Tensions between Russia and the West have intensified after Germany blamed Moscow directly for the drone attack on Leipzig/Halle airport last month.
German Interior Minister Alexander Dobrindt said the deployment of a drone loaded with explosives followed the “well-established pattern of Russian hybrid operations in Europe”: the use of military and non-military tactics to exert pressure without an open conflict.
In response, Germany and Russia have closed each other’s cultural centers, including the Russian consulate in Bonn.
U.S. Ambassador to NATO Matthew Whitaker described the incident at Leipzig/Halle airport — which has been used in logistics operations in support of Kyiv — as one of the most worrying hybrid actions Europe has witnessed.
Whitaker added that it is important “to firmly express that this type of actions are unacceptable” and that they will not be tolerated.
This is part of a broader pattern of actions that have become increasingly common across Europe since Russia’s large-scale invasion of Ukraine in February 2022, analysts say.
Moscow has denied any involvement in Leipzig and has rejected the German accusations as unfounded.
He has also denied previous accusations.
Earlier this year, the Globsec study center, based in Bratislava, Slovakia, that it identified 151 cases of Russian activity against Europe between February 2022 and February 2026, although it suspects that the actual figure is much higher.
These acts included attempted murder, fires, sabotage, vandalism and public unrest.
The report noted that the distribution of attacks against countries such as Poland, France, Germany, Lithuania, Estonia and the United Kingdom “strongly suggests that support for Ukraine is the most important factor influencing the selection of targets.”
In August, a U.S. Congressional Investigation Service report also listed allegations of Russian attacks on European countries, including attacks on railways and submarine cables, “murder, political interference and influence, cyber attacks and airspace violations, among others.”
Emily Ferris, of the British study center RUSI, says the frequency and magnitude of attacks have intensified since 2022.
The analyst argues that Moscow seeks to create “discord and chaos in the West” and increase “the cost for NATO to support Ukraine,” while remaining “below the threshold of war.”
Maksym Beznosiuk, an associate researcher at Globsec, notes that the Kremlin has been “testing NATO preparedness, exploiting political and legal divisions between allies and intentionally creating uncertainty.”
Beznosiuk argues that Russia’s growing use of hybrid warfare is also a response to the “very high lows” in Ukraine, the depletion of Soviet-era equipment, the growing economic pressure and difficulties to a decisive conventional advance in the war.
“Hybrid operations against Europe are increasingly becoming a strategy to weaken military aid to Ukraine and European defense production at a lower cost and with less risk, while generating disproportionate disruption and political anxiety,” he said.
Most of the acts attributed to Russia so far have caused limited damage, but authorities warn that they still consume significant security resources.
Poland, NATO’s logistical pillar for supply to Ukraine, is a good example of this.
In November 2025, the Polish government described an explosion on a railway line used for deliveries as “an unprecedented act of sabotage” and claimed that everything indicated that Russia was responsible. Moscow denies any involvement.
The incident led Poland to launch a military operation with the deployment of up to 10,000 soldiers to help protect critical infrastructure.
And in January, it signed contracts worth more than $4 billion for anti-drone defense systems along the country’s eastern border.
Drone activities allegedly linked to Russia have been near military facilities, airports and critical infrastructures in several European countries, including Germany, Belgium, Denmark, the Netherlands, France, Norway, Sweden and the United Kingdom.
Hybrid activity is not limited to physical sabotage.
European governments have accused Russian-linked networks of spreading misinformation through the use of fake accounts on social media, fabricated reports and artificial intelligence-generated content.
French authorities have investigated alleged Russian-linked influence operations aimed at prominent political figures ahead of the 2027 presidential election.
In Germany, authorities have warned of attempts to spread false information and undermine confidence in democratic institutions ahead of regional elections.
“The fundamental goal has not changed,” Beznosiuk said.
“Moscow does not necessarily need to persuade a large number of voters directly. It can exploit existing divisions, discredit politicians critical of Russia, intensify political polarization and gradually erode trust in democratic institutions.”
Experts note that, in recent years, Russia has found new ways to distance itself from its hostile acts.
Following the large-scale invasion of Ukraine, European governments concluded that Russian diplomatic missions were widely used for espionage and expelled diplomats suspected of being intelligence agents operating under diplomatic cover.
Since then, according to analysts consulted, Moscow has been very effective in recruiting people from third countries via the internet to circumvent European counterintelligence measures.
“It is no longer done through embassies,” says Ferris. “It is done through these intermediaries.”
Ferris adds that the use of foreigners, who are often motivated by money rather than ideology, makes it difficult to link hostile acts with the Kremlin.
In January, Lithuanian authorities accused the Russian military intelligence service GRU of orchestrating attempts to fire attacks in 2024 against a plant that supplied radio wave scanners to the Ukrainian army.
Six citizens of Spain, Colombia, Cuba, Russia and Belarus were arrested for the case and face sentences of up to 15 years in prison if found guilty.
According to the Globsec report, 95% of the 172 people involved in Russia-linked attacks in Europe were “ordinary citizens without any formal link to the Russian intelligence services.”
“What this causes is a certain distance with Russia,” Ferris asserts, noting that this makes the assignment slow and legally complex.
“All those details took a long time to come to light, which makes it quite difficult,” he adds.
Beznosiuk also highlights the changing role of Russia’s so-called “shadow fleet”: a network of oil tankers and other commercial vessels operating under foreign flags and ghost companies registered abroad to evade Western sanctions against Moscow.
Since 2024, more and more ships have been linked to alleged incidents involving damage to submarine cables and pipelines, as well as surveillance and use of drones near critical infrastructures in the Baltic and North Sea regions.
As with all other accusations, Russia has denied it.
Beznosiuk believes NATO and the European Union (EU) should go beyond what he calls the “rhetorical recognition” of the threat and be clearer about how Russian sabotage is defined and addressed.
Acts of sabotage, he says, should be treated as hostile state activity and there should be stricter restrictions on diplomatic movements, actions against Russia’s “shadow fleet” and greater investment in media literacy in electoral periods.
NATO and EU countries have declared that they are strengthening intelligence cooperation, increasing the protection of critical infrastructures and expanding sanctions against persons, organizations and vessels linked to Russia.
However, authorities assure that greater coordination will be needed as hybrid threats evolve.
Ferris refers to the coordinated response that followed the assassination attempt on former Russian spy Sergei Skripal and his daughter in Salisbury, England, in 2018, when European countries “united” and “expelled in solidarity many of their Russian diplomats.”
According to her, this measure “dismantled Russian intelligence networks in Europe quite successfully.”
In the face of the future, both Ferris and Beznosiuk argue that Russia is unlikely to want a direct war with NATO.
Ferris points out that if the war with Ukraine comes to an end, Russia will take several years to regenerate its army.
Beznosiuk believes a “more plausible scenario” is for Russia to deploy a “limited and deliberately ambiguous political-military provocation on NATO’s eastern flank.”
However, both predict that Russia’s use of hybrid warfare will intensify.
Beznosiuk says Russia is likely to increase its hybrid activity by 2027, with tactics such as sabotage, cyber operations and disinformation to pressure NATO without triggering an open conflict.
“As long as these operations remain cost-effective, difficult to attribute quickly and capable of generating disproportionate disruption and political anxiety, Moscow has strong incentives to continue testing European vulnerabilities and red lines.”
But Ferris and Beznosiuk warn that there is a danger of involuntary escalation.
“Accidents, civilian casualties and politically sensitive incidents could trigger a serious escalation that neither side intends,” Beznosiuk said.
For that reason, Ferris argues that improving communication with Russia is essential, even if it is “unpopular,” which includes the reactivation of the NATO-Russia Council, which held its last meeting in January 2022.
“It’s about avoiding conflicts, not calming tensions,” she says. “There is a wide margin for misunderstandings and death.”
This article was originally written in English and we use an artificial intelligence tool to translate it. BBC journalists reviewed the text before it was published. Find out more about how we use it.
