Russia’s Hybrid Campaign Against Europe Is Growing

This week, leaders in Poland, France, Lithuania and Finland warned publicly that Russian pressure on Europe is growing. The coordinated timing raised a fair question: what do governments know that the rest of us don’t?

The intelligence behind the latest warnings hasn’t been published. But the hybrid campaign itself is documented in court filings, government attributions and independent counts. A conventional attack on NATO is a far less likely scenario, and officials in Finland, Romania and Latvia say they see no sign of one. The hybrid campaign, by contrast, is already under way.

What was said this week

On 17 September, Polish Prime Minister Donald Tusk told parliament that intelligence services expect Russia to attempt hybrid drone or missile strikes on countries supporting Ukraine, Poland included. They would be presented as accidents, so that NATO hesitates to invoke Article 5, its clause treating an attack on one member as an attack on all. Tusk called this the most probable scenario for the coming months and said it drew on NATO, Ukrainian and US intelligence, including the CIA.

Others followed. Lithuania’s foreign minister said his country holds the same intelligence. Emmanuel Macron said the Russian hybrid threat had intensified in recent weeks and ordered a plan to protect critical infrastructure. Finland’s president, Alexander Stubb, told citizens to prepare mentally for sabotage and drone incidents, while adding there is no reason to panic.

No new evidence was disclosed, and withholding raw intelligence is normal. The warnings are also older than this week. Lithuania raised security at energy sites in June, the Daily Telegraph reported possible provocations in early July, and Lithuania’s president confirmed intelligence of that kind in mid-July.

Why warn in public

Lithuania’s foreign minister called the statements “part of a coordinated campaign” telling Russia not to bet that a limited provocation would stay below the Article 5 threshold. Deterrence only works if the other side knows you have noticed, and announcing a scenario in advance makes it harder to pass off as an accident.

Media have compared this to the run-up to 2022, when Washington also went public. But that warning concerned a full invasion. Now the officials describe limited, deniable acts, and the reporting on the CIA director’s August trip to Moscow rests on anonymous sources that Trump disputes.

A hybrid campaign in plain sight

Hybrid attacks are designed to hurt without triggering a war: arson, sabotage, cyberattacks, GPS jamming, drone incursions and assassination plots. Germany’s interior minister said on 1 September: “We are not at war, but we are a daily target of hybrid attacks.” A US Congressional Research Service report counts at least 151 reported Russian operations in Europe between February 2022 and March 2026. It cites a study finding attacks quadrupled from 2023 to 2024, and describes Russian military intelligence as the most aggressive agency involved.

The method is built for deniability. A 2025 GLOBSEC study identified 131 individuals involved in Russian-linked incidents in Europe, at least 35 with prior criminal involvement. In the Leipzig case, German officials said the device showed high technical skill but was left to low-level agents.

Recent cases show the range:

On 4 August, a drone with explosives was found near a Ukrainian cargo plane at Leipzig airport. Germany blamed Russia on 1 September and closed a Russian consulate. Moscow called the accusation absurd.
On 15 September, US prosecutors charged five people over an alleged Russian intelligence-linked network planning assassinations and terror attacks. All remain at large.
In May, a Russian drone hit an apartment block in Galați, Romania, during an attack on Ukraine, injuring a woman and a child.
On 13 September, a Russian drone destroyed a locomotive about two kilometres from Poland’s border, on the Ukrainian side. Moscow says it targets rail links carrying Western military supplies.

Attribution is not always possible. An attack on a power line in Brandenburg, reported on 1 September, is unattributed. Authorities say a foreign power or left-wing activists can’t be ruled out. Nor is every drone hostile: Finland’s president says four have come down this year, and earlier incidents there were tied to stray Ukrainian drones.

One analyst quoted by Euronews notes that acts below the threshold of open war have gone on for years, with limited strategic effect. The next rung is the “accidental” strike on NATO soil that Tusk described. It is a forecast that officials take seriously, not an established plan.

What to watch

Signs of escalation in the hybrid campaign:

A drone or missile killing people or causing serious damage on NATO soil, or repeated incursions in a short window rather than isolated debris.
Arson, rail or power-line sabotage in several countries within days, and arrests of paid local recruits.
Undersea cable damage, drone-related airport closures, or widespread GPS interference.
Governments formally naming Russia and expelling diplomats, as Germany did, which shows how confident investigators are.

Signs of a larger step, which remain less likely:

Forces massing near the Suwałki Gap, the narrow corridor between Belarus and Kaliningrad that links Poland and the Baltic states.
A formal Russian mobilisation order. Bloomberg reported on 18 September that officials fear one after the Duma elections, and the Kremlin denies any plan.

Real movement towards a ceasefire in Ukraine, or weeks without new incidents, would ease concern.

The campaign’s aim, in Macron’s words, is to intimidate Europeans and weaken support for Ukraine. Governments are not revealing a secret invasion plan. They are publicising a scenario they can’t fully prove, hoping that saying it aloud makes it fail. For most readers in Central Europe, the practical effects are more likely to be disruptions, such as airport closures, cyber incidents or GPS interference, than physical danger.

Key Takeaways

The warnings of 17–18 September are not new, but the coordination is unusual, and it points to intelligence that governments have not disclosed.
The hybrid campaign is documented: at least 151 reported Russian operations through March 2026, including Leipzig airport and a US indictment.
It relies on deniability, using paid, often low-level recruits, so attribution can be slow or impossible, and not every stray drone is an attack.
Lithuania’s foreign minister called the public messaging deliberate deterrence. Several eastern-flank governments see no sign of a conventional attack.
Watch for deadly incidents on NATO soil, sabotage clusters across countries, and formal government attributions.

Selected sources

Photo: Kris Møklebust via Pexels