Europe fortifies itself against Russia’s hybrid war

Russia is stepping up its hybrid war against Europe. From sabotage, drone incursions, and arson to plots (mostly foiled) to assassinate pro‑Ukraine activists and Russian dissidents on European soil, the Kremlin is testing the allied response, and incidents against NATO’s European partners are becoming more serious, such as the explosive‑laden drones found this summer at Leipzig Airport in Germany. That gray line between a hybrid attack and a conventional one is blurring, and several European intelligence sources warn of the risk that one of those incidents could escalate — either by a deliberate Kremlin decision or a miscalculation.

“What would have happened if the explosives at Leipzig Airport had detonated?” asks a senior EU source. Senior European and NATO officials consulted over the past week share the concern — not because of a conventional military assault but because that gray boundary is becoming ever more fragile. “The greatest danger now is that the hybrid war will accidentally cross a red line,” says another veteran source, who points to an incident two weeks ago in which flares were fired from a Russian frigate at a Danish helicopter as an example.

In fact, Emily Ferris, a researcher at the Royal United Services Institute (RUSI), says the serious episode involving explosive drones in Leipzig — which Germany clearly attributed to the Kremlin on September 1 — “showed that Moscow, and probably NATO itself, still lacks clarity on the current red lines that would trigger a military response.”

The Kremlin is furious at the stalemate in its war against Ukraine — which is approaching its fifth anniversary — and is moving to undermine allied support for Kyiv while testing the West’s response capacity, which so far has been relatively mild. The uptick in attacks is also occurring at an especially vulnerable moment for Europe, as it considers how to operate without the security umbrella of the United States and on the eve of a key super election year for the European project.

In recent weeks the alarm has risen sharply and Europe is beginning to bunker down against a threat that is becoming less and less hybrid. “We are preparing to face and survive a new kind of war,” admits a European intelligence source. One that does not necessarily involve missiles or tanks but could paralyze a country and undermine society through cuts to water and energy supplies, disruptions to computer systems, or weeks‑long closures of its airports, the source stresses.

Temperatures are rising in European capitals and the secret visit by CIA director John Ratcliffe to Moscow on August 25, the mystery over its purpose, and the messages he received there, has fed concern. The trip revived an unsettling precedent: the last time a CIA director traveled to Moscow was in November 2021, when William Burns tried to dissuade the Kremlin from invading Ukraine. Vladimir Putin launched the full‑scale war on February 24, 2022. As such, Keir Giles, a researcher at the Chatham House think tank, says the comparison is inevitable — and the parallel, he adds, shows how seriously the U.S. appears to view the current Russian threats.

Russia is multiplying its hostile and criminal acts, French President Emmanuel Macron warned a few days ago, saying the nature of the Russian aggression and those threats in Europe is changing. It is intensifying. Polish Prime Minister Donald Tusk said he has intelligence indicating the Kremlin is preparing to escalate hybrid attacks by late autumn and winter, coinciding with a particularly “critical” moment on the battlefield in Ukraine. Danish intelligence services warned last week that there is a risk Russia could carry out a “limited” attack on one or more NATO member states in the coming months.

However, despite the alarms — especially from the Baltic and Nordic countries, which are closest to Russia and the most direct and frequent victims of these incidents — no ally has invoked NATO’s Article 4, which states member countries “will consult together whenever, in the opinion of any of them, the territorial integrity, political independence or security of any of the Parties is threatened,” military sources note.

The Atlantic Alliance is deliberately ambiguous about its response to this and other types of threats. Last week, its secretary-general, Mark Rutte, warned that the Russian menace will remain for the long term and urged Kyiv’s allies to “stay calm, carry on, and keep supporting Ukraine.” “Russia, in the end, is doing this because they are not successful at the moment in Ukraine,” he insisted during his visit to the United States in a conversation with that country’s ambassador to NATO, Matthew G. Whitaker.

The U.S. representative was blunt. “The first shot of any future global conflict is not going to be troops across a border. It is going to be attacks on infrastructure and attacks on technology and very sophisticated increasing hybrid warfare,” Whitaker said, calling for preparation not only for conventional war but also for hybrid war. “We’re going to have to do it all at the same time,” he warned.

Europe and its outlook have shifted a great deal over the last year. “Hybrid threats facing Europe are less and less hybrid and less and less threats,” European Commission President Ursula von der Leyen said in her solemn state of the Union speech to the European Parliament on September 16. Brussels is finalizing a security strategy that aims to strengthen strategic capabilities — air and missile defense, transport, space, and cybersecurity — create a common response framework to hybrid threats, and an emergency protocol that would allow the 27 to coordinate when an incident seriously threatens a member state without constituting an armed attack, EU sources explain. That strategy complements preparedness plans — which design measures so the population can be self‑sufficient for at least 72 hours in any emergency, from climate to armed conflict — and other infrastructure reinforcement plans.

Von der Leyen, a strong Atlanticist, stresses that NATO will remain the pillar of collective defense, but she has also spoken of creating a kind of “Article 4” modeled on NATO’s that would adapt current institutions and decision‑making mechanisms — designed for a “different world” — to today’s situation, the head of the EU executive said. Yet nobody in Brussels seems very clear on what that mechanism will look like or what it will entail.

Thus, the European Union — the institutions and its member states — is constructing, piece by piece, a new security architecture for a continent that can no longer clearly separate peace from confrontation. France is finalizing a special plan to protect critical infrastructure and the most sensitive facilities of its defense industry against drones and Russian cyberattacks. The Netherlands is stepping up its civil preparedness plans.

Denmark has activated a “total defense” plan and mobilized €161 million to strengthen water and electricity supplies, telecommunications, hospitals and transport. Sweden has announced a new €1.3 billion package for its air defense and is preparing, together with its neighbors, civilian evacuation plans. Norway has declared 2026 the “year of total defense.” Poland has tightened protection of its infrastructure. Lithuania is fortifying its strategic facilities against drones and sabotage. Belgium has launched its first national defense plan since the Cold War.

The Kremlin and its intelligence services declared a hybrid war on Europe long ago. Sabotage and targeted killings on European soil are part of the hallmark of its intelligence agencies. In 2018, officers from Russia’s military intelligence service (GRU) attacked their own former agent Sergei Skripal in the United Kingdom; a year later, in a Berlin park, a Russian citizen murdered Chechen exile Zelimkhan Khangoshvili on orders from “Russia’s central directorate,” according to the Higher Regional Court in Berlin.

Now, despite the blow to Russian espionage in the early stages of the Ukraine war (with thousands of expulsions of alleged diplomats and officers posted in Europe), such attacks are more frequent. And more serious. A study by the U.S. think tank the Center for Strategic and International Studies (CSIS), which has compiled its own database, says Russian sabotage — cutting submarine cables, GPS interference, attacks on defense companies — has increased since 2024.

In addition, intelligence officials cited by the Associated Press say Russia’s campaign of targeted killings in Europe has not only grown since the invasion but has also expanded its targets. They are no longer just deserters (such as Maxim Kuzminov, the Russian helicopter pilot who switched to the Ukrainian side before going into exile in Spain, where he was murdered in 2024) or former agents; they now include Russian opponents and foreigners who support Ukraine. Lithuania’s prosecutor’s office points to Russia, and particularly the GRU, as responsible for a foiled plot last year to assassinate Russian‑Bashkir dissident Ruslan Gabbasov and Lithuanian activist Valdas Bartkevičius.

For decades, Europe could think of war as something that happened beyond its borders. Today the situation is different. It has stopped treating its rear areas as a safe, separate zone from the front and now sees them as spaces vulnerable to sabotage, cyberattacks, espionage, and strikes on critical infrastructure with grave consequences.

Sign up for our weekly newsletter to get more English-language news coverage from EL PAÍS USA Edition