This week Germany accused Russia of involvement in a drone attack on Leipzig-Halle Airport, marking a new low in relations between the two countries since Moscow’s full-scale invasion of Ukraine.
The charge, which Russia denies, casts a spotlight once again on the notion of an escalating ‘hybrid’ war being waged by Russia against EU countries supporting Ukraine.
Is this a genuine threat, and if so, what has been Europe’s response?
Russia’s alleged hybrid warfare directed at Europe reached an inflection point this week when Germany formally accused Moscow of an attempted drone attack on Leipzig-Halle Airport on 4 August.
“The means used,” German Interior Minister Alexander Dobrindt declared on Tuesday, “such as the drone configuration, components, explosives and detonation systems, are known to us from other hybrid operations by Russia and its war against Ukraine”.
There were three drones in all: one, filled with military grade explosives, was discovered by an alert bus driver next to a Ukrainian cargo plane; a second collided with a cargo plane in flight; and a third with traces of explosives was found in a nearby field.
Germany immediately shut down the Russian consulate in Bonn and a Russian cultural centre in Berlin.
Russian President Vladimir Putin accused the German Chancellor Friedrich Merz of trying to distract voters ahead of this weekend’s key regional vote in Saxony-Anhalt (in which the Russia-sympathetic AfD party is expected to triumph).
Kremlin spokesperson Dmitry Peskov told reporters no evidence was produced and accused Berlin of “proceeding down a path of further escalation”.
However, on Wednesday, German media reported that police had identified two suspects through traces of DNA, including a Belarussian national who holds a Russian passport and a joint Russian-Latvian national.
What exactly is hybrid warfare?
The very nature of the alleged attacks, as well as the response from both the German authorities and the Kremlin, exquisitely reflect the essence of hybrid warfare: small-scale attacks designed to sow division, keep European countries off balance and provide Russia with deniability.
While hybrid attacks have been ongoing since Russia’s invasion of Ukraine in 2022, they appear to have reached a crescendo precisely when Mr Putin, having failed to achieve a breakthrough on the battlefield, and facing growing listlessness among the Russian population and elites, is thought to be considering some kind of escalation to break the impasse.
“We will escalate our methods to destroy everything that helps Ukraine’s military coming from the West,” foreign minister Sergei Lavrov admitted recently.
“In fact, we are already doing it.”
What made the Leipzig attacks so significant is that, in contrast to multiple drone sightings around Germany’s eastern flank last year, the custom-built quadcopter drone had 600g of explosives on board which the authorities could take apart and analyse.
Whether Mr Putin wants to risk directly attacking NATO countries – even in a hybrid fashion through drone attacks and sabotage – is the question.
Whatever the answer, Europe is struggling to piece together a coherent response, most likely the Kremlin’s aim.
At an informal meeting of EU foreign ministers in Druid’s Glen in Co Wicklow on Wednesday, the EU’s foreign policy chief Kaja Kallas described the Leipzig attacks as having “all the hallmarks of state-sponsored terrorism”.
She added: “The question is, what do we do about this? We have already summoned the Russian ambassador.”
Even when Berlin formally accused Russia of responsibility for the Leipzig attacks, the anticipated response was not as robust as had been expected.
Chancellor Merz had signalled the declaration in advance, but remained silent on the day itself, leaving it to his interior and foreign ministers on the basis that a tougher response would be kept in reserve in case Russia attacked again.
“This is also an expression of the appropriateness of our reaction, ” foreign minister Johann Wadepuhl explained.
“Germany can show a stronger reaction at any time.”
What has Germany’s response been?
In the wake of the Leipzig incidents, Minister Dobrindt doubled the number of specialist anti-drone police to 300, expanding their operating locations and adding a new drone research centre at Magdeburg-Cochsted Airport.
Two weeks ago, Berlin introduced legislation for a fundamental and wide-ranging reform of the federal foreign and military intelligence service, the BND, with the specific aim of combatting hybrid warfare.
The instinct is for more and tougher sanctions.
Minister Wadepuhl announced that Germany would push for further EU measures and travel restrictions against Russian nationals and increase pressure on Russia’s so-called shadow fleet of oil tankers, long suspected of being seaborne launchpads for drones.
However, officials suggest that, with 21 sanctions packages already in place, the EU is running out of low-hanging fruit, and that upping the ante will start to cut across national interests.
It is understood that getting the 21st package over the line in July was particularly difficult, with objections from Athens over measures against Greek vessels that ship Russian LNG, while Austria demanded that the Vienna-headquartered Raiffeisen Bank International (RBI) be allowed to access sanctioned assets linked to its Russian subsidiary to compensate for fines imposed on it by Moscow.
“There’s a certain reflection going on in Brussels about whether it is really smart to continue doing this,” says one EU diplomat.
“It’s getting more and more difficult and divisive. They are meant to be about holding Russia to account and eliminating its ability to wage war against Ukraine, when actually it’s dividing us.”
That said, there is every expectation that the EU will go for a 22nd package.
Have hybrid attacks been on the increase?
Hybrid incidents have been intensifying.
On 26 August, Romanian F16 jets destroyed an explosive-laden drone loitering a few hundred metres from Netpun Deep, Europe’s largest natural gas platform which is inside Romanian territorial waters.
It was the fourth allegedly Russian drone shot down over Romania this year.
Elsewhere, officials have reported numerous clandestine attacks against countries supporting Ukraine.
On 16 November last, the Warsaw to Lublin train line used to transport equipment to Kyiv was damaged in an explosion which the Polish authorities blamed on two Ukrainian men working for the Russian foreign security service (FSB).
Two months earlier, Lithuanian prosecutors said they had foiled a Russian plot to ship homemade incendiary devices through logistics companies, including DHL, with one device exploding in Leipzig and a second bursting into flames at a DHL hub in Birmingham.
There have been dozens of other alleged sabotage or drone-related incidents, according to intelligence services.
According to Carnegie Europe, an international think tank on foreign and security policy, there have been 151 instances of sabotage and shadow warfare either publicly attributed to Russia or suspected of being carried out by Russia or Russia-adjacent actors since 2022.
“Between 2023 and 2024, the number of such attacks quadrupled, and the tally for the following years continued on an upward curve. That is in addition to the daily informational warfare and intense political and election interference Europe is subjected to from various quarters,” says Carnegie’s Strategic Europe editor Rym Momtaz.
The Institute for International Institute for Strategic Studies (IISS) reported in July that between August 2024 and February 2026, suspected Russian drones were flown in the airspace of a dozen NATO member states and Ireland, “forcing the closure of aviation hubs including Brussels, Copenhagen, Munich, Oslo and Vilnius”.
The drones disrupted smaller regional airports across Denmark, Germany and the Baltic states and were seen over European naval facilities and air bases, including those hosting US nuclear weapons and a French ballistic missile submarine base.
The IISS described these incidents as a tactical success for the Kremlin and a strategic failure for Europe’s allied air defences.
The campaign, the report said, is aimed at “probing the response times and decision-making thresholds of allied air defence and civil-military command structures; mapping vulnerabilities around critical infrastructure, including dual-use civilian hubs, military logistics nodes supporting Ukraine, and facilities associated with allied nuclear deterrence; imposing economic and psychological costs on European societies through the disruption of civilian aviation and public confidence in airspace security”.
More broadly, hybrid (or shadow) warfare encompasses an inexpensive range of offensive methods designed to undermine and disorient an enemy that stops short of the threshold for open conflict.
These allegedly include electoral interference and social media campaigns designed to sow division, antagonism and apathy.
“Much like a hybrid vehicle, which seamlessly switches between gasoline and electricity without being noticed, hybrid warfare blends tools of statecraft and conflict,” said Eitvydas Bajarūnas, non-resident Senior Fellow at the Centre for European Policy Analysis (CEPA).
“Information manipulation campaigns segue into cyber attacks, which give way to political influence operations, economic pressure, or covert sabotage. The combination is designed to be adaptive, continuous, and hard to attribute, keeping the target off-balance.”
It is important to clarify that identifying the provenance of drones is difficult, and Moscow has repeatedly denied any involvement.
However, the IISS report concludes that “the aggregate pattern of [drone] sightings cannot be adequately explained by misidentification, hobbyist activity or opportunistic harassment alone”.
While the Danish authorities were not definitive about a series of drone incidents in September last year involving Copenhagen airport and a number of military bases, an earlier incident appeared more sinister.
Up to 20 large drones were seen flying in formation over the Køge port before disappearing into the bay at high speed.
The port had previously served as the main embarkation point for Denmark’s deployment to NATO’s Enhanced Forward Presence in eastern Europe.
How have sabotage operations worked?
According to UK counter-terrorism police, Russia has co-opted proxies in order to carry out attacks which again will provide another layer of deniability.
Last October, Dylan Earl, 24, and Jake Reeves, 21, were sentenced to a combined total of 29 years for an arson attack on a Ukrainian-owned business causing €1.16 million in damage in east London in March 2024.
Police found that both men had made contact via the Telegram messaging system with the Russian mercenary organisation, the Wagner Group, which paid them to carry out the attack and plan for others.
Commander Dominic Murphy, head of the Counter Terrorism Policing London, said: “This case is a clear example of an organisation linked to the Russian state using ‘proxies’ – in this case British men – to carry out very serious criminal activity in this country on their behalf.”
There are suspicions that numerous other sabotage operations across Europe have been carried out by local proxies, recruited through third parties.
How long has Russia been operating a hybrid warfare doctrine?
Experts are divided as to when Moscow embraced hybrid warfare.
In 2019, Nicole Ng, of Carnegie’s Russia and Eurasia Programme, and Eugene Rumer, a former US national intelligence officer, traced the concept back to 1996, when Yevgeny Primakov, the director of Russia’s foreign intelligence service, became foreign minister.
While in the years following the collapse of the Soviet Union Russia had sought accommodation with the West, Primakov put forward the argument that a unipolar world dominated by the United States was unacceptable to Russia.
“He envisioned a multipolar world managed by a concert of major powers, with Russia as an indispensable actor with a vote and veto on key issues.
“Securing Russia’s primacy in the post-Soviet space and opposing NATO enlargement were also crucial to Primakov’s vision.”
It was also in tune with Vladimir Putin’s instincts when the former Soviet intelligence officer in East Germany became president of the Russian Federation in January 2000.
At the Munich Security Conference in 2007, Mr Putin famously eviscerated the idea of a unipolar world saying it was not only unacceptable, but “impossible in today’s world”.
A year later Russia invaded Georgia.
In February 2013, Russia’s chief of staff General Valery Gerasimov published a 2,000-word article in an obscure military trade paper entitled, “The Value of Science Is in the Foresight”.
General Gerasimov blended Soviet tactics with a new theory of modern warfare, aimed at undermining an adversary’s society without having to launch a frontal attack.
“The very ‘rules of war’ have changed,” he wrote.
“The role of non-military means of achieving political and strategic goals has grown, and, in many cases, they have exceeded the power of force of weapons in their effectiveness.
“All this is supplemented by military means of a concealed character.”
One year later, Russia invaded and annexed Crimea, a hybrid operation of sorts since Mr Putin denied the existence of Russian troops on the peninsula, saying instead they were “little green men”, only admitting their presence when the operation had become a military success.
Senior intelligence officials are in no doubt that Russia has launched a hybrid war against Europe.
“We are in the middle of a hybrid war,” former vice-president of the German BND Ole Diehl told a German Council on Foreign Relations podcast.
“Russia has not declared this war, but Russia is leading this war against us.The Russians say so quite clearly, they openly declare that there is no difference between a conventional military war, and a hybrid war.
“Russia wants to destabilise our society, to stop our support for Ukraine, it wants to increase its influence not just in the former Soviet republics and Warsaw Pact countries, but also its influence on us, on Europe.
“This hybrid war requires that we think differently about what the Russians are doing and what we are doing in response.”
What is Europe doing in response?
The virtue of hybrid warfare, from a protagonist’s point of view, is that existing defence and deterrence systems are often inadequate or outdated.
Since hybrid warfare operates along a spectrum of guises – from drone attacks to sabotage to assassinations to flooding social media narratives with anti-Ukraine messaging and interfering in elections.
As a result, responding in a coherent manner can be highly challenging.
If the threats are deployed by the Kremlin in a coherent manner, then the response must also be coordinated, critics say.
In March this year, EU leaders agreed to advance Europe’s ability to counter hybrid threats.
They referred to a stack of legislation including the new Hybrid Toolbox, directives including those on Critical Entities Resilience (CER), the Cyber Diplomacy Toolbox, the Digital Services Act, the Foreign Information Manipulation and Interference (FIMI) framework, the European Democracy Shield, which Irish commissioner Michael McGrath is leading, as well as other strategies for the maritime, airspace, cyber and critical-infrastructure sectors, AI and quantum technologies.
“It is about organising [the response] around a clearer theory of how vulnerabilities interact in the same operating environment,”argue Raluca Csernatoni and Alicia Wanless of Carnegie Europe.
“What is missing is a strategic vision matched by an operational logic that can make sense of and connect infrastructural disruptions, technological dependencies, information manipulation, and practices of economic coercion as disturbances in the same wider ecosystem.”
Likewise, EU intelligence services are also hampered by uneven responses.
When a German BND officer receives intelligence about a potential sabotage operation he or she is restricted to sending a classified report to the Chancellery and other government departments.
By contrast, in France, agents are required to act on the spot.
“In the future, this will be the BND’s job,” said former BND vice-president Ole Diehl.
When it comes to drone attacks, argues the IISS report, “Europe’s… air-defence and civil-aviation radar infrastructure was designed for a different era and was focused on fast, high-altitude aircraft operating in known corridors, cooperating with aviation and surveillance systems that depended on electronic self-identification”.
By contrast, drones fly at low altitude without broadcasting their identity and position, often launched from vessels in international waters rather than crossing a land border.
As such, drone attacks can both test a country’s air defences and force it into scrambling highly expensive fighter jets or missile-based interceptor systems.
Last year the European Commission proposed a European Drone Defence Initiative (EDDI), which envisages a continent-wide, 360-degree counter-drone architecture, with initial operational capability by the end of this year.
The European Parliament has warned about the high costs of drone interception and the risk that by the time the system has been procured and tested it could be obsolete.
In the meantime, each member state has its own rules about who can shoot down drones (military or police) and in what circumstances.
Ireland’s response
Ireland is seen as particularly vulnerable both given the risk to poorly-defended undersea cables and the presence of some 30% of EU data in the State thanks to the large number of US tech companies headquartered there.
The 2015 National Cybersecurity Strategy was updated in 2019.
It acknowledged the country’s dependence on globally connected technology flows which give rise to “a complex and evolving set of risks”, including “deliberate actions by organised groups, including nation states, seeking to subvert or compromise these systems”.
Russia is not mentioned, even though Moscow’s interference in the 2016 US presidential election, via the Internet Research Agency in St Petersburg, linked to the Wagner Group boss Yevgeny Prigozhin, had become a widely discussed concern in Europe.
The full-scale invasion of Ukraine dramatically sharpened the Government’s sensitivity to hybrid warfare, including cyber attacks, misinformation, electoral interference and the risk to maritime infrastructure.
Russia had planned naval exercises inside Ireland’s Exclusive Economic Zone (EEZ) just two weeks before the invasion, before agreeing to moving the exercises outside the EEZ.
The 2022 report of the Commission on the Defence Forces referred to a “continued blurring of the lines between internal and external security, accelerated by the increased use of hybrid forms of aggression against Western democracies”.
Following the Taoiseach’s Consultative Forum on International Security Policy, chair Professor Dame Louise Richardson concluded: “Russian military manoeuvres within Ireland’s Economic Exclusion Zone (EEZ) shortly before the invasion of Ukraine also laid bare our vulnerabilities.
“Ireland’s EEZ is host to fibre optic cables that carry 97% of global communications, while three-quarters of Ireland’s natural gas is imported via pipeline.
“In all, Ireland’s territorial waters and EEZ are almost seven times the size of our land area. This area is of critical strategic importance and is vulnerable to attack.
“It has also become clear that deliberate foreign disinformation campaigns can also impair a country’s ability to respond quickly and effectively to threats.”
Within two years, the Government was sounding increased alarm over the threat to undersea cables and the need to boost defence capabilities there.
Without mentioning Russia, the Defence Policy Review in 2024 referred to “the increase in suspicious activity by foreign militaries in Ireland’s Exclusive Economic Zone (EEZ)”.
“The security of undersea fibre optic cables, which represent vital but vulnerable components of the international communications infrastructure are a particularly important feature in this regard,” the review continued.
With the creation in March 2025 of the Ministerial Council on National Security, Taoiseach Micheál Martin was much more explicit about the Russian hybrid threat, which would now be countered on a cross-departmental basis.
“We are facing new cyber and hybrid threats, as well as an ongoing bloody and immoral invasion by Russia of Ukraine, which poses an existential threat to EU member states,” Mr Martin said.
On 1 December last year, four military-grade drones were monitored loitering above the naval vessel LÉ William Butler Yeats, which was patrolling the Irish Sea, before heading towards the east coast.
The crew decided not to fire given the risk to civilian life, but given that the drones were on or near the flight path of the aircraft that would bring Ukrainian President Volodymyr Zelenskyy to Dublin for his first official visit, the incident has been seen as potentially the gravest incident yet in which Ireland was targeted.
Experts believe the hybrid campaign will intensify.
“The Kremlin is aware of Russia’s diminished military status as its war in Ukraine fails to achieve meaningful strategic goals,” said Michael Newton, of the Centre for European Policy Analysis (CEPA).
“Planned confrontation in the West through instigated shadow war crises, and a paralysed response, remains one of its remaining options to achieve its objectives.”