Russia is Escalating its Hybrid War against Europe, but What for?

“There will be more (Russian — Ed.) hybrid threat actions in the next few months. It will be a dark winter for Europe,” Belgian defence minister Theo Franken warned on September 30. He and his European Union counterparts have already begun discussing a new protocol for responding to Russian hybrid threats. NATO officials are also calling for a revision of its defence approach in the context of hybrid warfare.

What methods is Russia using to wage its hybrid warfare against Europe and why is the Kremlin doing all of this at all?

Direct aggression: drones, aircraft, and beyond

Starting in the early months of the full-scale war, Russian drones have been entering the airspace of countries neighbouring Ukraine. As early as mid-March 2022, a Romanian farmer found an ‘Orlan-10’ reconnaissance UAV, brought it home on his tractor and reported it to the police.

Since then, Russian drones or missiles launched at Ukraine have repeatedly flown into the airspace of Romania, Moldova, Poland, Latvia and Lithuania. The Romanian armed forces alone have recorded around 80 instances of drones or their debris falling. Usually, it happens either due to the guidance system errors or because the munitions trajectories are affected by Ukrainian air defence or electronic warfare systems. Sometimes drones and missiles leave the third country’s airspace after a short while.

In September 2025, 19 Russian decoy Gerbera drones carrying no explosives flew into Poland all at once. Some of them were shot down by NATO aircraft; this was the first time since the start of the Russian invasion of Ukraine that the Alliance’s air force had destroyed Russian UAVs. One of the missiles fired at the drones fell onto a village house due to a guidance system malfunction, but did not explode. No one was injured.

Prior to this, isolated incidents of drones falling in European countries were usually described as accidental, but the aerial incursion into Poland was deemed deliberate, which was stated by Polish and German authorities. The American Institute for the Study of War (ISW) suggested that Russia may have been preparing this operation for several months.

Since the war began, the number of incidents involving Russian military aircraft at NATO’s air borders has increased. For example, in July 2026, NATO aircraft would be scrambled to intercept Russian aircraft 3.5 times more frequently than in July 2025. Interception refers to identificating the aircraft, establishing visual contact and escorting it. In most cases, NATO scrambles the jets when the Russian ones approach the Alliance’s border without a flight plan and with their transponders switched off. However, sometimes Russian aircraft do cross the air border.

The most notable incident occurred a year ago, when three Russian MiG-31s (the aircraft Russia uses to launch ‘Kinzhal’ missiles at Ukraine) spent 12 minutes in Estonian airspace. A few days later, European diplomats privately warned Russia that they were prepared to shoot aircraft down should such incidents recur, according to Bloomberg. On 18 March 2026, a Russian Su-30 spent approximately one minute in Estonian airspace.

Sabotage acts within Europe

Since the beginning of the full-scale war, there have likely been hundreds of Russian sabotage acts within Europe. By August 2025, the International Institute for Strategic Studies (IISS) had reported 66 operations linked to Russia’s hybrid war. The International Centre for Counter-Terrorism (ICCT) and GLOBSEC estimated 151 incidents linked to Russia by the first four years of the war.

In 2026, dozens of sabotage acts have taken place at defence enterprises and infrastructure sites across Europe. The most prominent case was the Leipzig Airport incident, when a drone carrying explosives was discovered near a Ukrainian transport aircraft carrying ammunition intended for the Ukrainian Armed Forces. US intelligence concluded that the design of the explosive device and the explosive itself were typical of those used in operations by GRU, the main intelligence directorate of the Russian general staff. Germany officially accused Russia of involvement in the attempted attack.

In addition to the direct acts of sabotage, Russia also launches its reconnaissance drones over Europe — not only to gather intelligence, but also to create economic and psychological pressure on Europeans, according to the IISS. The Institute estimates that between August 2024 and February 2026, Russians launched 144 drones into European airspace, sometimes using shadow fleet tankers. UAVs have been spotted both over military bases and civilian facilities such as airports. Trouw and DroneWatch, however, recorded more than 50 cases where the information following drone sighting reports was inconclusive between 9 September and 27 November 2025. IStories explained why this happens.

Fibre-optic cables on the seabed of the Baltic Sea have also become a target for sabotage attacks. From October 2023 to the end of 2025, at least 11 instances of cable breakage or damage were recorded. In April 2026, NATO ships disrupted Russian exercises in the Arctic where the Russians were testing a ‘new technology’ designed to damage deep-sea cables, sources told Reuters. The weapon was being tested by the Main Directorate of Deep-Sea Research (GUGI), which is part of the Russian Ministry of Defence.

Other ways Russia is waging hybrid warfare

• Cyberattacks. This is one of the main directions of Russia’s hybrid warfare against Europe, according to the Centre for Strategic and International Studies (CSIS). Some notable operations include a large-scale attack on energy infrastructure in Poland and an attack on a Norwegian dam which hackers were able to take control of and open its floodgates for four hours.

• GPS jamming. Most often, this happens because of Russian electronic warfare against Ukraine's drones. However, experts suggest this might also be an attempt to create a ‘sense of unease’ in Western countries. The Russians use both ground-based jammers (which can interfere with signals up to 450 km away from the Russian border) as well as those in space.

• Disinformation. The European Union has recorded thousands of instances of Russian disinformation aimed at discrediting Ukraine and Ukraine-friendly politicians as well as at praising Russia. The ‘Storm-1516’ project is described by Bloomberg as the most powerful weapon in Russia’s disinformation arsenal. The GRU is likely to be behind the project, while the content is created by the late Yevgeny Prigozhin’s ‘troll factory’ ex-employees. Often, the aim of these information campaigns is election interference. Here you can read more on how Russian propaganda’s fake news actually influences voting results.

• Sending migrants to Europe. Russia is smuggling citizens of various Middle East and Asia countries into the EU via Belarus. In particular, tunnels from Belarus to Poland are being used for this purpose, according to The Telegraph.

• Assassination attempts. The most high-profile operations (the murders of Alexander Litvinenko and Zelimkhan Khangoshvili, and the attempted murders of Sergei Skripal and Emilian Gebrev) had been carried out before 2022. Since the full-scale invasion began, Russia has murdered Maxim Kuzminov, a Russian pilot who had defected to Ukraine. An unsuccessful plot to kill Armin Papperger, the head of Rheinmetall, a major German arms manufacturer, is another example.

Why is Russia doing all of this?

There are relatively few instances of Russian hybrid attacks in Europe able to directly influence the volume of military support for Ukraine. But those have happened — for example, the fires and explosions at factories producing weapons and ammunition. However, whilst the damage caused by a single sabotage act may not be extraordinary, it is wrong to view it in isolation from the overall military strategy, Pavel Luzin, a military analyst, says: “Every successful sabotage act builds up the damage.”

Usually experts refer to broader objectives when speaking about Russian hybrid attacks.

The first objective is to intimidate Europe and force it to withdraw its support for Ukraine. The Kremlin believes that it can defeat Ukraine if Russia’s military capabilities ultimately outweigh the support Kyiv receives from Europe, the Institute for the Study of War reports. According to this logic, sabotage acts and other hybrid warfare tools are intended to force the European governments to withdraw or at least reduce their military and diplomatic support for Ukraine.

Russia cannot influence the European ruling establishment directly, which is why the Kremlin is attempting to intimidate European voters, Abbas Galliamov, a political analyst, believes. The expectation is for Europeans to cast their votes for parties similar to the far-right ‘Alternative for Germany’ or the French ‘National Front.’ “[The members of these parties — Ed.] say: ‘We mustn’t upset Putin; we need to negotiate with him, or it will be bad for us, and there will be war.’ This is betting on an ostrich-like stance, where you simply want to bury your head in the sand without thinking about the future,” Galliamov explains. The situation in Ukraine is, of course, not the main issue for European voters; the problem of migration, for example, is far more pressing. But for many, the far-right parties' stance on the war may well become an additional reason to vote for them, Galliamov says.

The second objective is to test the limits of what can go unpunished. A month ago, Hanno Pevkur, the Estonian defence minister, said Russia was constantly testing the limits of Article 5 (of the North Atlantic Treaty — Ed.), trying to find the “red line.” The article Pevkur referred to states that an armed attack against one NATO member shall be considered an attack against them all, and each member will assist the party attacked. However, this does not necessarily mean military aid.

The problem with Article 5 is that there’s no clear criteria for its invocation. In the entire history of NATO, the article has been invoked just once — following the September 11 attack in 2001. Currently, all of Russia’s hybrid war attacks are carefully calculated so as not to provide grounds for Article 5 invocation, according to The Telegraph's sources within Western intelligence.

“Every successful sabotage act serves as a test of the limits and of the way the target reacts, and a test of the strengths and weaknesses in the target’s defence, which can be used to plan and carry out further actions,” explains Pavel Luzin, a military analyst.

So far, NATO member states have only invoked Article 4 in response to Russia’s actions (twice). This article only provides for mandatory consultations in case one of the member states considers its ‘territorial integrity, political independence or security’ under threat. Last year, such consultations were requested by Poland (following the drone incursion) and Estonia (following the aforementioned airspace violation by Russian aircraft). The invocation of Article 4 should not be regarded as a serious step; tangible measures to counter Russian provocations would be far more effective, says Gleb Bogush, an international law expert.

The third objective is to lay the groundwork for a possible invasion. The Kremlin might not have explicitly decided that it is in its best interests to fight a conventional war with NATO, but it is “undoubtedly setting conditions to do so in the future if it so chooses,” according to ISW. The hybrid warfare attacks are aimed, amongst other things, at sowing division within NATO, as its officials acknowledge. This could affect NATO’s willingness to defend a member state in the event of a Russian invasion.

Furthermore, ISW reports, the Russian military may be violating NATO’s airspace in order to gather intelligence; in particular, to understand the alliance’s air defence response patterns.