Russia’s Escalating Hybrid Attacks Put Europeans in a Bind

Russia is expanding its campaign of hybrid attacks against countries that supply weapons and money to Kyiv and has caught Europe without a plan to respond.

From cyber attacks to armed drones and mysterious cases of arson, tensions are rising across the continent as the war in Ukraine is set to enter its fifth winter. Just this month, Poland said it thwarted an attempted assassination of a US citizen originally from Ukraine that was ordered by Russia while Estonia accused Moscow of being behind a fire at a drone maker.

Meanwhile, German Chancellor Friedrich Merz said on Tuesday that those responsible for hybrid attacks “will pay the price” after an explosive-laden drone was discovered at an airport in Leipzig near a Ukrainian cargo plane, raising speculation that Moscow was involved in attempted strike.

Milrem Robotics’ drone vehicles awaiting shipment at the startup’s facility in Tallinn, Estonia in 2025; Photo credit: Peter Kollanyi/Bloomberg

Amid an uptick in sabotage efforts, CIA Director John Ratcliffe traveled to Russia for meetings on Tuesday, according to people familiar with the matter. It was unclear what the talks were about. The Central Intelligence Agency declined to comment.

European officials have been anticipating for months that Russia may escalate its aggressive campaign against the continent. But the bloc has yet to change its fundamentally defensive posture, according to people familiar with how the institutions gauge outside threats, who spoke on condition of anonymity.

That has likely encouraged Moscow to probe how far it can go in trying to intimidate and wear down western allies as itremains locked in a war of attrition with Ukraine.

“NATO, European and national responses have largely been reactive and defensive,” said Agnia Grigas, a non-resident fellow at the Atlantic Council in Vilnius. “They have focused on detecting and countering individual provocations, but have not built a record of effective deterrence by consistently dissuading Moscow from continuing or escalating them.”

That lack of preparedness comes as Europe has taken on the primary role in supporting the Ukraine with the US shifting away from the continent. While NATO’s mutual defense clause commits members state to help each other in case of an attack, Russia’s alleged actions have so far fallen short of what would become a trigger for such a response.

Moscow has increasingly relied on recruitment via social media to carry out arson or other sabotage attacks, after large scale expulsions of its diplomats following the invasion of Ukraine.

Two Ukrainian nationals were handed prison sentences in the UK in June, after a jury found them guilty of conspiring to commit arson attacks on a car and property linked to then-Prime Minister Keir Starmer. The prosecution said during the trial that one of the perpetrators was recruited online by a Russian-speaking Telegram user.

Lithuanian Prosecutor General Nida Grunskiene said last week that the drone attack in Germany has “links” to an ongoing investigation into an attempt to detonate a parcel on a DHL cargo plane in 2024. Lithuania has charged five in the attempted sabotage, allegedly hired by Russia’s military intelligence.

While Germany hasn’t singled out Russia as being behind the armed drone, or the recent discovery of a cache of weapons on the outskirts of Berlin, a slew of investigative media reports have pointed the finger at Moscow. It also added to fresh warnings that Europe’s biggest economy must grapple with the new dimensions of asymmetrical risks.

There are indications that Russian intelligence and security services are looking at hybrid warfare operations against the Baltic States and Poland, an intelligence official told Bloomberg earlier this month. Lithuanian Defense Minister Robertas Kaunas said Moscow is weighing a potential false flag operation using captured Ukrainian drones to strike critical infrastructure in the Baltic region.

“Russia’s ongoing hybrid warfare in Europe is a highly coordinated, sub-threshold campaign aimed at destabilizing Western political systems, fracturing NATO and EU unity, and eroding support for Ukraine,” said Alex Kokcharov, geoeconomics analyst at Bloomberg Economics in London. “To achieve these goals, the Kremlin maintains plausible deniability by exploiting anonymity and utilizing proxies to obfuscate direct state attribution.”

Some European Union members have called on the bloc to respond by adopting the sanctions that have been blocked including seizing assets, a ban on transporting Russian liquefied natural gas and restricting visas, according to people familiar with the matter. The EU is preparing another package of sanctions on hundreds of individuals and entities, which it aims to adopt in the fall, they said speaking on condition of anonymity.

But as previous such measures have failed to restrain Moscow, it’s unlikely they will do now.

“Russia is willing to use kinetic means because until now they have been unsuccessful in discouraging support for Ukraine,” said Marek Kohv, head of the Security and Resilience program at the Tallinn-based International Centre for Defense and Security. “It is directly connected to how Russia is doing on the front line.”

NATO members have pledged $80 billion in military aid to Ukraine for 2026 and “at least the equivalent levels” in 2027 at the alliance’s July summit in Ankara. The money is overwhelmingly coming from Europe.

UK Prime Minister Andy Burnham handed over cruise missile blueprints to Kyiv in a visit on Monday. He also compared Ukraine’s fight to Britain’s resistance to the Nazis in World War II, drawing a response from the Kremlin’s spokesman Dmitry Peskov.

He accused the UK of “methodically and regularly adding fuel to the fire” and “methodically and regularly plotting to prevent any progress in the peace process” in his remarks to reporters on Monday.

Russia has also warned that the UK would face “consequences for which it will have to answer” after reports that Kyiv used drones made by British companies to carry out strikes inside Russian territory.

This month Estonian authorities said they were investigating Russian involvement in a fire at Milrem Robotics, a drone manufacturer that supplies Ukraine. A Latvian charity for Ukraine said its warehouse was the subject of an arson attack last month.

“Russia is clearly seeking to escalate the situation — not through direct military escalation, but perhaps by influencing western countries, particularly those supporting Ukraine,” Finnish Prime Minister Petteri Orpo said in Helsinki on Monday. “But it is not working. In fact, it is having the opposite effect.”

Top photograph: Volodymyr Zelenskyy and Andy Burnham during a meeting in Kyiv on Aug. 25, 2026; photo credit: Andrew Kravchenko/Bloomberg

Related: