The hybrid ceasefire: A persistent threat in the Black Sea

An illustration of a maritime port with multiple ships. Blue glowing arcs connect various points, symbolising cyber connectivity, data exchange, or electronic warfare.

25 March 2025

A ceasefire in Ukraine and the Black Sea could be undermined by Russian hybrid warfare due to the likely limited scope and uncertain conditions of a ceasefire agreement. Hybrid warfare tactics, such as cyberattacks, sabotage, and disinformation campaigns, can continue to target critical infrastructure even during a ceasefire.

By Kristian Bischoff, Analyst

While generally covering old concepts in international adversarial competition, “hybrid” warfare/activities/tactics is a term that has been increasingly used to explain some tactics related to modern warfare. In short, hybrid activities involve a combination of conventional military force, cyber attacks, drones, espionage, misinformation, and electronic warfare activities, commonly executed in such a way that the activity retains plausible deniability by the perpetrator. This allows an actor to achieve strategic objectives without triggering a full-scale military response. This portfolio of activities is useful for pressuring opponents without resorting to overt military action.

Hybrid tactics have long been linked to the conduct of Russia in areas like the Baltic Sea and elsewhere, but especially so in the case of Ukraine before February 2022, where hybrid tactics were extensively used to destabilise the coherence of the country and pave the way for the actual invasion.

Vladimir Putin is only likely to accept a ceasefire proposal if it allows Russia to continue to exert pressure on Ukraine. Hybrid activity in the Black Sea will allow Russia to maintain pressure and leverage in negotiations or in a post-war situation, causing disruptions and damage while still retaining plausible deniability to its partners and the wider international community. For example, attacks on energy infrastructure and port facilities may continue to some degree, affecting maritime operations and civilian infrastructure.

This is especially the case if Russia sees the ceasefire only as a brief pause in hostilities and uses it to strengthen its own position and regroup. At the same time, Russia will want to deny the Ukrainians any chance of similar respite or recovery, and hybrid activities are a way to continue to exert pressure – although to a lesser degree than with overt military means. Hybrid activities in the Black Sea are therefore likely to continue if Russia wants to undermine the viability of a truce and ultimately destabilise it to a point of failure and renew hostilities.

Russian hybrid activity continuing after a ceasefire is also likely due to the established Russian priority of disrupting Ukrainian trade in and out of the major ports of the NW Black Sea. Since the failure of the Black Sea Grain Initiative in the Summer of 2023, Russia has maintained steady pressure on the ports in Odessa Oblast, aiming to limit Ukrainian commerce, notably the Ukrainian exports of grain products.

Russian actions for destabilisation and limiting Ukrainian exports could include cyberattacks to disrupt port or shipping operations, AIS interference using electronic warfare, or covertly releasing mines into shipping lanes. The continued use of drones for reconnaissance and espionage is also likely to continue in the area.

While Russia has a long history of such activities, it is also likely that Ukrainian intelligence and special forces organisations have developed capabilities for hybrid tactics and that these will be deployed to some degree against Russian assets in and around the Black Sea. The main limit to such activities may be that Ukraine likely wants to avoid giving Russia an excuse for continuing the conflict, and that Ukrainian activities may therefore be less damaging or disruptive than Russian activities.

🚨 NEW WHITE PAPER:

Hybrid warfare in the Baltic Sea and High North 

In recent years, hybrid warfare has attracted growing attention, particularly following the Russia-Ukraine conflict. With incidents like disruptions to undersea cables and GPS interference, it’s evident that hybrid tactics are reshaping security threats. The High North and Baltic Sea are increasingly becoming focal points for these activities, prompting a stronger response from the EU and NATO. The white paper, explores the rising focus on hybrid warfare in these regions and its implications for future security.