A drone sighting at Leipzig airport has sparked unease across the European Union, and with it a clear and growing fear: Russian hybrid warfare attacks are intensifying across the Union. Hybrid warfare is the use of a combination of military and non-military tools designed to weaken an adversary without triggering a conventional armed conflict. [1] It can include cyberattacks, disinformation campaigns, sabotage, economic pressure, irregular tactics, and psychological operations conducted through both traditional and social media. A defining feature of hybrid warfare is the challenge of attribution. While governments may suspect the involvement of a foreign actor, proving direct responsibility is often difficult. [1] Operations are frequently conducted through proxies, criminal networks or anonymous cyber actors, creating ambiguity around who ordered or carried out an attack.[1] This uncertainty can delay political responses and complicate international coordination. For many analysts, this ambiguity is not a weakness of hybrid warfare but one of its principal strengths.
Hybrid warfare has become an increasingly attractive tool for states because it allows them to exert pressure on adversaries without crossing the threshold of conventional war. Cyberattacks, disinformation campaigns, and acts of sabotage are generally cheaper and less politically risky than military intervention. They can create uncertainty, undermine public trust and disrupt critical systems while making it difficult for targeted governments to justify a military response. As a result, hybrid tactics enable states to challenge opponents while limiting the risk of direct escalation.
While it is often discussed in terms of national security, the effects are also felt by ordinary citizens. Cyberattacks can expose personal data, disrupt essential services, and undermine confidence in public institutions. Disinformation campaigns seek to influence public opinion and deepen political polarization, while attacks on transport, communications or energy infrastructure can affect everyday life.[2] The cumulative objective is not necessarily to cause immediate physical damage, but to weaken societal resilience and erode trust in democratic systems.[2]
Russia’s invasion of Ukraine in 2022 was the culmination of the campaign of hybrid pressure the country had faced since its independence in 1991.[3] For Ukraine, hybrid warfare was not a precursor to war but an integral part of the conflict itself. Long before the 2022 invasion, Kyiv faced cyberattacks, disinformation campaigns, political interference, and support for separatist movements, particularly following Russia’s annexation of Crimea and intervention in Donbas in 2014. The war also marked a turning point for the rest of the continent. Russian hybrid attacks increased across Europe, aimed at intimidating and testing the Union and the NATO allies supporting Ukraine.[3]
On September 18th, French President Emmanuel Macron called an emergency meeting on the heightened security threats facing the nation, including clear interference in the presidential campaigns since the start of summer.[2] He warned that Russian interference and hybrid methods against France have intensified over that period.
Politico Paris Playbook journalists explain that France is targeted because of the powerful position it holds in both the European Union and NATO. The elections in spring 2027 also offer the Kremlin an opportunity to shift the balance and attempt to place a more favourable candidate. Meanwhile, cyberattacks on key French infrastructure, including Finances Publiques and many commercial banks, occurred throughout the summer and leaked critical personal data of many citizens. This is part of a longer trend. In their book, Laura Kayali and Marion Solletty argue that Russian hybrid attacks in France have grown exponentially since 2016.[2] Examples include the Stars of David in 2023 and the pigs’ heads in 2025. Such events aim to parasitize public debate: they paralyze politicians and keep them from discussing more pressing issues, such as support for Ukraine.[2] These operations do not seek physical destruction alone. Their purpose is often psychological, aiming to sow distrust, polarize society, and force governments to divert political and security resources.
France is not alone. Attacks in Germany, the Netherlands, and Estonia, among others, have intensified throughout the summer. Journalists in a roundtable interview for Arte on Monday, September 21st, argued that the Kremlin’s goal is clear: to weaken its enemies before turning to conventional warfare. This remains speculative, however, as no hard evidence has shown that the Kremlin intends to wage conventional war across continental Europe.
Europe’s response
European leaders have nonetheless been working to counter, prevent, and protect against these attacks by securing critical infrastructure, understood here as infrastructure critical to war efforts. Since 2008,the European Commission has progressively developed a framework aimed at strengthening the resilience of critical infrastructure. In 2023 it passed the Critical Entities Resilience (CER) Directive, which member states had until 2024 to adopt nationally.[4]
The directive came with enhanced cooperation with NATO, including the creation of the EU-NATO Task Force, which provides assessments of critical points across allied states’ borders.[4] Allies have stepped up exercises on moving assets swiftly across the continent. These include exercises in the Baltic Sea testing the use of civilian airport infrastructure, tabletop exercises among NATO allies testing railway mobility, and the use of a civilian commercial ferry to mobilize British troops to continental Europe.[5]
While these initiatives demonstrate growing awareness of hybrid threats, critics argue that European responses remain fragmented. Hybrid attacks often exploit legal and institutional grey zones, making rapid attribution and coordinated retaliation difficult.
A new proposal, and concerns
This renewed tension raises questions about the ability of Europe and NATO allies to respond effectively to increasingly unpredictable hybrid attacks.
Ursula Von der Leyen, in her State of the Union speech, proposed the creation of a European Security Council as a response to Washington’s uncertain leadership of NATO.[7] This council would be composed of EU Member States and partners including Canada, the UK, Norway and Ukraine, and would be mandated to discuss security and defense issues. Alongside, she proposed the creation of an Emergency Security Protocol that could be triggered by EU capitals if they felt threatened by actions below the level of invasion. Its principal goal is to coordinate response “to deter further escalation and mitigate the impact” of such attacks.[7]
On Monday, September 28th, European defense ministers are meeting to discuss a European Commission proposal for a new Emergency Security Protocol.[6] Countries hit by hybrid attacks could trigger it to coordinate effective responses. It would resemble NATO’s Article 4 and be triggered in the same way, when an ally feels its “security is being threatened”. European diplomats worry, however, that the protocol could compete with NATO’s, creating overlapping responses that are delayed by competing mandates.
In the face of Moscow’s clear escalation of its hybrid campaign against NATO allies — its use of bombs, arson, and other potentially fatal methods — have prompted some European countries to argue that “hybrid” warfare might no longer be an adequate way of qualifying the assaults.[6] Although many European governments attribute these incidents to Russian actors, attribution remains one of the central challenges of hybrid warfare. The ambiguity surrounding responsibility is often viewed as one of the strategy’s principal strengths.
Whether these attacks continue to be described as “hybrid” or evolve into something more overt, European governments increasingly view them as a long-term security challenge. The debate is therefore no longer limited to how to respond to individual incidents, but how to build resilience against a strategy designed to exploit political, technological, and societal vulnerabilities. The effectiveness of Europe’s response may ultimately depend on its ability to coordinate rapidly, attribute responsibility with confidence and maintain political unity in the face of persistent pressure.
Edited by Maria Antonietta Fiocchi.
References
[1] Sustainable Development Policy Institute. (2020, June 1). Hybrid warfare. JSTOR. http://www.jstor.org/stable/resrep29111.7
[2] Spotify. (2026, September 22) [Playbook Paris Podcast] [Plongée dans la guerre hybride par la Russie]. https://open.spotify.com/episode/3Si5IhQ4VGAl1WUd2C8uPC
[3] Spotify. (2026, September 5) [Les Dessous des Cartes] [Russie-UE: la guerre hybride est déclarée]. https://open.spotify.com/episode/28uOKIKAQs75Xu7dsFUB7f
[4] European Commission, Directorate-General for Migration and Home Affairs. (2026, January 13). Critical infrastructure resilience at EU level. https://home-affairs.ec.europa.eu/policies/internal-security/counter-terrorism-and-radicalisation/protection/critical-infrastructure-resilience-eu-level_en
[5]
a. NRDC-ITA Public Affairs Office. (2026, June 26). Eagle Enablement 26: Enhanced logistics planning and readiness for the Allied Reaction Force. NATO Rapid Deployable Corps Italy. https://nrdc-ita.nato.int/newsroom/news-archive/2026/eagle-enablement-26-enhanced-logistics-planning-and-readiness-for-the-allied-reaction-force
b. Allied Air Command. (2026, May 14). Airpower underpins Swedish-led exercise AURORA 26. NATO. https://ac.nato.int/archive/2026/airpower-underpins-swedishled-exercise-aurora-26-
c. BBC News. (2026, April 22). [Soldiers take North Sea ferry to Nato exercise]. https://www.bbc.com/news/articles/cvgk9dwkyqwo
[6] Financial Times. (2026, September). EU countries consider NATO-style joint responses to Russian hybrid attacks. https://www.ft.com/content/5513b441-a575-4c73-8532-cb09216c4406
[7] Financial Times. (2026, September 17). Von der Leyen advances EU defence pitch with army of new ideas. https://www.ft.com/content/5d1dba1a-db81-464d-b2d0-9e0741010560
[Cover picture]: General Staff of the Armed Forces of Ukraine. (2026, August 5). Drone operators of the 22nd Mechanized Brigade in the sunset [Photograph]. Wikimedia Commons. https://commons.wikimedia.org/wiki/File:Drone_group_22nd_ombr.jpg
0 Comments
No comments yet. You can start the conversation below.