Separating Campaign-Level Threat from Incident-Level Attribution: A Bayesian Framework for Assessing Russian Hybrid Operations in Europe

European debate about Russian “hybrid war” tends to collapse three different questions into one: whether Russia is conducting hostile activity below the threshold of armed conflict, whether that activity forms a centrally coordinated campaign, and whether a given incident was directed by the Russian state. This article develops and applies a Bayesian framework that keeps these questions apart. At the incident level, six exhaustive hypotheses distinguish Russian state operations, state-sponsored proxies, autonomous pro-Russian actors, other states, non-hostile causes, and non-incidents; evidence enters through explicit likelihoods with dependence weights, and uncertainty in those likelihoods is propagated by simulation. At the campaign level, eight evidence blocks are weighed against three hypotheses: coordinated campaign, fragmented activity, and over-attribution. Applied to five cases spanning the evidentiary spectrum—the Wagner-tasked Leyton arson, Nord Stream, the Eagle S cable damage, the December 2025 Polish grid attack, and the November 2025 Dutch drone sightings—the model yields posterior probabilities of state direction ranging from below 0.05 to above 0.99. At the campaign level, the probability of sustained Russian activity exceeds 0.97 under every prior and dependence assumption tested, whereas the probability of central coordination ranges from 0.56 to 0.87 and is driven chiefly by assumptions about source dependence. The framework shows which conclusions are robust, which are assumption-dependent, and which evidence would most reduce uncertainty. A census of all 255 incidents in a recent open-source dataset, coded against a tiered evidentiary standard, shows that a Russian link is established for 41% of covert incidents and state direction for 24%, that none of 28 drone sightings is established, and that roughly one in five recorded incidents is overt or lawful state activity. The findings support graduated public attribution and investment in forensic and financial evidence over the accumulation of incident counts.