China‑Russia hybrid tactics

China and Russia are using a broad mix of disinformation, cyber activity, economic pressure and covert influence to test Western unity below the level of open war. (nato.int) The North Atlantic Treaty Organization says those hybrid methods now target political institutions, public opinion and civilian resilience, and it names both the Russian Federation and the People’s Republic of China as leading state actors. NATO updated that assessment on January 29, 2026. (nato.int) The European External Action Service, the European Union’s diplomatic arm, says foreign information manipulation and interference is an intentional, coordinated pattern of behavior that seeks to stoke polarization, weaken democratic processes and damage the European Union’s standing. Its March 17, 2026 overview says it focuses in particular on Russia and China. (eeas.europa.eu) That matters in 2026 because European and North American officials are no longer treating disinformation as a side issue to war. NATO says hybrid actions against one or more allies could, in some cases, lead to a decision to invoke Article 5, and it created a Special Coordinator for Hybrid Threats in 2025. (nato.int) The European External Action Service’s third report on foreign information manipulation, released in March 2025, analyzed a sample of 505 incidents involving about 38,000 channels. It said Russia and China remained among the most prolific threat actors in 2024 and kept adapting their tactics to evade restrictions and use new technology. (stopfake.org) Russia’s side of the playbook is the most established. The Office of the Director of National Intelligence said in its March 2025 Annual Threat Assessment that Moscow would keep using disinformation, espionage, cyberattacks and other gray-zone tools to compete below the level of armed conflict. (dni.gov) China’s side often looks different: less overtly destructive, more persistent, and spread across state media, fake personas and platform networks. Meta said in May 2025 that it removed a China-based covert influence network targeting Myanmar, Taiwan and Japan before it built authentic audiences, and linked it to earlier China-based operations removed in September 2022 and February 2024. (transparency.meta.com) Google’s Threat Analysis Group said on June 26, 2024 that it disrupted more than 10,000 instances of the China-linked Dragonbridge network in the first quarter of 2024 alone. Google said the operation leaned into United States wedge issues, Taiwan and major news events, but still drew little real engagement. (blog.google) Microsoft said on October 23, 2024 that Russian, Iranian and Chinese actors were all active in the final stretch of the United States election, and that Chinese influence operations had shifted attention toward several down-ballot candidates and members of Congress. The report also said Russian actors were integrating generative artificial intelligence into election influence efforts. (microsoft.com) Some Western officials and analysts argue the Russia-China overlap is growing into a more coordinated front. At its May 25, 2025 session in Dayton, the NATO Parliamentary Assembly said Chinese disinformation and cyberattacks were threatening allied democratic ecosystems, and one committee report warned of “growing cooperation with Russia.” (nato-pa.int) Beijing and Moscow do not usually describe these activities in Western terms such as “hybrid warfare,” and both governments have repeatedly rejected foreign accusations of interference and disinformation in other contexts. But Western security institutions are now building policy, staffing and alliance planning around the assumption that these campaigns will continue. (nato.int)