The Security Brief

Tag: NATO

  • Russia’s Expanding Patriotic Education System: Indicators of Long-Term Mobilization

    This analysis was prompted by recent reporting from Matthew Luxmoore at the Wall Street Journal, which highlighted how deeply military content has been integrated into Russian schools. I reviewed additional reporting, open-source research, Russian government documents, and independent analyses to understand the broader context.

    Overview

    Recent reporting by Matthew Luxmoore at the Wall Street Journal (WSJ) prompted a deeper look into how far the Kremlin has reshaped Russia’s education system for long-term militarization. His work highlights a trend that has accelerated significantly since the invasion of Ukraine in 2022, and after reviewing additional sources, the picture that emerges is sharper and more concerning than a single article can capture.

    A Systematic Shift Since 2014

    Russia’s patriotic education initiatives began expanding after the annexation of Crimea, but the scale shifted significantly following the 2022 invasion. Federal spending grew from roughly $40 million in 2021 to nearly $600 million by 2024, supporting curriculum rewrites, school-based training programs, and the proliferation of state-run youth organizations.

    New standardized history and civics textbooks portray the US and NATO as direct threats and depict Ukraine as a Western proxy. Tactical training equipment and mock Kalashnikov rifles have been distributed to thousands of schools. In many regions, these activities are now compulsory, not extracurricular.

    Youth participants in military training exercises, equipped with camouflage uniforms and training equipment, highlighting the integration of militarization in Russian education. Source: Jamestown

    Education as a Mobilization Pipeline

    The Defense Ministry’s Youth Army (Yunarmiya), established in 2016, now claims more than 1.8 million members. It operates as a nationwide cadet network that integrates students into military culture early and maintains engagement through adolescence.

    Active-duty personnel increasingly teach in classrooms, leading instruction on weapons safety, basic first aid, drone operation fundamentals, and military discipline. By eighth grade, these courses resemble structured pre-conscription preparation. In occupied Ukrainian regions, Russia has imposed these same curricula while removing Ukrainian-language materials.

    Map showing the assessed control of terrain in the Russo-Ukrainian War as of November 14, 2025, highlighting significant fighting areas and territorial claims. Source: Institute for the Study of War

    Strategic Messaging

    The Kremlin frames these programs as tools for national unity and resilience. Critics inside Russia describe them as mechanisms for suppressing dissent and reducing independent thought. Teachers who resist implementation face administrative penalties or prosecution, underscoring the coercive nature of the effort.

    While patriotism in Russian schools is not new, the current approach is more centralized, more compulsory, and more explicitly linked to real-world conflict. The expansion into early childhood (down to the first years of primary school) represents a significant change from previous decades.

    Information Environment Pressures

    A key driver appears to be the changing information landscape. Russian youth have greater exposure to Western media, global online discourse, and alternative political viewpoints than previous generations. Surveys consistently show that younger Russians are the least aligned with Kremlin narratives and the most likely to bypass state information controls.

    This environment has prompted more aggressive ideological programming. Early-age indoctrination is used to establish state-approved narratives before outside information becomes accessible.

    Implications for Future Confrontation

    Taken together, these developments suggest deliberate social preparation for long-term geopolitical tension with the West. Russia is not only modernizing its armed forces; it is shaping future generations to accept sustained confrontation and large-scale mobilization as normal.

    This generational strategy will influence Russia’s military posture, information operations, and cyber workforce for years to come. For the US and allied nations, it suggests a security environment where societal militarization becomes a persistent feature of Russia’s strategic behavior.

    But let me know your thoughts!

  • US Intelligence Support Amplifies Ukraine’s Deep Strike Campaign On Russian Energy Infrastructure

    A recent Financial Times report revealed that the US has quietly provided intelligence support to enable Ukraine’s long-range strikes on Russian energy infrastructure, representing a significant evolution in the strategic landscape of the war. This isn’t just about Ukraine landing successful drone or missile strikes. It’s about deliberately going after the economic base that keeps Russia’s war machine running.

    According to the reporting, US intelligence has played a central role in shaping Ukraine’s route planning, timing, and target prioritization. This has allowed Ukrainian forces to bypass layers of Russian air defense and strike energy assets far beyond the frontline. Over the last few months, at least 16 of Russia’s 38 oil refineries have been hit, disrupting more than one million barrels per day of refining capacity. These strikes have forced Moscow to cut diesel exports and rely more on imports, tightening supply chains across sectors vital to its economy and military.

    Flames and smoke rise from a Russian oil refinery after a Ukrainian drone strike in October 2025, part of a US-backed campaign targeting energy infrastructure. Source: The Moscow Times

    The operation points to a deliberate shift in US strategy. Rather than direct military engagement, the US appears to be enabling Ukraine to impose economic costs through precision strikes on energy infrastructure. These assets are crucial to financing and sustaining Russian military operations. By degrading this capacity, Ukraine is eroding the Kremlin’s ability to wage a prolonged war.

    The timing is notable, too. The escalation in intelligence sharing reportedly followed a July conversation between President Donald Trump and President Volodymyr Zelenskyy, signaling a change in Washington’s willingness to support deeper strikes. This is a departure from earlier caution, signaling a move toward indirect pressure on Moscow, as opposed to direct escalation.

    The operational implications are just as significant. Ukraine has combined improved domestic drone production with high-quality targeting data to achieve strategic effects once reserved for major powers. This model of intelligence-enabled, long-range strikes highlights how modern warfare increasingly relies on precision, adaptability, and economic disruption rather than massed forces alone.

    In the months ahead, Russia is likely to face mounting financial pressure as repeated strikes force expensive repairs, disrupt production cycles, and strain export revenue. Even if individual facilities recover, the cumulative effect of sustained targeting will weaken Moscow’s economic resilience. This campaign is designed to shift the balance through systemic pressure on the Kremlin’s capacity to sustain its war.

    References:
    https://www.ft.com/content/f9f42c10-3a30-4ee1-aff7-3368dd831c8c
    https://www.themoscowtimes.com/2025/10/12/us-intelligence-helps-ukraine-strike-russian-energy-infrastructure-ft-a90789
    https://www.nytimes.com/2025/10/13/world/europe/ukraine-drones-russia-oil-refineries.html

  • Russian MiG-31s Violate NATO Airspace

    Russian MiG-31s Violate NATO Airspace

    Summary: On 19 September 2025, three Russian MiG-31 fighters violated Estonian airspace near Vaindloo Island, remaining inside NATO territory for about twelve minutes before being intercepted by Italian F-35s deployed under NATOs Baltic Air Policing mission. The aircraft entered without flight plans, had their transponders off, and failed to communicate with air traffic control, prompting a rapid NATO response.

    Estonia reported the jets penetrated up to five nautical miles into its territory. NATO officials framed the incident as another deliberate provocation, testing alliance readiness along the eastern flank. Reports indicate these MiG-31s were carrying Kinzhal hypersonic missiles during the incursion.

    Analysis: Russia is deliberately testing the NATO alliance by sending strategic assets into allied territory to measure response times and resolve. Putin likely views NATOs restraint as an opportunity to exploit through unconventional warfare and hybrid tactics. These incidents are likely to also shape his perception of alliance weakness, influencing future decisions in possible future conflicts in the Baltics or APAC region.

    Sources

    Reuters: https://www.reuters.com/business/aerospace-defense/nato-member-estonia-says-three-russian-jets-violated-its-airspace-2025-09-19/

    AP News: https://apnews.com/article/443df0c37ff2254fcc33d5425e3beaa6

    Türkiye Today: https://www.turkiyetoday.com/world/3-russian-jets-enter-estonian-airspace-nato-scrambles-f-35s-3207176

  • Russia’s Digital Playbook: Targeting Poland’s Election with Anti-Ukrainian Disinformation

    Russia’s Digital Playbook: Targeting Poland’s Election with Anti-Ukrainian Disinformation

    As Poland approached a critical presidential runoff on June 1, Russian-linked influence networks ramped up efforts to flood Polish social media with anti-Ukrainian messaging. The Institute for Strategic Dialogue (ISD) recently published a detailed report showing how these campaigns are designed to erode public support for Ukraine and stir domestic resentment, right when political tensions are at their peak

    Two main disinfo operations are behind this push. One is Operation Overload, which has a track record of impersonating media outlets and recycling content. The other is a newer ecosystem tied to the Pravda and Portal Kombat networks, which lean heavily on AI-generated articles and fake screenshots to manufacture outrage.

    Some of the false claims spreading online included:

    • A fake story alleging that Ukrainian refugees were planning terror attacks in Poland
    • A re-edited satire video presented as real, suggesting Ukrainians were exploiting Poland’s welfare programs
    • AI-written content designed to look like legitimate Polish journalism
    • False narratives amplified so widely that even language models like ChatGPT ended up echoing them when prompted

    Analyst Comments

    This is classic information warfare, just modernized.

    Russia doesn’t need to hack a system if it can hack the conversation. These campaigns are trying to fracture Poland’s support for Ukraine by painting refugees as a threat socially, economically, and even physically. It is low-cost, high-volume influence work, meant to stoke outrage, not debate.

    What makes this different from past operations is how AI tools and platform vulnerabilities are baked into the tactics. Generative models are now being used to churn out disinfo content that mimics real reporting. Influencer accounts are being used to frame false stories as trending news. Even satire is weaponized, knowing that once something goes viral, the original context is often lost.

    As we head into another global election cycle, Poland is not the only target. Similar tactics are already being seen elsewhere, especially in countries where refugee issues, defense policy, or migration tensions are front and center. This is a good reminder for policymakers, tech platforms, and threat analysts: the battlefield may be digital, but the consequences are real.

    Reference

    https://www.isdglobal.org/digital_dispatches/russia-aligned-campaigns-amplify-negative-sentiment-towards-ukrainians-in-poland-ahead-of-a-decisive-presidential-vote/

  • Hidden Bear: How GRU Unit 29155 Evolved Into a Cyber Sabotage Force

    Hidden Bear: How GRU Unit 29155 Evolved Into a Cyber Sabotage Force

    Disclaimer: This post is based on unclassified, open-source reporting and reflects my personal analysis and interpretations. The views expressed here are my own and do not represent the views or positions of my employer.

    In a previous post, I detailed GRU Unit 29155’s role in physical sabotage campaigns across Europe, from the Skripal poisoning to the Czech arms depot blasts. For years, their operations reflected a legacy of Cold War-era tradecraft. Covert, kinetic, and plausibly deniable.

    But according to a new investigation from The Insider, Unit 29155 has undergone a major transformation. While their physical sabotage capabilities remain intact, they have expanded into the cyber domain, developing a set of offensive capabilities that go far beyond what most attributed to this unit.

    This evolution has implications not only for Ukraine but for NATO supply chains, digital infrastructure, and future hybrid conflicts.

    Cyber Attacks

    The reporting confirms what many in the threat intelligence space have suspected. Unit 29155 is no longer limited to physical acts of disruption. In 2022, the group ran the WhisperGate operation in Ukraine, using destructive malware to damage government systems and leak personal data. The intent was not just disruption. It was psychological destabilization.

    This operation was structured and deliberate. The malware wiped systems while the data leaks created distrust. This fits Russia’s broader approach to hybrid warfare, where technical, cognitive, and physical effects are coordinated for maximum pressure.

    Disinformation Campaigns

    Unit 29155 also operated false flag personas like Anonymous Poland. These were used to publish disinformation that undermined trust between Ukraine and its Western partners. This was not unsophisticated trolling. It was part of a campaign using multilingual content and coordinated narratives.

    In one example, the group reportedly collaborated with Bulgarian journalist Dilyana Gaytandzhieva to publish stolen material. This gave the operation a veneer of journalistic legitimacy. Russia has long used this kind of media laundering to amplify leaks, but seeing it connected to Unit 29155 shows their deeper involvement in the information space.

    Hacker Recruitment

    This evolution started more than a decade ago. Around 2012, the GRU began recruiting programmers and hackers through online forums and competition platforms. They focused on individuals who could operate quietly, build offensive tools, and maintain strong operational security.

    Some of these actors developed malware, access frameworks, and data exfiltration tools that supported both espionage and sabotage. This is the convergence of cybercrime tradecraft and military doctrine. Unit 29155 has grown into a force that can operate in the digital domain with the same intent and effect as their physical missions.

    NATO Supply Disruption

    The investigation also highlights the unit’s interest in transportation and logistics networks, particularly in countries like Poland. This is a strategic move. It targets the rear areas that support Ukraine’s defense by interfering with how weapons and supplies reach the front lines.

    Instead of blowing up rail lines, the modern version might involve tampering with scheduling software, triggering false alarms, or planting disruptive code that causes bottlenecks. The outcome is the same. Slow the response. Introduce uncertainty. Force decision makers to question the integrity of their support systems.

    This aligns closely with Russian military thinking. Create friction, delay, and confusion through minimal but high impact actions.

    Analyst Comments

    This isn’t a new threat; it’s a mature one. GRU Unit 29155 has evolved from a physical sabotage unit into a hybrid operations group. Their capabilities now span cyber access, information warfare, and physical disruption. All under the same command structure.

    For security professionals, this should change how we think about attribution and intent. A single unit may now be responsible for an email phishing campaign, a leaked set of government documents, and a compromised transportation system. That complicates response planning and forces a more integrated intelligence posture.

    In my opinion, cyber sabotage is no longer the prelude to conflict. In many cases, it is the conflict.

    References

    https://theins.press/en/inv/281731

    The Escalation of GRU Unit 29155: Espionage and Sabotage Tactics