European governments have escalated warnings over an intensifying Russian “hybrid” campaign against the continent, which officials say is meant to test the North Atlantic Treaty Organization’s (Nato) resolve.
French President Emmanuel Macron said on September 18 that “in recent weeks, the threat — particularly the Russian hybrid threat — facing Europeans and France has intensified”. He said he had asked his government to prepare a plan to protect critical infrastructure, including sensitive defence industry sites, against drone attacks and cyberattacks.
A day earlier, Polish Prime Minister Donald Tusk told his country’s parliament there was a “real risk that drones or other types of projectiles will enter the territory of one or several countries on the eastern flank and even cause destruction”, the Associated Press (AP) reported. Germany is preparing its hospitals for a possible Russian escalation, Bloomberg reported, and Lithuania has drawn up evacuation plans for a “variety of scenarios”, Prime Minister Mindaugas Sinkevičius told the BBC.
Nato, the military alliance, is more cautious. A senior alliance official said: “At this time, we see no imminent threat of attack” while cautioning member states against becoming “naive or complacent”.
What is hybrid warfare?
Hybrid warfare is an umbrella term covering a mix of tactics. The BBC describes hybrid attacks as cyberattacks, sabotage and misinformation deployed to pressure and destabilise an adversary, often through proxies rather than openly identified military forces.
The European Parliament, in a report adopted on September 16, defined the term more broadly: as deliberate, combined and coordinated actions by states, including through non-state actors, intermediaries and proxies, that operate across several domains at once, from information and cognitive warfare to cyberattacks and strikes on critical infrastructure.
The report said these operations are engineered to look like separate, unconnected incidents and to stay below the threshold of open armed conflict while still producing effects that can rival conventional aggression.
By design, the format of hybrid warfare makes attribution and response to an adversary difficult.
In practice, that can mean cyber intrusions into government systems, infrastructure sabotage, disinformation campaigns, interference with transport or energy networks, covert operations, and, increasingly, drone attacks.
What is Europe accusing Russia of?
The Institute for the Study of War (ISW), a US-based think tank, argued in a September 16 assessment that these incidents should be treated as a coordinated campaign rather than a series of unrelated events.
It cited Russian-linked attacks or suspected operations against critical infrastructure, European defence industries, cyber targets and Nato airspace, along with threats to undersea cables and the growing role of Russia’s so-called “shadow fleet”, a network of vessels used to evade sanctions, which European analysts have also linked to other covert activity.
Earlier this month, Germany said it had identified Russian involvement in a drone attack at the Leipzig/Halle Airport on August 5. The announcement marked a point at which European officials became more willing to publicly attribute such incidents to Russia.
Other cited episodes include suspected sabotage of Polish rail infrastructure, arson attacks at European defence-related facilities, cyberattacks, and Russian military activity near Nato airspace.
ISW said Russia has accepted the risk that drones and missiles from its war in Ukraine will stray into Nato airspace, and assessed that some of these incursions may be deliberate, a way of testing Nato’s air defences and reaction times.
The BBC separately reported suspicious fires at defence facilities in several European countries, with some governments blaming Russia, and a recent drone strike on a passenger train near the Ukraine-Poland border.
The latest incidents came this week. A fire broke out late on September 23 at a satellite communications station in central Poland, AFP reported. The station, owned by the state telecommunications company Exatel, carries internet traffic through Poland, including to Ukraine, and is also used by SpaceX systems that connect Starlink terminals.
Poland’s digital affairs minister, Krzysztof Gawkowski, said the blaze was sabotage designed to disable the station and disrupt internet access for institutions, including the Ukrainian army. The station remained operational and investigators were still establishing the cause, he said, but “there is much to suggest that we are dealing with an element of the next phase of hybrid warfare”.
The Baltic Sea has seen its own run of incidents. Earlier this month, a Russian warship fired two flares towards a Danish military helicopter in international waters, one of them passing at close range, Bloomberg reported.
On September 24, Finnish and Swedish fighter jets jointly intercepted a group of Russian military aircraft, including a transport plane and several fighter jets, in international airspace over the Gulf of Finland, Reuters reported. It was the first such joint operation by the two countries, which joined Nato after Russia’s full-scale invasion of Ukraine in 2022. “The Baltic Sea has never been as vulnerable as it is now – but it has also never been better protected than it is right now,” Swedish Prime Minister Ulf Kristersson wrote on X. The Russian embassies in Stockholm and Helsinki did not immediately respond to requests for comment.
Moscow has repeatedly denied planning any attack on Europe. Its embassy in Copenhagen told Bloomberg there was no credible evidence linking Russia to the Leipzig drone incident, called attempts to blame it for the helicopter encounter “biased”, and said the West was responsible for Europe’s deteriorating security.
Also read: Russia’s grey-zone attacks on Europe are growing more brazen | The Economist
Why is the word ‘hybrid’ controversial?
A consequential argument in Europe right now concerns how to describe what is happening.
Officials commonly reach for terms like “hybrid attacks”, “provocations” or “sub-threshold” actions. ISW argued that this vocabulary can unintentionally soften how serious the attacks appear, and can make them sound disconnected from one another when they may not be.
Describing an incident as “sub-Article 5,” the think-tank said, shapes expectations of whether Nato ought to respond collectively at all, and labelling a kinetic attack “hybrid” can obscure the possibility that it is part of a broader Russian military effort.
Some officials have started using sharper language. Polish foreign minister Radoslaw Sikorski said Russian actions against Europe had “turned kinetic”. Lithuanian foreign minister Kestutis Budrys said the attacks were “no longer hybrid; they are very kinetic”. European Commission president Ursula von der Leyen said the Leipzig/Halle incident was “an attack using military-grade material carried out by Russian operatives on European Union soil”.
The label a government chooses can influence how large it judges the threat to be, and what response it considers appropriate.
What does Russia gain from this approach?
ISW assessed that Russia’s campaign serves several overlapping goals: disrupting European support for Ukraine, intimidating governments, gathering intelligence on Nato’s defences, testing how European states respond, and gradually normalising incidents that might once have triggered a much stronger reaction. The think-tank also argued that these operations can deepen political divisions inside Europe, signal to domestic Russian audiences that Moscow can strike Nato territory, and lay the groundwork for possible future conventional operations.
Ukraine is central to Europe’s wider security calculus here. European governments have armed and funded Ukraine’s war effort while Nato has stayed out of direct combat.
That leaves a hard question unanswered: how should Europe respond if Russia targets countries that back Ukraine, without letting every incident escalate into direct Russia-Nato confrontation?
Also read: ‘No hard feelings’: US downplays India’s warning over Russia Sanctions Act
Why does Nato’s Article 5 matter here?
Article 5 of the North Atlantic Treaty holds that an armed attack on one or more members is treated as an attack on all of them, with each ally committing to help by whatever action it judges necessary.
ISW warned that Russia could try to exploit uncertainty over how Nato would respond to a limited strike. For instance, drones, missiles or a small-scale ground incursion against a member state could be framed as accidental or too minor to justify a unified response.
Tusk made a similar point in a September 17 speech, warning that a Russian strike could be presented as an accident specifically to weaken Nato members’ appetite for invoking collective defence. The worry extends beyond the physical damage any single incident causes, to whether a string of such incidents can erode clarity over where the threshold for a joint response actually lies.
Denmark’s military intelligence service has since set out what such an attack could look like. In a threat assessment published on September 24, the Danish Defence Intelligence Service warned of a growing risk that Russia could launch a limited attack on “one or several Nato countries bordering Russia”, and said Moscow was expected to intensify its hybrid warfare against the alliance, Bloomberg reported.
Such an attack could involve long-range strikes on infrastructure critical to supporting Ukraine, false-flag operations using Ukrainian-made drones, or small numbers of Russian troops sent into neighbouring Nato states, possibly without national insignia.
“It is more serious now than at any other point since the end of the Cold War,” Danish defence minister Jeppe Bruus said.
The Danish agency, nonetheless, rates the risk of a limited attack as “low” and sees “no indications” that Moscow is preparing an outright invasion of a Nato member, though it said such an invasion “cannot be ruled out”. Estonia’s defence ministry, commenting on X, said the Danish warning largely echoed its own view and did not warrant raising its armed forces’ readiness.
What is ‘shadow fleet’, and why does it matter?
Russia’s shadow fleet, a network of vessels allegedly used to transport oil and dodge sanctions, has become a parallel front in this debate.
An analysis by the EU Institute for Security Studies (EUISS) found that European pressure on the fleet, through sanctions, intelligence-sharing and maritime operations, has pushed Russia toward more direct protection of its vessels. According to the analysis, Russia increasingly began registering shadow-fleet vessels under its own flag in 2026, with signs of militarisation, including reports of weapons mounted on vessels and Russian warships accompanying some tankers.
EUISS also linked shadow-fleet vessels to earlier undersea cable-cutting incidents and drone sightings, as part of the wider European assessment of Russia’s maritime activity. Its conclusion was that the fleet serves Russia both as an economic workaround and as a component of the broader security challenge it poses to Europe.
Is Europe preparing for war?
The governments are on alert but intelligence assessments stop short of predicting war.
The European Parliament has called for more intelligence-sharing among EU members, better coordination on early detection of hybrid threats, closer EU-Nato cooperation, and a new cross-cutting EU action plan on hybrid warfare.
Nato’s assessment remains more measured. The alliance does not see an imminent threat of attack, but warns against complacency.
For European governments, the danger is that Russia can impose costs, gather intelligence and test political and military responses without ever crossing the obvious line into declared war. For Nato, the task is to hold deterrence and alliance unity together while deciding how, and whether, to respond to incidents that may be deliberately designed to stay ambiguous.
The European Parliament calls Russia the most serious hybrid threat facing the EU, while also naming Belarus, China, Iran and North Korea as other actors running hybrid campaigns. ISW argued that European governments need a shared framework for reading Russian activity, one that separates an ongoing kinetic campaign from the distinct question of a future conventional attack. It laid out three tasks facing Nato and European states: responding to attacks already under way, preparing for a possible limited conventional strike, and adapting military capabilities based on lessons from the war in Ukraine.
