According to available data from European intelligence services, around fifty incidents classified as hybrid operations occurred in September 2026 across the EU and the United Kingdom. The geography includes Germany, France, Britain, Poland, Spain, the Baltic states and Scandinavia.
Targets cited include military-industrial enterprises, warehouses, railway infrastructure, aviation logistics facilities, as well as the mailing of explosive devices and assassination attempts on entrepreneurs and dissidents. Some of the episodes involved arson, damage to tracks and power lines, and attempts to disrupt airport operations. The most high-profile cases in recent weeks have been the drone incident at Leipzig/Halle Airport, fires at defence plants in Poland, and intelligence warnings of possible attacks from the sea against southern European countries.
European officials link the rise in such activity to an effort to undermine support for Ukraine, sow fear and test NATO’s response. The perpetrators are more often “disposable” agents recruited online than career intelligence officers. Germany has already officially attributed the Leipzig attack to Russian structures and closed the Russian consulate-general in Bonn. Poland, the Baltic states and the Nordic countries have also recorded an increase in incidents and are tightening security around critical infrastructure.
Moscow routinely denies involvement. European leaders stress that they do not expect a direct military attack on NATO for now but regard the sabotage campaign as a deliberate escalation in the “grey zone.”
