Europe Struggles to Counter Russia's Escalating Hybrid Warfare Campaign

Russia's suspected sabotage campaign across Europe appears to be gathering pace, confronting governments with a problem they have struggled to solve since the start of the war in Ukraine: how to impose a meaningful cost on Moscow for attacks that remain deliberately below the threshold of conventional war.

Over the past month alone, an explosives-laden drone was discovered next to a Ukrainian cargo plane at Germany's Leipzig airport. Poland has faced suspected acts of sabotage, and a string of unexplained explosions and fires have hit defence facilities supplying Ukraine across Europe. These incidents have prompted European capitals to move faster in imposing costs on Moscow for its increasing attacks, which are linked to its opposition to Western support for Ukraine.

The challenge for European leaders is that these hybrid actions do not constitute an open military attack, making direct retaliation under Article 5 of NATO difficult. Instead, governments are exploring a range of diplomatic, economic, and covert measures to signal that such tactics carry consequences, while avoiding a direct escalation with a nuclear-armed adversary. The pattern has forced a rethink of European security assumptions and is straining alliances as member states seek a unified approach.

Why This Matters

Escalating risk to civilian infrastructure: The discovery of a drone bomb at a major airport underscores that hybrid attacks increasingly target transport hubs and defence supply chains, endangering ordinary Europeans.
Undermining NATO's deterrence: Russia's below-threshold operations test the alliance's collective defence commitment, exposing gaps in how Europe defines and responds to non-military aggression.
Threat to Ukraine's supply lines: Fires and explosions at facilities that equip Ukraine directly jeopardise Kyiv's ability to sustain its defence, translating into battlefield consequences.

Background

Since the 2014 annexation of Crimea, Russia has employed a mix of cyberattacks, disinformation, election interference, and sabotage to pressure European states without triggering a conventional military response. The full-scale invasion of Ukraine in 2022 deepened this tactic, with intelligence agencies in multiple European countries accusing Moscow of orchestrating arson, bomb scares, and other disruptive acts. The latest wave — including the Leipzig incident and the Polish sabotage — signals an intensification of this campaign as Western military aid to Ukraine continues. Europe has struggled to establish a coherent counter-strategy, partly because hybrid attacks often lack clear fingerprints or are carried out by cutouts, complicating retaliation.

Key Perspectives

European Governments: Seeking to impose costs through sanctions, the expulsion of Russian diplomats, and enhanced intelligence-sharing, while avoiding a direct military confrontation that could escalate to open conflict. They are under domestic pressure to ensure public safety but are limited by legal frameworks designed for peacetime. Russia: Denies involvement in the reported incidents, framing them as baseless accusations or the work of third parties. Its strategic aim is believed to be deterring and weakening European support for Ukraine by raising the political and economic costs of continued aid. Ukraine: Has documented the attacks as part of Russia's broader war effort and calls for a more robust Western response, including stricter sanctions and military countermeasures against Russian assets. Critics and Security Analysts: Argue that current European responses remain too timid — sanctions and expulsions have not deterred Moscow, and the lack of a credible retaliatory mechanism invites further hybrid operations.

What to Watch

Frequency and scope of incidents: An uptick in attacks targeting critical infrastructure such as power grids, transport hubs, or munition factories would signal an escalation.
NATO's formal response: Whether the alliance classifies any future hybrid attack as triggering Article 5, or develops a new hybrid-deterrence framework, will shape European security posture.
European policy shifts: New legislation or cross-border task forces aimed at hardening defences and enabling faster attribution — such as Germany's recent steps to tighten security at logistics hubs — could become models for collective action.

ZOTPAPER