The “Russian hybrid war” narrative: a new NATO strategy of tension?
Thomas Fazi
Oct 07, 2026
Lately, not a day goes by in Europe without some drone scare, fire or blackout being blamed on Russia. We are told that these incidents are all part of a relentless “hybrid war” that Russia is waging against Europe — one that involves drone incursions, airspace violations, sabotage, arson, cyberattacks and more. We are
told this “includes plots to place incendiary devices aboard DHL cargo planes, blow up railroad tracks in Poland, and burn down warehouses and shopping centers all over Europe”, as well as “acts of sabotage against defense companies and the defense industry in Europe”,
and “attacks on European critical infrastructure” — but
also, apparently, sending secret agents to defecate in the lavatories of Finnish MPs. We are also told that “uch attacks began occurring shortly after Russia launched its full-scale invasion of Ukraine in 2022”, and have escalated in recent months and weeks.
According to Kaja Kallas, “Europe faces a fast-proliferation of sabotage attacks and airspace violations”.
Tensions escalated dramatically last month after Germany formally attributed an attempted explosive-drone attack at Leipzig/Halle Airport to Russia, with subsequent investigations reportedly tracing the operation back to Russian military intelligence. This raised the stakes considerably: it was one of the most serious incidents on German soil ever officially pinned on Moscow by Berlin — albeit a “failed” one. German foreign minister Johann Wadephul said the attack “fits into a broader pattern of Russian hybrid operations in Europe”.
Within hours, EU-NATO leaders across multiple capitals had not only accepted the attribution but agreed on what the incident meant: a piece of a coordinated campaign, with a known motive, requiring a predetermined response, i.e., sanctions and more Ukraine support. “The evidence is clear”,
said NATO Secretary General Mark Rutte, on the same day as the German government’s announcement — though at that point the Germans hadn’t yet shared any evidence, either with the public or,
it would appear, with other EU-NATO governments. French President Emmanuel Macron also said that the attack was clear evidence that “the Russian hybrid threat against Europeans... has intensified”. Polish Foreign Minister Radosław Sikorski
warned that Russia’s confrontation with Europe was becoming increasingly “kinetic”, adding that “Russia is at war with Europe”. “This is the new normal”, said European Commission President Ursula von der Leyen. Seemingly confirming this, just a few weeks later, on September 29, the Estonian government officially
accused Russian special services of commissioning an arson attack on the building of the Estonian defence company Milrem — another serious step up from the previous pattern of alleged but unofficial attributions to Russia.
Warnings of worse to come
Meanwhile, we are also constantly told that Russia intends to escalate even further — i.e., that we should brace for much more serious attacks against Europe, possibly just around the corner. Within the space of a few days, it was
reported that “European intelligence officials have raised the possibility of an imminent Russian test of NATO, with one saying a potential attack could come in a matter of ‘months, not years’”; that,
according to the FBI, “Russia is plotting targeted assassinations across the US and in European countries”; and that there
exists a CIA report warning Italy, France and Spain about a potential Russian operation involving drone attacks launched from merchant ships in the Mediterranean Sea, or so the journalist who published the “scoop” in El Mundo claimed to have been told by an anonymous source close to the Lithuanian Ministry of Defense.
The article received massive global coverage — yet, in less than 24 hours, both Italian Defense Minister
Guido Crosetto and
Macron firmly denied receiving any such warning and dismissed the claims as groundless, suggesting that the story was concocted either by the “anonymous source” or by the journalist himself. The episode also shows that such claims, especially when presented with no supporting evidence whatsoever, need to be treated with extreme caution — particularly when they rest on shaky logic to begin with. In this case, for example, one may reasonably wonder what interest Russia would have in attacking Spain and Italy, two of the least enthusiastic supporters of the forever war Ukraine.
But there have been even more bizarre claims. In recent weeks, there has been coordinated messaging across NATO that Russia could be
preparing a “false flag attack... in the next few months” — i.e., a drone or missile strike that Russia would then
claim was an “accident” or even try to blame on Ukraine. But how would Russia benefit from either of these scenarios? They have both occurred already — there have been several instances of stray Russian and Ukrainian drones entering NATO airspace near the border with Ukraine (see below) — and the only effect has been to harden NATO’s stance. Moreover, if Russia were aiming for plausible deniability, why did it allegedly leave its fingerprints all over the attempted drone attack in Leipzig/Halle? And how do these claims square with the opposite claim that Russia may launch an open attack against a NATO country “within months”, as Danish intelligence recently
said? Which one is it? But we are not expected to ask questions or point out inconsistencies in the story; we are simply expected to believe what our media and governments tell us.
Is Russia about to attack? Even NATO isn’t sure
Of course, none of us has any way of knowing what Russia is planning to do, especially given that this is a dynamic situation in which Russia’s actions are influenced by NATO’s actions and vice versa. Russian President Vladimir Putin, for his part, denies all allegations, and has repeatedly stated —
most recently on September 19 — that Russia has “no aggressive intentions towards Europe or European countries” and is ready to restore relations and cooperate with its European neighbours — while at the same time accusing European leaders of using the alleged Russian threat to justify their own policies and seek an escalation with Moscow. Of course, one may argue that if Russia were poised to attack, it wouldn’t tell Europeans in advance, and so its words shouldn’t be taken at face value.
This is true, of course. At the same time, insofar as most states are rational actors that tend to think and act strategically — and Russia certainly fits the description — one may ask what rational or strategic interest Russia would have in launching an attack on Europe that could easily lead to an all-out NATO-Russia war, especially since Russia’s refusal so far to retaliate in kind to NATO-enabled Ukrainian attacks on its territory, including against civilians, has likely been motivated precisely by a desire to avoid such an outcome. Interestingly enough, such scepticism is shared even by some voices within the NATO establishment.
Estonia’s foreign intelligence service, for example, wrote in its
2026 Annual Report, published in February: “There is... no cause for panic. In the Estonian Foreign Intelligence Service’s assessment, Russia has no intention of militarily attacking Estonia or any other NATO member state in the coming year. We are likely to reach a similar assessment next year”. Even Finnish President Alexander Stubb, otherwise very hawkish on Russia, has
pushed back against warnings from fellow European leaders that Russia could attack NATO in the near future, saying Helsinki’s intelligence sees no evidence of an imminent military threat. “We don’t see the evidence of that”, Stubb said. “In our intelligence we see that there is activity but no imminent military threat right now”. Indeed, as
reported by Politico, even NATO’s official assessment remains that there is no imminent threat: “At this time, we see no imminent threat of attack”, said a NATO official speaking on behalf of the organisation. On September 29, at a joint NATO press conference, Lithuanian PM Mindaugas Sinkevičius
stated that he asked Mark Rutte for real intelligence evidence of Russia preparing an imminent attack, receiving confirmation that none exists. “I asked [Rutte] is there proof, real proof, that Russia is planning something? But there is actually nothing”, he said.
This shows that even NATO’s own assessments are highly contradictory. In terms of public sentiment, however, it makes little difference, since the imminent-attack claims far outweigh the more cautious assessments, which generally receive hardly any coverage. In any case, in the absence of evidence pointing in one direction or the
other, speculations about future scenarios ultimately remain just that: speculations — especially considering that we have to assume that Russia’s posture isn’t fixed but is inevitably influenced by NATO’s actions. What we can assess with some certainty is what Russia has been engaged in so far — which in turn provides us with the best possible insight as to what it might do next. The question that needs to be asked is thus: does the evidence support Western claims that Russia is engaged in a “hybrid war” against Europe?
The “hybrid war” reports — and its inconsistencies
There are several databases and reports that purport to quantify Russian hybrid warfare, which are often cited as proof of a coordinated, escalating Russian campaign. These include datasets and reports by the
European Repository of Cyber Incidents, which is strictly focused on cyber attacks,
Leiden University, the
Soufan Center,
Associated Press, the US-based think tank
Center for Strategic and International Studies (CSIS), the UK-based
International Institute for Strategic Studies (IISS) and the Bratislava-based think tank
GLOBSEC. Taken individually and at face value, each of these reports paints an apparently damning picture comprising dozens — and in some cases hundreds — of alleged sabotages, attacks and influence operations spanning several European countries over many years. Worrying indeed. Read side by side and in detail, however, they tell a very different story: the numbers diverge wildly; the central concept is undefined; attribution often rests on nothing more than press reports of official suspicion; and the reports’ own caveats — buried in footnotes, appendices and methodology sections — often undercut the claims made in their executive summaries.
For starters, the numbers don’t add up. Depending on which report you read, Russia carried out somewhere between 52 and 255 hybrid attacks in Europe after February 2022 — a fivefold spread for what is supposedly the same campaign. The Soufan Center, covering just six countries — two of them, Moldova and Georgia, outside the EU — records more incidents for 2025 alone than CSIS does for three years across the whole continent. The numbers diverge because there is no agreed answer to the most basic question: what is a hybrid attack? The IISS paper itself concedes that hybrid warfare is “an amorphous term” with wide variation in definitions. Some reports limit themselves to physical attacks and plots, and even then these range from arson to placing pro-Kremlin stickers, vandalism and spraying graffiti; others include “influence operations” such as monthly peace demonstrations in Amsterdam; and others even include Russian naval passages through the English Channel. Ultimately the term can be used to include almost anything. The biggest difference in numbers is determined by the treatment of (alleged) drone sightings attributed to Russia — numbering in the hundreds but in most cases eventually debunked (see below) — and hence excluded by most reports, despite receiving huge media coverage and being one of the largest contributors to the “hybrid war” hysteria.
Moreover, in most cases, the evidence linking Russia is very weak — or non-existent. Across these reports, the evidence that Russia was behind a given incident usually consists of a news article reporting that officials suspect it. There is no independent verification: if a government says “Russia did it”, it goes on the list — even in the absence of any evidence. Moreover, the Leiden dataset includes incidents that were
linked to Russia by officials or politicians, or uncovered by journalistic investigations — but also those that merely “appeared to fit in a pattern” of similar events. The reports also lean on each other. IISS’s dataset is built on the Leiden dataset; GLOBSEC cites the Leiden figures, IISS and an AP count; CSIS cites the Leiden research; the Soufan Center interviewed the author of the Leiden dataset. Ultimately, most roads lead back to the same pool of media reports of official claims — in most cases of “possible” or “likely” Russian involvement. And those official claims are not neutral. The IISS paper, remarkably, says so itself: decisions about attribution are “rarely made in a political vacuum”, and public statements “reflect broader strategic calculations as much as their confidence in the evidence”.
Nor can many of the organisations behind these reports be considered neutral. The IISS, CSIS and GLOBSEC all have funding ties to American and European arms manufacturers (GLOBSEC counts among its donors the defence company Helsing, which the Ukraine war has turned into Europe’s
most valuable startup), as well as to the transatlantic establishment, and are known for their hawkish approach to the Ukraine war and to Russia. The language of the reports themselves betrays their ideological commitment. The CSIS brief argues that NATO should abandon its “mindset of self-deterrence” and launch a “calibrated offensive campaign” against Russia. The IISS urges a “more assertive and proactive stance”, with its chair, Lord Mark Sedwill,
saying that Britain was at war with Russia. The GLOBSEC report
speaks of “state terrorism”.
But, in fact, as noted above, the reports themselves contain very little evidence, if any, to support the “Russia is at war with Europe” narrative.
Aside from the handful of sabotages that have resulted in convictions — discussed below — and even then with only tenuous links being drawn to the Russian state, virtually all the incidents logged in these reports are based purely on unsubstantiated claims made by Western officials, security services or media outlets, often without presenting evidence (as we shall see, this also applies to formally attributed actions like the Leipzig/Halle drone incident). As the Associated Press admits, “t is often difficult to prove Russia’s involvement, and the Kremlin denied carrying out a sabotage campaign against the West. But more and more governments are publicly attributing attacks to Russia”. This constant talk of “
possible” or “potential” Russian attacks ultimately generates a public perception of a relentless campaign being waged against Europe, even in the absence of evidence. As Ivo Capaul of ETH Zürich
noted, the effect of the media coverage and political climate (a wholly intended one, I would add) is to create “cognitive biases in the form of a clustering illusion” — seeing patterns between data points that are not necessarily connected, or that in some cases don’t exist at all.
The claims don’t stand up to scrutiny
Indeed, what is astonishing is how many widely reported claims of Russian sabotage ended up collapsing upon basic scrutiny. One of the most infamous cases occurred in
September of last year, when it was widely reported (initially by the
Financial Times) that Russia had “recklessly” jammed the GPS of von der Leyen’s airplane over Bulgaria, forcing pilots to land using “paper maps” after “circling the airport for an hour”. NATO Secretary General Mark Rutte was quick to suggest that the incident was part of a wider pattern of “hybrid warfare” that included “cyber attacks and severing subsea cables”. Public outcry ensued. However, the story
collapsed within hours: a flight tracking service
demonstrated that the signal was never lost and the plane was actually only 9 minutes late. Bulgarian Prime Minister Rosen Zhelyazkov stated there was nothing to investigate. This was a significant case of claims
promoted by sources close to the top of the European Commission being prominently exposed as false, yet the claims made were never
retracted or clarified. Nor did they give rise to wider scrutiny of the “Russian hybrid warfare” narrative.
But this was not an isolated case: there have been countless claims of Russian sabotage or hybrid activity that were massively amplified by the media, only to be subsequently debunked or proven false — the latter going largely unreported. In November 2024, a series of incidents causing damage to cables in the Baltic Sea was widely reported in the media. Coverage was fuelled by
European decision-makers openly attributing the incidents to Russia even before the investigations had been concluded. The lack of clear information sparked
public speculation about who was responsible for the incidents and how exactly they had come about. Finnish authorities
detained a ship, suspected of being part of
Russia’s “shadow fleet” used to avoid sanctions, after that cable and others were damaged. It eventually turned out that the damaged undersea cables in the Baltic Sea had been caused by
Hong Kong- and
China-flagged ships — not by Russian vessels. The Finnish intelligence service SUPO
observed that “statistically, the number of cases of cable damage in recent years is quite typical for the Baltic Sea”. Yet again, no apology was issued by European authorities for the false claim.
Does the evidence support the narrative? Or does it rather point to a “hybrid war” — a campaign of psychological warfare — being waged by the EU-NATO establishment itself, against its own population?
www.thomasfazi.com