Through drones that intrude into the airspace of NATO member countries and fly over civilian airports or military sites, through cyberattacks aimed at critical infrastructure, or through sabotage of key logistical corridors, Russia blurs the boundary between war and peace.
- Most European countries, except those in the eastern part of the continent near Russian borders, reject the term “hybrid war” and instead place Russia’s activities on the continent within a “gray zone”.1
- At the beginning of August, following the discovery of a drone laden with explosives on the tarmac at Leipzig airport, Germany’s Interior Minister, Alexander Dobrindt, declared that Germany was “daily the target of a hybrid war”, without naming any country in particular.
The International Institute for Strategic Studies (IISS) estimates that Russian sabotage operations in Europe “have almost quadrupled” between 2023 and 2024. Moreover, between June and October 2025, we recorded at least forty drone-related incidents—seen, crashed, or shot down—in Europe.
- Russia frequently relies on “disposable” agents to conduct sabotage, espionage, deception, or other attacks outside its national territory.
- Between 2022 and February 2026, ICCT and GLOBSEC logged 151 “incidents” involving these civilians recruited by Russian intelligence services, who are entrusted with missions by Moscow via encrypted messaging2.
- The Kremlin relies in particular on existing criminal networks, which act as intermediaries with local recruits—recruits who generally remain unaware that they are serving Moscow’s interests.
In recent months, the defense industries have become prime targets.
- On August 15, a building belonging to Milrem Robotics, an Estonian company based in Tallinn that supplies land robots and military systems to Ukraine, was set on fire.
- Earlier in August, explosions occurred at an ammunition factory on the outskirts of Rome as well as at a Bulgarian plant that manufactured artillery shells and rockets for Ukraine3.
- The sponsors of these attacks have not yet been identified. According to intelligence sources, these operations appear to be “carefully calculated to avoid triggering Article 5” of the NATO Treaty and to stay below the threshold of what would traditionally be considered an “attack.”
Russian interference activities in Europe are also multiplying as several key national and regional elections are due to take place in several countries over the coming months.
- Several German Länder will renew their legislatures starting in September, beginning with Saxony-Anhalt.
- In France, at least three declared or potential presidential candidates—Édouard Philippe, Raphaël Glucksmann, and Gabriel Attal—have been targeted by disinformation campaigns, the attribution of which remains disputed.