Introduction
NATO’s current strategic landscape has slipped firmly beneath the threshold of armed conflict into the realm of disinformation. Foreign adversaries increasingly pursue their strategic interests of corroding NATO unity, polarizing Western policy coherence, eroding legitimacy within democratic institutions, or exploiting existing grievances through instruments of disinformation, instead of the long-established reliance on conventional military force in geopolitical competition. Intelligence reporting across NATO countries confirms that foreign interference, particularly cyber-enabled influence and information manipulation, are now persistent and embedded features of state competition rather than sporadic threats tied to moments of electoral volatility or political crisis.
Rather than pursuing territorial gains, adversarial actors attack the social and cultural fabrics of democratic governance: trust in institutions, confidence in media, electoral legitimacy, and the capacity of societies to sustain collective political cohesion. These operations are not intended to convert Western audiences to competing systems of government, but instead seek to fracture public debate by burdening democratic decision-making with distortion and disorder, consequently weakening NATO’s strategic communications. At its core, this strategy exceeds the bounds of intra-state fragmentation: by distorting the epistemic foundations of democratic decision-making, disinformation warfare broadens the initiating state’s comparative strategic bandwidth internationally. Within this setting, Russia and Iran have taken shape as strategically aligned anti-Western powers amid a steady expansion of bilateral agreements. Despite the gap in scope, resources, influence, and capability, both states exploit open information ecosystems to corrode democratic resilience within NATO societies. Periods of acute geopolitical pressure, including Russia’s war in Ukraine and the Middle East post–October 7, did not create these operations but significantly intensified the existing campaigns targeting democratic cohesion. Far from an abstract end, democratic resilience is a strategic vulnerability inherent to free societies; within NATO contexts, institutional legitimacy and policy coherence function as operational prerequisites for sustained collective defence. As such, disinformation campaigns are designed to degrade these conditions, with crises heightening informational volatility and political sensitivity, enabling adversarial actors to convert external pressure into internal political friction.
Information Operations as Hybrid Warfare
The notion of hybrid threats has been absorbed into the political mainstream through its repeated presence in the statements of NATO, the EU, and the national governments of both frameworks. The term “hybrid threats” continues to invite debate, specifically in relation to its definition and analytical use. However, Frank Hoffman – often seen as the pioneer of this conceptualization – states that “new language and new terms aid us in…characterizing what is truly new…without overlooking what is enduring in war.” Hence, the debate is less about semantics than whether the concept explains how states adapt familiar coercive practices to evolving conditions in pursuit of power. Following this approach, “The Landscape of Hybrid Threats: A Conceptual Model” report released by the European Centre of Excellence for Countering Hybrid Threats, coupled with the EU Commission’s Joint Research Center, frames hybrid threats as a blanket term encompassing a range of activities, including influence operations, campaigns and warfare. Five benchmark factors are needed to assess what falls within hybrid warfare: coordinated use of diverse instruments to produce kinetic and non-kinetic effects, cultivating ambiguity through varying degrees of deniability; the use of deceptive tools, strategic threshold calibration and the weaponization of the vulnerabilities within democratic society. Hybrid warfare therefore essentially hinges on the synchronized use military and non-military means to secure strategic effects, without triggering conventional escalation. In this model, information operations are not peripheral activities but strategic tools of state power, coupled with cyber activity, intelligence operations, economic intimidation, and diplomatic coercion. Information warfare operates across state competition pervasively, directed at adversaries’ information environments, irrespective of regime type. Its potency stems from manipulating narratives, blurring causal perception, and hollowing out trust within target societies. Democratic societies are uniquely exposed because openness, pluralism, and independent media – the very foundations of democratic states, give hostile actors avenues to disseminate manipulative content at scale. Russian influence operations in the United States embody this strategy. Microsoft Threat Intelligence documents how Russian actors methodically and simultaneously recalibrate messaging and discursive framing to volatile political conditions, particularly through operations targeting the 2024 U.S. Presidential election. In the final months of the campaign, Russian-linked actors, such as Storm-1516 and Storm-1679 shifted from targeting President Biden to the Harris-Walz campaign by circulating fake videos and conspiracies through media platforms to amplify social divisions. Particularly, as Microsoft Threat Intelligence notes “[Russian disinformation campaigns] disseminate and amplify propaganda and disinformation from the Kremlin-funded and directed organization RT”. Microsoft points to cyber proxies such as RaHDit who operate alongside these efforts through employing low-level cyber activity, extending narratives where their impact lies in exploiting divisions. Iran mirrors these techniques, albeit more cheaply and on a smaller scale, layering cyber-enabled influence, synthetic-media propaganda, and engineered dissemination to magnify social rifts.
What these operations reveal is a logic of competition rather than persuasion. Rather than seeking to influence rival publics towards a particular position; the point is to generate enough confusion and unrest to weaken democratic systems from within. For states engaged in this geopolitical rivalry, this is a relatively cost-effective way to raise the political costs of coherency without risking open warfare. For multinational organizations, especially those pertaining to collective defence, resilience can no longer be measured solely through the lens of military preparedness; the capacity to withstand and respond to coordinated interference has become equally central for preserving unity.
Iran and Russia as Anti-Western Axis Actors
Although Russia and Iran differ considerably in military strength and geopolitical reach, intelligence reporting consistently indicates a shared strategic logic in their influence operations. Their disposition toward NATO is not merely reducible to abstract anti-Western sentiment; it is grounded in concrete security calculations that shape their geopolitical behaviour. For Russia, NATO enlargement in tandem with Western support for Ukraine – along with encroachment to its perceived sphere of influence, reinforces the Kremlin’s view that the Euro-Atlantic order impedes Moscow’s strategic objectives. However, for Iran, Western pressures manifest differently through economic sanctions and U.S.-aligned regional security architectures that limit Iran’s ability to project influence across the Middle East. Essentially, both perceive NATO as more than a simple military alliance, but as a broader political and normative pillar supporting that an order which constrains their state autonomy.
Rather than pursuing direct military confrontation with NATO, both states aim to destabilize domestic cohesion through digital disinformation campaigns. Their influence operations weaken
faith in governance and their respective public institutions, aggravate ideological cleavages, and chip away support for multinational cooperation. These campaigns do not operate under a centralized command structure, but they move parallel in purpose, timing, and outcome. Iran’s information operations are consistent with its broader asymmetric strategy. This asymmetry reflects Iran’s dependency on low-cost indirect tools, whether through proxies or cyber operations, as a means to offset conventional weakness. Disinformation, in this context, functions as a force multiplier, allowing Iran to impose strategic costs without escalation. Generally, from late 2023 onward, Iran-affiliated cyber actors have directed operations against Western critical infrastructure. Iran-aligned cyber groups, such as the IRGC-linked CyberAv3ngers, have employed a range of tactics and are working to breach critical organizations across sectors, including healthcare, technology, and energy sectors. Under sanctions and conventional limitations, Tehran draws on not merely it’s “Axis of Resistance”, but also its technical tools such as cyber- mediated influence and transnational repression to impose political and reputational costs on Western societies. The Foundation for Defense of Democracies notes how Iran co-opts protests movements abroad under the guise of grassroots activism, quietly supplying financial and organizational support, alongside disinformation campaigns to cultivate anti-Western sentiment from within. This matters largely in light of the strategic value of such activity, which lies in shaping the political environment through which Western states interpret dissent and legitimacy. By embedding itself within emotionally charged movements, Tehran does not need to manufacture division from scratch; it only needs to redirect existing tensions in ways that raise reputational costs and weaken policy cohesion of rival states. In that sense, Iranian disinformation, much like Russia’s, is less about persuasion than exploiting political energy within democratic societies. More importantly, this strategy of ambiguity, allows Iran to blur the line between domestic unrest and foreign interference, forcing Western governments to navigate social instability under conditions of uncertainty.
Russian operations unfold at a broader scale, having entrenched information warfare as a permanent tool of geopolitical strategy. Since the 2022 Ukraine War, Russia’s information operations are no longer limited to propaganda alone. The Kremlin’s disinformation efforts are aligned with missile strikes, cyberattacks, and intelligence activities; this approach merges digital automation, strategic coordination and psychological pressure to destabilize and disorient perception. During crises, the convergence of Russian and Iranian campaigns becomes more evident, both framing Western governments as normatively inconsistent and corrosive; with its implications that spill into NATO societies, such as the indictment of two Canadians in the US for their alleged involvement in an assassination plot linked to Iranian intelligence.
Targeting NATO Societies
Iranian and Russian influence operations are directed not only at governments, but at societies themselves. These are concentrated in settings shaped by polarized identities, fragmented governance, and extensive digital connectivity; conditions evident across NATO member states. Russia and Iran’s governing logic is underpinned by its authoritarian strategic culture, in which the state’s convergent ideological principles inform how they understand security and conflict.
Each regime is marked by anti-democratic norms such as the control and suppression of independent media: a symptom of democratic backsliding in the West, this helps to explain the state’s use of bot-driven and AI-enabled media manipulation as a strategic component of disinformation campaigns. Consequently, an analysis of national strategic cultures yields a clear conclusion: the Cold War divide between capitalist and communist, or Western and anti-Western forces, has not disappeared but migrated into a technical and cultural sphere of disinformation. Universities, information networks, online advocacy circles, and diaspora populations frequently act as channels of dissemination. As argued, influence operations do not create grievances; they leverage pre-existing social and political divisions. During the 2016 election, through fake social media personas and bots, Russia manipulated racial tensions surrounding BLM in the United States to erode social unity and sow division, particularly targeting the Clintons. The FDD analysis of Iranian activity highlights how foreign states intentionally obscure the boundary between authentic protest and foreign-sponsored by adopting activist identities online and subtly manipulating public debate. Microsoft reporting reflects comparable methods employed by Russian actors through deceptive media outlets and AI-generated personas. The ultimate aim is systemic erosion, not abrupt disturbance; as divisions sharpen and trust wanes, support for collective security such as NATO diminishes.
Canada and NATO’s Security Implications
Canada is not immune from these forces. As an open and pluralistic democracy with a densely connected information ecosystem, Canada is especially susceptible to foreign interference. CSIS highlights the ongoing targeting of Canadian institutions, such as academia, civic organizations, as well as ethnocultural communities by Russia and Iran. As a NATO member, Canada’s internal stability directly bolsters the alliance’s collective resolve and defensive posture. The Public Inquiry into Foreign Interference confirmed that while foreign interference, specifically from Russia and Iran, did not determine the ballot box; it weakened public trust in democratic institutions, amounting to a strategic success for hostile actors. Russia, with its enduring effort to delegitimize Western democracies in general, demands hypervigilance from Canada, particularly its Canadian Communications Security Establishment division. This mirrors the Canadian Global Affairs Institute’s Marcus Kolga’s finding that hybrid warfare aims to manufacture instability and disorder rather than short-term electoral gains.
At the alliance level, Iranian and Russian influence operations illustrate that the information environment has become an active site of strategic competition. The most serious risk is alliance fatigue. As polarization grows within member states, preserving public backing for collective defence and sustained security commitments becomes more difficult. However, emerging technologies attempt to further lower barriers to escalation. NATO StratCom analysis convenes policymakers, military experts and practitioners to align cross-sector responses around how AI-enabled tools amplify the breadth, speed, and credibility of counterintelligence influence operations. Moreover, NATO’s Strategic Communications Centre of Excellence serves a vital role in doctrine design ,preparing practitioners, and applying AI analysis to information defence.
Conclusion
These measures reflect an awareness that information must be treated as a field of practice rather than with passive analysis as cyber threats continue to intensify. For Canada, this threat is neither distant nor abstract. For NATO, the defence of the information domain is now intrinsic to collective defence. Meeting this challenge requires coherent coordination and a future-oriented strategy, or adversaries will continue to mould the political terrain, under which NATO must operate without crossing into open war.
Photo: “Man Sitting on Bench Reading Newspaper” (2018), by Roman Kraft via Unsplash. Licensed under the Unsplash License.
Disclaimer: Any views or opinions expressed in articles are solely those of the authors and do not necessarily represent the views of the NATO Association of Canada.
