'No longer hybrid' — As Russian sabotage grows bolder, Europe lacks red lines

Moscow's shadow war on Europe grows bolder by the day, and no one can say how far the Kremlin is ready to go.

Russia is no longer only meddling in elections or hacking networks: Germany found explosives-laden drones at its Leipzig Airport in an apparent Moscow-backed sabotage plot. Russian drone incursions in NATO airspace are now common. And a Russian warship shot flares at a Danish military helicopter.

The rhetoric in Western capitals has hardened, with some saying this campaign is "no longer hybrid at all."

For the first time, Berlin named Russia as a perpetrator of a physical attack against its infrastructure, and allies grow less fearful about downing drones and detaining shadow fleet ships.

But even as European officials warn that Moscow's campaign may yet escalate in the coming months, the question of how to deter it remains unanswered.

The response so far has ranged from symbolic ones, like shuttering Russian cultural and diplomatic centers, to fresh sanctions and arms packages for Ukraine — something that Moscow has weathered for years.

Analysts say Europe must toughen up, with some calling for novel ways of retaliation that will catch the Kremlin off guard.

"We've got to make Russia think: 'OK, s**t, they're awake,'" proposes Edward Lucas, a British journalist, security analyst, and head of the Baltic International Security Center (BISC).

Testing Europe

Russian hybrid warfare — from cyberattacks and GPS jamming to disinformation campaigns and election meddling — was nothing new for NATO countries prior to 2022.

But Moscow cranked up its operations to a whole new level after the full-scale war broke out, with its suspected proxies setting warehouses on fire and its shadow fleet allegedly cutting cables and launching drones over strategic targets across Europe.

Researchers say that the number of hybrid attack incidents increased fourfold between 2023 and 2024, with one study recording 151 incidents in Europe between the start of the full-scale invasion and March 2026.

This campaign has become increasingly kinetic since 2025, when a group of Russian drones invaded Polish airspace. Moscow's drones are now probing other countries at NATO's frontier, from the Baltic to the Black Sea.

Such attacks aim not only to sow panic and disrupt support for Ukraine, but also to test Europe's willingness to hit back, officials and experts say.

Polish Prime Minister Donald Tusk warned on Sept. 17 that Russia might soon launch further "accidental" missile and drone strikes into NATO's territory to prove that Article 5 "is more theoretical than practical."

Moscow is testing something that Julian Pawlak, a security expert at the German Institute for International and Security Affairs (SWP), calls a "deterrence gap" — Europe's blank spot between its current response toolkit and a full-on military response against Russia.

And it is Europe's slow and weak response that allows Russia to keep doing so and trying just "how far it can go," the expert told the Kyiv Independent.

Part of the reason European nations are often slow to respond is the difficulty of finding solid evidence that allows them to publicly blame Russia.

Moscow often uses proxies; for example, vulnerable Ukrainian and Belarusian refugees recruited through the Telegram messaging app, says Anastasia Pociumban, an expert in hybrid threats at the German Council on Foreign Relations.

However, Pociumban also believes that the "states often use these delays to avoid taking costly response measures and not to create panic."

NATO made clear already in 2016 that a hybrid attack can trigger Article 5. But it doesn't define what red line the attacker would have to cross — that's up to individual states.

Pawlak raises doubt over whether "European politicians or capitals actually themselves know where this line is."

Adding to that, NATO members may be reluctant to invoke Article 5 at a moment when the alliance grapples with internal divisions, as a lackluster or absent response from allies could shake its credibility.

The U.S. under the Trump administration is shifting away from Europe, while Slovak Prime Minister Robert Fico recently declared that his country would not be drawn into a war "because of some Article 5."

And German officials said it is "no coincidence" that fresh cases of sabotage in Germany came shortly before regional elections, which saw major wins for the Kremlin-friendly, NATO-skeptic Alternative for Germany (AfD) party.

Pociumban sees a "two-front pressure campaign" — with Russia deploying not only physical and cyber attacks but also leveraging parties that want to "normalize" ties with Moscow.

Europe's response

A response to a Russian hybrid attack roughly comes in three steps — countering its impacts, identifying the culprit, and deterring the perpetrator from trying something like this again.

Europe has seen progress in the first area.

NATO air defenses are building up drone defenses along the border and are finally downing Russian drones.

European navies are stepping up protection of maritime infrastructure and are detaining suspected Russian shadow fleet vessels, and governments are bolstering protection of critical infrastructure.

Countries on the front lines of Russia's hybrid war — such as the Nordics and the Baltics — are further integrating military and civilian defenses, aiming to counter the very kind of threat Moscow's shadow war poses.

Estonia, for example, aims to expand the law enforcement role of military and allied forces to help counter threats similar to the "little green men" scenario in Crimea in 2014, when Russian troops without insignia occupied Ukraine's peninsula.

And European officials are learning not to mince words and talk about Russia's campaign more openly.

The Leipzig Airport attack marked the first time Berlin officially accused Moscow of orchestrating such an attack on its soil.

Estonian Intelligence Chief Kaupo Rosin dismissed "hybrid warfare" as a euphemism and urged European leaders to describe Moscow's campaign as "state-sponsored terrorism."

The stance was echoed by EU chief diplomat Kaja Kallas, who said Moscow's campaign bears "all the hallmarks of state-sponsored terrorism."

Nevertheless, deterring this campaign is the most persistent problem.

After Germany officially blamed Russia for the Leipzig Airport attack, its response — next to promising additional support for Ukraine — was to shut down a Russian consulate and tighten visa access for Russian citizens.

"You should have done this a decade ago… after (Russia occupied) Crimea in 2014," Lucas told the Kyiv Independent.

Europe must "get on the front foot and take the initiative," he adds.

Deterrence

In 2022, just a few months after the invasion, Lithuania banned the transit of EU-sanctioned goods to the Russian exclave of Kaliningrad.

Russia's threats of "retaliation" sparked concern in Brussels, which in turn pressured Vilnius to relent.

Three years later, Estonia attempted to stop a shadow fleet tanker it said was violating sanctions — before a Russian Su-35 entered NATO airspace to shield the tanker, preventing the boarding.

Tallinn later said it would refrain from detaining shadow fleet ships due to the risk of military response.

The record shows that when smaller front-line states want to take bolder steps, they need solidarity so as not to bear the brunt of Russia's response alone.

This is what Lucas calls a lateral response — if a Russian drone violates Estonian airspace, it could be Sweden, Germany, or the U.K. that hits back.

Analysts agree that Europe must increase the costs to Russia of its hybrid war. But they propose different ways of going about it.

According to Pawlak, Europe should set a clear line and make sure the aggressor knows that if it carries out Action A, Europe will respond with Action B — for example, sending another shipment of arms to Ukraine.

Lucas proposes a different path: Europe should "blindside" the Kremlin by the scale and range of its responses.

A sabotage attack should trigger, for example, "a money-laundering investigation in one jurisdiction, an unseaworthy ship impounded in a second, a cyberattack on a Russia-related target launched from a third," he writes in his April column.

But Europe must be ready to see its response through, even if Moscow escalates, Lucas adds in comments for the Kyiv Independent.

"Because it would be disastrous if we see an initial escalation (by a European country), Russia then threatens, and the (European) country backs down again," he warns.

Note from the author:

Hi, this is Martin Fornusek.

I hope you enjoyed this article. In our team, we believe fact-based and truthful reporting should be available to all — that's why we don't use any paywall.

If you want to see more in-depth coverage of regional politics and how it shapes Ukraine's struggle against Russian aggression, please consider joining the Kyiv Independent community.