The Balkans’ Critical Infrastructure Front

Hybrid warfare targeting Europe, and the Western Balkans in particular, has expanded in recent years at the nexus of energy, resources, technology, and security. Energy and digital transitions alike create new vulnerabilities for countries and international organizations such as NATO and the EU. Russia and China are well positioned to exploit these weaknesses. 

The more significant challenge stems not only from the fact that the Balkans are an arena of great-power rivalry. Rather, weak institutions, political polarization, and declining confidence in the European enlargement process are factors that create conditions conducive to interference by external actors. With public trust fragile and uncertainty over the region’s long-term geopolitical direction growing, disinformation campaigns, infrastructure investment, and economic leverage all become instruments in the toolkits of external actors vying for greater influence.

Following Russia’s invasion of Ukraine, the Western Balkans are quickly becoming Europe’s next most important strategic arena. But the fighting increasingly takes place in the digital sphere rather than on battlefields. Recent cyber incidents affecting telecommunications firms, public utility providers, and several government agencies across the Balkans highlight an alarming trend in which critical infrastructure has become a target of hybrid operations. Such cases show that cyber disruption can negatively impact public confidence, state capacity, and critical infrastructure security. The reportedly Russian-linked March 2026 cyberattack against Telekom Srbija Group in Serbia resulted in the leak of customer records, showing that telecommunications providers can have significant vulnerabilities. 

Montenegro’s state energy provider was forced to switch to manual operations after an August 2022 cyberattack disrupted the digital operations of the country’s electricity grid. This case is particularly significant because it demonstrates that a cyberattack on public systems can quickly escalate to a combined infrastructure-security crisis, challenging the resilience of both government and energy provider. Albania’s railway, shipping, and other border hubs in 2024 suffered attacks that disrupted regular operations, exposing the vulnerability of the movement of goods, people, and services, with potentially significant economic and political consequences. 

Serbia is the most concentrated example of a wider Balkan problem: the risk stemming from the interplay between energy dependency, geopolitical ambiguity, and weak public trust. Belgrade has long managed a delicate balancing act between competing external relationships. While Ukrainian forces have reportedly relied heavily on Serbian ammunition purchased through third countries, Belgrade also recently extended a gas supply deal with Russia’s Gazprom, addressing up to 90% of Serbia's needs. This may not bode well for Serbia’s future path to EU membership. Challenges to such balancing acts are increasingly supported by information operations aimed at shaping public perceptions, assigning blame, or undermining trust in institutions and corporate leadership.Such hybrid operations fit a familiar pattern: Disinformation and cyberattack campaigns have routinely targeted the Balkans, spreading false information about the EU’s credibility, COVID-19, and elections. 

Due to their vital role in the dissemination of information, especially during moments of political and societal upheaval, telecommunications providers and other critical infrastructure firms frequently find themselves targeted. In Serbia, this dynamic can be seen in the Telekom Srbija Group case. The cyberattack was followed by heightened public and political scrutiny of company leadership and governance, including criticism from media commentators and political actors. The case is significant because Telekom Srbija Group sits at the center of Serbia’s telecommunications infrastructure at a time when the country’s digital networks are becoming increasingly geopolitically relevant, largely due to Western-supported 5G networks and international financing, including a recent Eurobond issuance and US EXIM-backed support for 5G rollout. Company CEO Vladimir Lučić has also played a role in establishing the Balkan franchise of US broadcaster Newsmax. The case in question illustrates that a cyberattack targeting critical infrastructure can become part of a wider political debate over corporate governance, media influence, and digital sovereignty. 

Vital energy, transportation, and financial firms, as well as diplomats and journalists in other parts of Europe, have found themselves targeted as they sit at the intersection of public trust, national resilience, economic stability, and strategic decision-making. Governor of the National Bank of Romania Mugur Isărescu found himself at the center of recurring deepfake campaigns using AI-generated audio and video content promoting questionable financial services. Iulius-Dan Plaveti, the CEO of Romania’s Hidroelectrica, the largest electricity producer in the country, was targeted in a similar manner. Such cases show that hybrid operations increasingly target not only infrastructure systems themselves, but also the credibility of the institutions and individuals responsible for them. Public trust in financial stability, energy security, and corporate leadership can become a target in its own right.

Serbia’s digital, energy, and transport infrastructure is especially sensitive to geopolitical competition as several major powers seek to maintain a foothold simultaneously. With historic ties to Russia, including Moscow’s political support on Kosovo, Belgrade remains one of Moscow’s last major European partners. Russia also holds a significant stake in the country’s energy industry. Meanwhile, Serbia is one of the main European beneficiaries of China’s Belt and Road Initiative (BRI), although Chinese infrastructure financing, industrial investments, and preferential trade agreements have greatly expanded Chinese influence across the Balkans. Montenegro, for example, took a controversial multibillion-euro loan from the Export-Import Bank of China to fund its Bar-Boljare highway. On the security front, Serbia is the only European country that deploys Chinese military technology. Security competition, however, represents the exception rather than the rule, as Chinese companies continue to invest primarily in transport infrastructure, mining, and telecommunications. 

The Western Balkans’ connectivity with strategic spaces such as the Black Sea, the South Caucasus, and the broader Middle Corridor support Brussels’ efforts to diversify trade, energy, and transport links away from Russian-controlled routes, and should be viewed as strategic infrastructure. Ports, railways, logistics hubs, and telecom networks cannot be viewed as separate areas of concern; they are part of the same European security equation. 

The EU and the United States also have deep strategic interests in Serbia and the wider region. Serbia remains a candidate for EU membership and has deepened many of its ties with Western institutions in the diplomatic, economic, and security arenas. With NATO forces stationed in Kosovo, and NATO members on almost all sides, Serbia occupies a critical place in the alliance’s security considerations. As hybrid warfare, disinformation, energy security, and related vulnerabilities have risen in importance in recent years, NATO and the EU’s overall approach to security is directly relevant to recent concerns about Serbia’s energy, digital, and information landscape. 

The battle for influence is already underway, and critical infrastructure is a key front. Serbia, and the Balkans more broadly, represent not an isolated challenge but part of a wider regional test: Can Europe strengthen resilience before strategic vulnerabilities in energy, technology, and information spaces are further exploited by external actors? A clear security strategy is required to strengthen protection and resilience against Russian and Chinese coercion, especially in energy and technology fields, in preparation for the new era of hybrid warfare.

The views expressed herein are those solely of the author(s). GMF as an institution does not take positions.