparing to confront grey zone operations, deterring adversaries by demonstrating both capability and intent.
NATO is also advancing its technological edge. The Alliance has initiated plans to field a persistent fleet of subsea and surface drones capable of continuously patrolling pipeline and cable corridors. Officials envision a networked mesh of unmanned systems—a high-tech “tripwire” on the seafloor—capable of providing early warning against interference or sabotage.
Several member states are already taking action. The United Kingdom has fast-tracked the acquisition of a Multi-Role Ocean Surveillance Ship (RFA Proteus), converting a commercial vessel to carry unmanned vehicles and diving teams for undersea protection missions. France and Norway have similarly expanded their investments in survey vessels and underwater drones, reinforcing NATO’s ability to monitor and secure the undersea domain.
Strategic Signaling at the Vilnius Summit
NATO’s adaptation to the grey zone maritime threats extends beyond operations and exercises across European waters, and into the policy realm. At the 2023 Vilnius Summit, the Alliance issued a landmark statement warning that hybrid attacks, including sabotage of critical undersea infrastructure, could trigger Article 5, the collective defense clause.
While the language was carefully measured, the message was unmistakable: NATO now recognizes that hybrid activities, if strategically significant, may warrant an Alliance-wide military response. This represents a major doctrinal shift from previous decades, where Article 5 was reserved almost exclusively for overt military aggression.
This shift reflects a broader strategic understanding that hybrid grey zone tactics can produce destabilizing effects equivalent to traditional armed attacks. Moreover, NATO and EU leaders have moved toward more aggressive public attribution. In coordinated statements, foreign ministers from multiple member states pinned responsibility on Russia for the recent sabotage of Baltic Sea cables and pipelines, condemning these acts as systematic attacks on Europe’s security architecture.
Such diplomatic unity and public attribution serve a dual purpose: stripping grey zone actors of plausible deniability and laying the groundwork for collective deterrence. In an environment where ambiguity is a weapon, clarity and collective signaling becomes a vital countermeasure.
Denying Adversaries the Shadows They Exploit
The contest for Europe’s maritime domain increasingly plays out in the shadows through covert acts that test the limits of international law, challenge NATO’s cohesion, and threaten the security of critical undersea infrastructure without triggering open conflict. Grey zone maritime threats are no longer theoretical. They have become a persistent, operational reality stretching from the North Atlantic to the Mediterranean.
The first and most urgent task has been to illuminate the grey zone. By systematically exposing covert activities, whether Russia’s clandestine seabed mapping, suspicious cable “accidents,” or loitering espionage vessels, Western nations are steadily eroding the deniability that adversaries once relied on. Transparency remains the most immediate weapon against hybrid tactics: when malign behavior is detected and attributed publicly, the strategic risk calculus for aggressors shifts.
Yet awareness alone will not be sufficient. The nature of the grey zone maritime threats—multifaceted, stealthy, and constantly adapting—demands a dynamic, multi-domain response across European waters. Advances in surveillance technology, artificial intelligence for maritime anomaly detection, and enhanced Allied information-sharing networks are beginning to close the gaps in domain awareness. But protecting Europe’s underwater lifelines will also require proactive resilience-building: from deploying unmanned patrol networks across the seabed to hardening infrastructure itself against subthreshold attacks.
Grey zone threats, by design, operate in the seams between traditional defense, law enforcement, intelligence, and economic policy. Western maritime security must evolve accordingly. No longer solely the province of navies, defense of the undersea domain will require a holistic effort, blending military deterrence with regulatory vigilance, private sector partnerships, and rapid legal and diplomatic attribution mechanisms. Success will hinge not merely on technological innovation, but on agile institutional adaptation.
The good news is that momentum is building. NATO’s coordinated maritime monitoring for threats throughout European waters, the tightening of multinational attribution efforts, and new investments in seabed defense capabilities are steadily making the grey zone a less permissive environment for malign actors. The strategic imperative is to sustain and accelerate this trend, closing windows of ambiguity faster than adversaries can innovate around them.
Ultimately, grey zone competition is a contest over the control of ambiguity itself. To win, the West must deny its rivals the shadows they seek to exploit. European waters are vast, but they are not lawless, and those who target them from the deep must know that they are neither unseen nor unchallenged.
