Senior officials and intelligence agencies across Europe have been sounding the alarm that hybrid campaigns orchestrated by Russia and China have increasingly converged, posing an amplified threat to Western security. While, hybrid warfare, characterised by attacking democratic governance through a blend of military and non-military means such as cyber operations, disinformation, sabotage and espionage is nothing new, the strategic alignment of Russia and China in a combined campaign certainly is.
Russia and China both deploy sophisticated cyber capabilities against Western targets, including governments, corporations and critical infrastructure. Chinese state-sponsored groups such as MirrorFace, previously focused primarily on East Asia, have expanded their cyber-espionage campaign into Europe, closely mirroring Russian cyber-espionage patterns. Similarly, Kremlin hackers that have long targeted Europe have also consistently targeted the diplomatic, financial and defence sectors in Japan, South Korea, Australia and Taiwan.
Alignment on anti-Western narratives
This convergence also extends into disinformation and information manipulation. According to the recently released 3rd European External Action Service (EEAS) Report on Foreign Information Manipulation and Interference (FIMI) Threats, while Russian and Chinese operations differ in structure and emphasis, their efforts increasingly converge in both tactics and objectives. While some experts note the cooperation between these two actors has been largely opportunistic, the EEAS report’s network analysis reveals deeper functional convergence. Russian and Chinese FIMI ecosystems increasingly synchronise narratives, especially around major geopolitical events, such as the 1000-day mark of Russia’s full-scale invasion of Ukraine – when both states blamed NATO and the West for escalating the conflict. Their media outlets and diplomatic accounts regularly amplify each other’s content, forming digital bridges that help spread anti-Western narratives across regions like Africa, Latin America and the Balkans.
Both nations have also aligned their strategies in deploying disinformation campaigns intended to fracture social cohesion and undermine democratic institutions. China's expansive "Spamouflage" campaign, known for impersonating human rights organisations to spread anti-Western narratives, parallels Russia’s extensive use of state-sponsored media and digital platforms to amplify divisive content and discredit Western foreign policies.
This collaboration was witnessed more recently when not only Russian but also Chinese disinformation was prominently observed during the devastating floods in Valencia, where manipulated narratives falsely accused Spanish and EU institutions of negligence, exacerbating social unrest and mistrust towards democratic governance. In German-speaking Europe, China has also co-opted Russian-controlled news outlets like Zuerst! to place its messaging.
These aligned narratives suggest coordinated strategic intent rather than isolated parallel efforts. Similar Russian-Chinese convergence against democracies is also being been seen in Latin America and Africa.
A dangerous hybrid partnership
Both regimes use third-party proxies, influencer campaigns and information laundering tactics to obscure the state origin of disinformation, effectively embedding it in local information ecosystems. This alignment of strategy, tools and goals, despite clear evidence of formal coordination, indicates a de facto hybrid partnership that significantly challenges the EU’s information sphere and democratic resilience.
Perhaps the most visible joint endeavour is their use of biased “election observer” missions to legitimise sham plebiscites in Russian-occupied Ukraine, where figures like Mateusz Piskorski and Ladislav Zemánek, reportedly connected to both Russian and Chinese networks, played prominent roles. Piskorski was even charged with espionage for both states. These shared assets suggest that China is increasingly exploiting Russia’s preexisting influence architecture in Europe, particularly where it intersects with populist and far-right political parties.
Pooling resources – and contacts
China and Russia’s espionage activities in Europe also increasingly overlap through shared networks of political influence and information operations. Both countries have leveraged the same individuals and political ecosystems – especially on the European far right and left – for their hybrid campaigns. A striking example involves the Chinese Ministry of State Security (MSS) operative “Daniel Woo,” who recruited Belgian politician Frank Creyelman to disseminate PRC-aligned narratives and collect intelligence. Creyelman also participated in Russian-backed election observation missions in occupied Ukrainian territories, revealing how single operatives can serve both states’ agendas.
The late Manuel Ochsenreiter, an AfD parliamentary staffer, reportedly functioned as a bridge between Chinese and Russian influence efforts, reportedly receiving money from Beijing for a parliamentary query and previously collaborating with Russian disinformation campaigns.
Collaboration in sabotage
The most striking evidence of Russia-China hybrid campaign convergence is their activity targeting undersea communication cables, critical infrastructure that facilitates global internet and financial transactions. In October 2023, the Chinese commercial vessel NewNew Polarbear enroute out of a Russian port damaged a gas pipeline and two telecom cables in the Baltic Sea by dragging its anchor across them.
The January 2025 incident involving the Chinese cargo vessel Shunxing-39 severing cables near Taiwan aligns closely with suspicious Russian maritime activity involving the vessel Vasily Shukshin near other undersea cables which connect Taiwan to the rest of the world. Moreover, the November 2024 sabotage of undersea cables in the Baltic Sea, implicating the Yi Peng 3, a Chinese-flagged vessel with a Russian captain, provides another indicator of operational collaboration.
These incidents in Asian and European waters reflect an increasingly calculated strategy to leverage commercial maritime capabilities to disrupt and intimidate, demonstrating mutual intent and shared operational goals. In addition, China recently unveiled a new submersible designed specifically for cutting undersea cables down to depths of 4,000 metres. Given their level of hybrid convergence seen thus far, it is not out of the question that such a device could be used in European waters in the near future.
China’s economic support, particularly in helping Russia evade Western sanctions through the provision of dual-use technology such as navigation systems, jamming equipment, and aircraft parts, exemplifies strategic economic collaboration. Such assistance bolsters Russia’s military-industrial complex and enhances its capability to sustain its illegal invasion of Ukraine. This economic integration points to a strategic partnership deeply invested in undermining Western economic pressure and sustaining joint geopolitical interests.
In recognition of the converging threat, NATO has significantly revised its strategic approach to counteract hybrid threats from China and Russia. The Alliance has prioritised intelligence sharing, collaborated with private sector stakeholders to protect critical infrastructure, and advanced physical protective measures for undersea cables. This includes establishing a NATO Maritime Centre for Security of Critical Undersea Infrastructure and a new Cyber Defence Centre to address increasingly advanced persistent threats.
Additionally, NATO is deliberating on whether hybrid warfare attacks warrant invoking Article 5 of the NATO treaty, the collective defence clause, indicating its assessment of the gravity of the combined threats posed by Moscow and Beijing.
The European Commission’s recently released White Paper on defence identified Russia as an existential threat and China as a systemic challenge that seeks to “assert their authority and control in our economy and society.”
The European Union, through bodies like the European External Action Service, has intensified intelligence sharing and cooperative cybersecurity frameworks among member states and with international partners. This includes joint cyber exercises, coordinated incident response, and exchange of threat intelligence targeting Russian and Chinese cyber operations. The EU already has a robust counter-disinformation framework that has included not only the Russian but also the Chinese disinformation threat from the 2020 coronavirus pandemic onward.
A call for a closer East-West security cooperation
To effectively counter the hybrid threats posed by China and Russia, European democracies should significantly enhance cooperation with democratic counterparts in Asia. This collaboration should include:
- Refine Europe's stance on China in line with its acknowledgment of Beijing’s role as a hybrid security threat.
- While previous efforts have been made, Europe should make further progress toward an East-West consensus on enforcing economic sanctions against Russia and to impose costs on China for supporting Moscow’s illegal invasion of Ukraine and its hybrid attacks against democracies.
- Establish joint East-West intelligence-sharing mechanisms specifically targeting hybrid threats against financial systems, critical infrastructure, disinformation and influence operations.
- Share cyber defence lessons learned and collaborate on cyber resilience strategies, including regular joint cyber exercises and information exchanges to quickly respond to evolving cyber threats.
- Implement collaborative maritime domain awareness efforts to protect critical infrastructure, particularly undersea cables, through shared situational awareness and monitoring technology.
- Through the G7, develop unified East-West diplomatic and economic strategies to counteract economic coercion and sanctions evasion, presenting a unified front to reduce vulnerabilities.
- Collaborate with democracies in Asia and Oceania to prevent China’s export of dual-use equipment to Russia and consider joint imposition of secondary sanctions against banks and financial institutions that help Russia to evade sanctions.
- Create joint platforms to exchange best practices in counter-disinformation strategies, digital democracy and public resilience programmes to build collective immunity against manipulative narratives.
The emerging convergence in Russian and Chinese hybrid campaigns represents a substantial escalation in their collective challenge to democracy. By synchronising cyber, espionage, disinformation campaigns, maritime sabotage activities and economic sanctions evasion, Russia and China have solidified their “true friendship” in acting against democracies in Europe and Asia.
NATO and the EU’s evolving responses indicate the urgency with which Europe is addressing these threats. But when faced with two aggressive global actors, these efforts may be insufficient, and Europe risks always being one step behind. Democracies in Asia and Australia can benefit from lessons Europe has learned about countering Russian hybrid threats while Europe can benefit from eastern democracies’ extensive knowledge of addressing Chinese hybrid aggression.
For these reasons, closer European collaboration with Japan, Taiwan, South Korea, Australia, Philippines, New Zealand and other democracies in Asia and Oceania is essential to effectively counteract this intercontinental hybrid campaign.
Chris Kremidas-Courtney is a Senior Visiting Fellow at the EPC
The support the European Policy Centre receives for its ongoing operations, or specifically for its publications, does not constitute an endorsement of their contents, which reflect the views of the authors only. Supporters and partners cannot be held responsible for any use that may be made of the information contained therein.