Germany’s relationship with Russia plunged to a fresh low this week after Berlin accused Moscow of playing a role in a drone attack targeting Leipzig-Halle Airport — an allegation the Kremlin rejects but one that has reignited fears across Europe of an expanding Russian “hybrid” campaign against countries backing Ukraine.
The dispute, which Russia denies, has thrown a harsh spotlight on the growing debate over whether Europe is already facing a shadow conflict designed to intimidate, disrupt and divide EU states supporting Kyiv.
Is this a genuine threat, and if so, what has been Europe’s response?
The alleged hybrid pressure on Europe took a sharper turn when Germany formally blamed Russia for an attempted drone strike at Leipzig-Halle Airport on 4 August.
“The means used,” German Interior Minister Alexander Dobrindt declared on Tuesday, “such as the drone configuration, components, explosives and detonation systems, are known to us from other hybrid operations by Russia and its war against Ukraine”.
Investigators say three drones were involved. One — packed with military grade explosives — was spotted by an alert bus driver beside a Ukrainian cargo plane. A second struck a cargo aircraft while it was in flight. A third, carrying traces of explosives, was later found in a nearby field.
Germany moved quickly, ordering the immediate closure of the Russian consulate in Bonn and a Russian cultural centre in Berlin.
Russian President Vladimir Putin, in turn, accused German Chancellor Friedrich Merz of trying to shift public attention ahead of this weekend’s pivotal regional election in Saxony-Anhalt, where the Russia-sympathetic AfD party is expected to triumph.
Kremlin spokesperson Dmitry Peskov told reporters that Berlin had produced no evidence and warned that Germany was “proceeding down a path of further escalation”.
Yet on Wednesday, German media reported that police had identified two suspects through DNA traces: a Belarussian national holding a Russian passport and a joint Russian-Latvian national.
Germany shut down the Russian consulate in Bonn in response to the incident in Leipzig
What exactly is hybrid warfare?
The episode — and the blunt exchanges between Berlin and Moscow — captures what officials and analysts describe as the essence of hybrid warfare: limited, often deniable actions calibrated to unsettle governments, strain alliances and keep rivals guessing about attribution and intent.
Hybrid attacks have shadowed Russia’s invasion of Ukraine since 2022, but they are increasingly being described as cresting at a moment when Mr Putin, having failed to force a breakthrough on the battlefield and facing waning energy at home among the population and elites, is thought to be weighing escalation to break the impasse.
“We will escalate our methods to destroy everything that helps Ukraine’s military coming from the West,” foreign minister Sergei Lavrov admitted recently.
“In fact, we are already doing it.”
What set Leipzig apart, German officials argue, was the recoverable hardware: unlike multiple drone sightings along Germany’s eastern flank last year, this custom-built quadcopter carried 600g of explosives — enabling authorities to dismantle and assess it.
The central question now is whether Mr Putin is prepared to risk direct attacks — even indirect, hybrid ones such as sabotage and drone strikes — against NATO countries.
Regardless of the answer, European capitals have struggled to assemble a response that is both unified and credible, a gap many believe the Kremlin is eager to exploit.
Speaking on Wednesday at an informal gathering of EU foreign ministers in Druid’s Glen in Co Wicklow, the EU’s foreign policy chief Kaja Kallas said the Leipzig incidents bore “all the hallmarks of state-sponsored terrorism”.
Russia has denied any involvement in drone attacks on EU territory
She added: “The question is, what do we do about this? We have already summoned the Russian ambassador.”
Even after Berlin formally assigned responsibility to Russia, the immediate reaction fell short of what some observers anticipated.
Chancellor Merz had telegraphed the accusation in advance, but said nothing publicly on the day, leaving the matter to the interior and foreign ministers and signalling that Germany would hold a tougher response in reserve should Russia strike again.
“This is also an expression of the appropriateness of our reaction, ” foreign minister Johann Wadepuhl explained.
“Germany can show a stronger reaction at any time.”
What has Germany’s response been?
After the Leipzig incidents, Minister Dobrindt doubled the number of specialist anti-drone police to 300, widened the areas in which they operate and announced a new drone research centre at Magdeburg-Cochsted Airport.
Two weeks ago, Berlin introduced legislation aimed at a sweeping overhaul of the federal foreign and military intelligence service, the BND, explicitly to strengthen its ability to combat hybrid warfare.
The political instinct, officials say, is to reach for more — and tougher — sanctions.
Minister Wadepuhl said Germany would press for additional EU measures, including travel restrictions on Russian nationals, and intensify efforts against Russia’s so-called shadow fleet of oil tankers, long suspected of serving as seaborne launchpads for drones.
German Foreign Minister Johann Wadephul (L) and Interior Minister Alexander Dobrindt held a press conference on Wednesday to address the incident
But EU officials privately acknowledge that the bloc is approaching the limits of easy consensus: 21 sanctions packages are already in place, and further steps increasingly collide with national economic interests.
Securing the 21st package in July, it is understood, proved particularly fraught. Athens objected to measures affecting Greek vessels that ship Russian LNG, while Austria pushed for Vienna-based Raiffeisen Bank International (RBI) to access sanctioned assets linked to its Russian subsidiary to offset fines imposed by Moscow.
“There’s a certain reflection going on in Brussels about whether it is really smart to continue doing this,” says one EU diplomat.
“It’s getting more and more difficult and divisive. They are meant to be about holding Russia to account and eliminating its ability to wage war against Ukraine, when actually it’s dividing us.”
Even so, officials widely expect the EU to proceed with a 22nd package.
Have hybrid attacks been on the increase?
Officials across the region say hybrid incidents are intensifying.
On 26 August, Romanian F16 jets destroyed an explosive-laden drone loitering a few hundred metres from Netpun Deep — Europe’s largest natural gas platform — inside Romanian territorial waters.
It was the fourth allegedly Russian drone shot down over Romania this year.
Elsewhere, governments have reported an array of covert operations against states supporting Ukraine.
On 16 November last, an explosion damaged the Warsaw to Lublin rail line used to move equipment to Kyiv — an attack Polish authorities blamed on two Ukrainian men allegedly working for the Russian foreign security service (FSB).
Two months earlier, Lithuanian prosecutors said they had disrupted a Russian plan to send homemade incendiary devices through logistics companies including DHL, with one device exploding in Leipzig and another catching fire at a DHL hub in Birmingham.
Intelligence services say dozens of other alleged drone and sabotage incidents have been recorded.
A train from Warsaw to Lublin in Poland was damaged in an explosion last year blamed on men working for the Russian foreign security service
Carnegie Europe, the international foreign and security policy think tank, says there have been 151 cases of sabotage and shadow warfare since 2022 either publicly attributed to Russia or suspected of involving Russia or Russia-adjacent actors.
“Between 2023 and 2024, the number of such attacks quadrupled, and the tally for the following years continued on an upward curve. That is in addition to the daily informational warfare and intense political and election interference Europe is subjected to from various quarters,” says Carnegie’s Strategic Europe editor Rym Momtaz.
The Institute for International Institute for Strategic Studies (IISS) said in a July report that from August 2024 to February 2026, suspected Russian drones entered the airspace of a dozen NATO member states and Ireland, “forcing the closure of aviation hubs including Brussels, Copenhagen, Munich, Oslo and Vilnius”.
The same report said drones disrupted smaller regional airports across Denmark, Germany and the Baltic states, and were spotted above European naval facilities and air bases — including locations hosting US nuclear weapons and a French ballistic missile submarine base.
The IISS characterised the trend as a tactical win for the Kremlin and a strategic failure for Europe’s allied air defences.
According to the report, the campaign seeks to “probing the response times and decision-making thresholds of allied air defence and civil-military command structures; mapping vulnerabilities around critical infrastructure, including dual-use civilian hubs, military logistics nodes supporting Ukraine, and facilities associated with allied nuclear deterrence; imposing economic and psychological costs on European societies through the disruption of civilian aviation and public confidence in airspace security”.
The Danish prime minister said Russia’s involvement in drone sightings at Copenhagen Airport last year could not be ruled out
More broadly, hybrid — or shadow — warfare is used as an umbrella term for relatively low-cost offensive tactics designed to weaken and confuse an opponent without crossing the line into open conflict.
Those methods allegedly span election interference, online campaigns and other efforts aimed at stoking division, hostility and political fatigue.
“Much like a hybrid vehicle, which seamlessly switches between gasoline and electricity without being noticed, hybrid warfare blends tools of statecraft and conflict,” said Eitvydas Bajarūnas, non-resident Senior Fellow at the Centre for European Policy Analysis (CEPA).
“Information manipulation campaigns segue into cyber attacks, which give way to political influence operations, economic pressure, or covert sabotage. The combination is designed to be adaptive, continuous, and hard to attribute, keeping the target off-balance.”
Attribution remains difficult: identifying where drones come from is often complex, and Moscow has repeatedly denied involvement.
Still, the IISS report argues that “the aggregate pattern of [drone] sightings cannot be adequately explained by misidentification, hobbyist activity or opportunistic harassment alone”.
Danish authorities stopped short of definitive conclusions after drone incidents in September last year near Copenhagen airport and several military bases, but an earlier episode appeared more alarming.
Up to 20 large drones were observed flying in formation over the Køge port before accelerating into the bay and vanishing at high speed.
The port had previously served as Denmark’s main embarkation point for deployments to NATO’s Enhanced Forward Presence in eastern Europe.
How have sabotage operations worked?
UK counter-terrorism police say Russia has relied on proxies to carry out attacks, adding another layer of deniability.
Last October, Dylan Earl, 24, and Jake Reeves, 21, received a combined 29-year sentence for an arson attack on a Ukrainian-owned business in east London in March 2024, which caused €1.16 million in damage.
Two men, who police found were working for the Wagner Group, were found guilty of an arson attack on a Ukranian-owned business in London in 2024 (Photo: London Fire Brigade)
Police said the pair made contact on Telegram with the Russian mercenary organisation, the Wagner Group, which paid them to carry out the arson and plan further attacks.
Commander Dominic Murphy, head of the Counter Terrorism Policing London, said: “This case is a clear example of an organisation linked to the Russian state using ‘proxies’ – in this case British men – to carry out very serious criminal activity in this country on their behalf.”
Officials suspect other sabotage operations across Europe have similarly been executed by local proxies recruited via intermediaries.
How long has Russia been operating a hybrid warfare doctrine?
Analysts disagree on when the doctrine took shape.
In 2019, Nicole Ng of Carnegie’s Russia and Eurasia Programme and Eugene Rumer, a former US national intelligence officer, traced the modern concept to 1996, when Yevgeny Primakov — then head of Russia’s foreign intelligence service — became foreign minister.
After the Soviet Union’s collapse, Russia initially pursued accommodation with the West, but Primakov argued that a US-dominated unipolar world was unacceptable to Moscow.
“He envisioned a multipolar world managed by a concert of major powers, with Russia as an indispensable actor with a vote and veto on key issues.
“Securing Russia’s primacy in the post-Soviet space and opposing NATO enlargement were also crucial to Primakov’s vision.”
That outlook aligned with Vladimir Putin’s instincts when the former Soviet intelligence officer who served in East Germany became Russia’s president in January 2000.
In his 2007 speech at the Munich Security Conference, Mr Putin attacked the concept of a unipolar world, calling it not only unacceptable but “impossible in today’s world”.
Russia invaded Georgia the following year.
In February 2013, Russia’s chief of staff General Valery Gerasimov published a 2,000-word essay in a little-known military trade paper titled, “The Value of Science Is in the Foresight”.
The article fused Soviet-era tactics with a modern theory of warfare aimed at weakening an adversary from within rather than relying on frontal assault.
Russian Chief of the General Staff Valery Gerasimov presented a new theory of modern warfare
“The very ‘rules of war’ have changed,” he wrote.
“The role of non-military means of achieving political and strategic goals has grown, and, in many cases, they have exceeded the power of force of weapons in their effectiveness.
“All this is supplemented by military means of a concealed character.”
One year later, Russia invaded and annexed Crimea — an operation often described as hybrid because Mr Putin initially denied Russian troops were there, referring instead to “little green men”, before later acknowledging their presence after the campaign succeeded.
Senior intelligence officials say they have no doubt Russia is waging a hybrid war against Europe.
“We are in the middle of a hybrid war,” former vice-president of the German BND Ole Diehl told a German Council on Foreign Relations podcast.
“Russia has not declared this war, but Russia is leading this war against us.The Russians say so quite clearly, they openly declare that there is no difference between a conventional military war, and a hybrid war.
“Russia wants to destabilise our society, to stop our support for Ukraine, it wants to increase its influence not just in the former Soviet republics and Warsaw Pact countries, but also its influence on us, on Europe.
“This hybrid war requires that we think differently about what the Russians are doing and what we are doing in response.”
What is Europe doing in response?
From the standpoint of those who deploy it, hybrid warfare has a built-in advantage: traditional defence and deterrence systems are often ill-suited or outdated for threats that sit below the threshold of open war.
Because hybrid tactics range from drones and sabotage to assassinations, cyber attacks and the flooding of social media with anti-Ukraine narratives — as well as election interference — governments can struggle to respond consistently.
Critics argue that if the Kremlin is applying pressure in a coordinated way, Europe needs a coordinated answer.
British forces intercepted a sanctioned oil tanker belonging to Russia’s shadow fleet in the English Channel earlier this year
In March this year, EU leaders agreed to step up Europe’s capacity to counter hybrid threats.
They pointed to a wide bundle of tools: the Hybrid Toolbox; directives such as Critical Entities Resilience (CER); the Cyber Diplomacy Toolbox; the Digital Services Act; the Foreign Information Manipulation and Interference (FIMI) framework; the European Democracy Shield, led by Irish commissioner Michael McGrath; and additional strategies spanning maritime, airspace, cyber and critical infrastructure, as well as AI and quantum technologies.
“It is about organising [the response] around a clearer theory of how vulnerabilities interact in the same operating environment,”argue Raluca Csernatoni and Alicia Wanless of Carnegie Europe.
“What is missing is a strategic vision matched by an operational logic that can make sense of and connect infrastructural disruptions, technological dependencies, information manipulation, and practices of economic coercion as disturbances in the same wider ecosystem.”
Europe’s intelligence effort is also constrained by uneven national mandates.
In Germany, when a BND officer receives intelligence about a potential sabotage operation, procedures limit the response to sending a classified report to the Chancellery and other departments.
In France, by contrast, agents are required to act immediately.
“In the future, this will be the BND’s job,” said former BND vice-president Ole Diehl.
On the drone threat, the IISS argues that “Europe’s… air-defence and civil-aviation radar infrastructure was designed for a different era and was focused on fast, high-altitude aircraft operating in known corridors, cooperating with aviation and surveillance systems that depended on electronic self-identification”.
Kaja Kallas said the Leipzig attacks had ‘all the hallmarks of state-sponsored terrorism’
Drones, by comparison, typically fly low, do not broadcast their identity and location, and may be launched from vessels in international waters rather than crossing land borders.
This means drone incidents can probe air-defence readiness while also forcing governments to scramble expensive fighter jets or missile interceptors.
Last year the European Commission proposed a European Drone Defence Initiative (EDDI), aiming for a continent-wide, 360-degree counter-drone architecture, with initial operational capability by the end of this year.
The European Parliament has cautioned that interception is costly and warned that by the time a system is procured and tested, it may already be obsolete.
For now, member states operate under differing rules governing whether police or the military can shoot down drones and under what conditions.
Ireland’s response
Ireland is widely viewed as especially exposed, given vulnerabilities around lightly protected undersea cables and the fact that roughly 30% of EU data sits in the State due to the concentration of US tech headquarters there.
The 2015 National Cybersecurity Strategy was updated in 2019.
It highlighted Ireland’s reliance on globally connected technology flows, warning of “a complex and evolving set of risks”, including “deliberate actions by organised groups, including nation states, seeking to subvert or compromise these systems”.
Taoiseach Micheál Martin has been more explicit about the Russian hybrid threat
Russia was not named, despite growing European concern over Moscow’s alleged role in the 2016 US presidential election through the St Petersburg-based Internet Research Agency, linked to Wagner Group boss Yevgeny Prigozhin.
The full-scale invasion of Ukraine sharply heightened the Government’s focus on hybrid threats, including cyber attacks, misinformation, election interference and risks to maritime infrastructure.
Russia had planned naval exercises inside Ireland’s Exclusive Economic Zone (EEZ) just two weeks before the invasion, later agreeing to move them outside the EEZ.
A 2022 Commission on the Defence Forces report described a “continued blurring of the lines between internal and external security, accelerated by the increased use of hybrid forms of aggression against Western democracies”.
After the Taoiseach’s Consultative Forum on International Security Policy, chair Professor Dame Louise Richardson said: “Russian military manoeuvres within Ireland’s Economic Exclusion Zone (EEZ) shortly before the invasion of Ukraine also laid bare our vulnerabilities.
“Ireland’s EEZ is host to fibre optic cables that carry 97% of global communications, while three-quarters of Ireland’s natural gas is imported via pipeline.
“In all, Ireland’s territorial waters and EEZ are almost seven times the size of our land area. This area is of critical strategic importance and is vulnerable to attack.
“It has also become clear that deliberate foreign disinformation campaigns can also impair a country’s ability to respond quickly and effectively to threats.”
Protesters gathered to celebrate the closure of the Russian House for Science and Culture in Berlin following the Leipzig incident
Within two years, the Government was issuing stronger warnings about threats to undersea cables and the need to reinforce defence capacity in that domain.
Without naming Russia, the 2024 Defence Policy Review pointed to “the increase in suspicious activity by foreign militaries in Ireland’s Exclusive Economic Zone (EEZ)”.
“The security of undersea fibre optic cables, which represent vital but vulnerable components of the international communications infrastructure are a particularly important feature in this regard,” the review continued.
When the Ministerial Council on National Security was created in March 2025, Taoiseach Micheál Martin spoke more directly about the Russian hybrid threat and said the State would counter it through a cross-departmental approach.
“We are facing new cyber and hybrid threats, as well as an ongoing bloody and immoral invasion by Russia of Ukraine, which poses an existential threat to EU member states,” Mr Martin said.
On 1 December last year, four military-grade drones were tracked loitering above the naval vessel LÉ William Butler Yeats as it patrolled the Irish Sea, before heading toward the east coast.
The crew chose not to fire because of the risk to civilian life. But because the drones were on or near the flight path of the aircraft due to bring Ukrainian President Volodymyr Zelenskyy to Dublin for his first official visit, the episode has been viewed as potentially the most serious instance yet of Ireland being targeted.
Experts say the hybrid campaign is likely to intensify.
“The Kremlin is aware of Russia’s diminished military status as its war in Ukraine fails to achieve meaningful strategic goals,” said Michael Newton, of the Centre for European Policy Analysis (CEPA).
“Planned confrontation in the West through instigated shadow war crises, and a paralysed response, remains one of its remaining options to achieve its objectives.”
