Russia's Federal Security Service has launched a sophisticated disinformation campaign alleging that Ukrainian and British intelligence services plotted to hijack a MiG-31 fighter jet equipped with Kinzhal hypersonic missiles and redirect it to NATO's Mihail Kogălniceanu airbase in Romania. The evidence-free accusation represents a dangerous escalation in Moscow's hybrid warfare targeting both Bucharest and Kyiv, arriving at a strategically opportune moment as Romania grapples with announced US troop reductions.

FSB and its hybrid "design"

The FSB's Tuesday announcement follows the established pattern of Russian intelligence services operating as primary tools in the information domain. The agency provided no evidence to support its claims, instead constructing an elaborate narrative involving $3 million bribes to pilots, British intelligence coordination, and even alleged involvement by the investigative journalism group Bellingcat.

Romania's Foreign Ministry swiftly dismissed the allegations with pointed irony.

"Soviet spy novels weren't exactly brilliant, being propaganda exercises. Today's Russian news stories with spies are the same," said Foreign Ministry spokesman Andrei Țărnea, emphasizing that "what's real is Russian aggression and the Russian provocations these stories about planes and spies attempt to cover."

Multi-Domain targeting strategy

The operation demonstrates textbook hybrid threat methodology across multiple domains:

Information domain: The primary vector employs disinformation to shape international perceptions and create confusion about alliance cohesion.

Diplomatic domain: By falsely implicating Romania in an alleged Ukrainian intelligence operation, Moscow seeks to create friction between NATO allies, particularly by exploiting sensitivities around Romania hosting alliance infrastructure.

Political domain: The timing capitalizes on genuine political tensions following the US troop withdrawal announcement, amplifying existing vulnerabilities in the Romanian security debate.

Military/Defense Domain: The narrative specifically targets Mihail Kogălniceanu airbase, NATO's largest military installation in southeastern Europe, where nearly 3,000 hectares are under development with €2.5 billion in investments planned through 2040.

Tool application: coordinated propaganda amplification

The operation's sophistication emerges in its cross-platform propagation. Chinese state media quickly amplified the FSB narrative, with Xinhua publishing a version that emphasized anti-Ukrainian angles and cited Russian State Duma deputy Dmitry Belik claiming the alleged plot demonstrated "Ukraine's intention to drag NATO into an open military conflict with Russia."

This coordinated echo represents a calculated information tool designed to establish false legitimacy through repetition across multiple authoritarian media ecosystems. 

The narrative simultaneously serves Chinese strategic interests inportraying Western-aligned Ukraine as destabilizing.

Priming through provocation as the Hybrid playbook tool

The FSB operation aligns with the priming phase of hybrid threat activity, where actors establish narratives that can be leveraged during future destabilisation or escalation phases.

By creating a fictional "precedent" of Ukrainian-British operations against Russian assets via Romanian territory, Moscow establishes information terrain for potential future false-flag operations or diplomatic pressure campaigns.

Notably, the FSB claimed that in response to this "thwarted plot," Russian Aerospace Forces struck Ukrainian intelligence facilities in Brovary and Starokonstantinov airfield on November 9-10 using Kinzhal missiles. This represents a dangerous inversion of cause and effect, potentially providing retroactive justification for kinetic military operations.

Strategic Objectives: fracturing alliance cohesion

The underlying objectives align with Russia's documented strategic culture of exploiting openness in democratic societies while seeking to undermine collective security architectures:

1. Wedge strategy: creating perceived conflicts of interest between Romania, Ukraine, and other NATO allies
2. Deterrence manipulation: Suggesting that hosting Ukrainian military operations or aircraft could make Romania a direct target
3. Narrative preparation: establishing information groundwork for future accusations or provocations
4. Attention diversion: Shifting focus from Russian aggression in Ukraine to fabricated NATO "provocations"

Resilience Response: exposure and Attribution

Romania's response demonstrates effective hybrid threat countermeasures. By immediately exposing the disinformation, using accessible language that frames the narrative within historical Soviet propaganda patterns, and refusing to legitimize the accusations through detailed rebuttals, Romanian officials denied the operation its intended amplification effect.

The incident highlights the importance of rapid response capabilities, strong inter-agency coordination between foreign ministries and defence establishments, and effective public communication strategies that expose hybrid operations without inadvertently reinforcing their narratives.

Vulnerability exploitation in transitional security contexts

The operation's timing reveals sophisticated intelligence about alliance vulnerabilities.

By launching this disinformation campaign during a genuine period of Romanian concern about US force posture adjustments, the FSB maximized the narrative's potential to create doubt and friction.

Approximately 5,000 NATO troops currently stationed in Romania, predominantly from the United States, Poland, France, and Spain, represent a tangible alliance commitment that Russia seeks to undermine.

Implications for Hybrid Threat Preparedness

This incident validates several core principles of the hybrid threats analytical framework:

• Cross-domain effects: actions in one domain (information) create cascading vulnerabilities in others (diplomatic, political, military)
• Attribution challenges: by implicating multiple actors (Ukraine, UK, Bellingcat), the operation complicates attribution discussions
• Below-threshold operations: the activity remains beneath conventional military thresholds while achieving strategic communication objectives
• Exploitation of openness: democratic media ecosystems and diplomatic transparency requirements become vectors for disinformation spread

As hybrid warfare continues evolving, the Mihail Kogălniceanu fabrication serves as a case study in how authoritarian actors weaponize information during periods of genuine security transition, seeking to transform legitimate policy debates into tools of strategic destabilization.

This analysis employs the Hybrid CoE conceptual framework for analyzing hybrid threats across actors, tools, domains, and phases to provide structured understanding of contemporary information warfare operations.