Germany has accused Russia of orchestrating a drone attack on Leipzig-Halle Airport, pushing relations between Berlin and Moscow to their lowest point since Russia launched its full-scale invasion of Ukraine.
Moscow rejects the allegation. But the accusation has once again focused attention on the possibility that Russia is waging an expanding “hybrid” war against European Union countries backing Kyiv.
- Advertisement -
How serious is the threat, and how is Europe responding?
Alleged Russian hybrid activity in Europe reached a new turning point this week when Germany formally blamed Moscow for an attempted drone attack on Leipzig-Halle Airport on 4 August.
Three drones were involved. An alert bus driver found one, carrying military-grade explosives, beside a Ukrainian cargo aircraft. A second drone struck a cargo plane in flight, while a third, also bearing traces of explosives, was discovered in a nearby field.
Berlin responded by closing Russia’s consulate in Bonn and a Russian cultural centre in the German capital.
Russian President Vladimir Putin accused German Chancellor Friedrich Merz of trying to divert voters’ attention before this weekend’s crucial regional election in Saxony-Anhalt, where the Russia-friendly AfD is expected to perform strongly.
Kremlin spokesman Dmitry Peskov told reporters that Germany had presented no evidence and accused Berlin of “proceeding down a path of further escalation”.
On Wednesday, however, German media reported that police had identified two suspects using DNA traces. They included a Belarusian national with a Russian passport and a dual Russian-Latvian national.
Germany shut down the Russian consulate in Bonn in response to the incident in Leipzig
What exactly is hybrid warfare?
The alleged attacks, and the sharply contrasting reactions from German officials and the Kremlin, capture the central logic of hybrid warfare: limited operations intended to create division, unsettle European governments and preserve Russia’s ability to deny responsibility.
Such activity has continued since Russia invaded Ukraine in 2022. But it now appears to be intensifying at a moment when Mr Putin has failed to secure a decisive battlefield breakthrough and is facing growing frustration among both the Russian public and the country’s elite. Some believe he may be weighing an escalation to break the deadlock.
“We will escalate our methods to destroy everything that helps Ukraine’s military coming from the West,” Foreign Minister Sergei Lavrov said recently.
“In fact, we are already doing it.”
The Leipzig incident carried particular weight because, unlike the many drone sightings reported along Germany’s eastern flank last year, the custom-built quadcopter was recovered with 600g of explosives on board. Authorities were therefore able to dismantle and examine it.
The central question is whether Mr Putin is prepared to risk direct attacks on NATO members, even if those operations remain below the threshold of conventional war.
Whatever the answer, Europe has yet to settle on a unified response — a confusion that may itself serve the Kremlin’s interests.
At an informal meeting of EU foreign ministers in Druid’s Glen, Co Wicklow, on Wednesday, the EU’s foreign policy chief Kaja Kallas said the Leipzig incidents bore “all the hallmarks of state-sponsored terrorism”.
Russia has denied any involvement in drone attacks on EU territory
She added: “The question is, what do we do about this? We have already summoned the Russian ambassador.”
When Berlin finally assigned responsibility for the Leipzig attacks to Russia, its response was less forceful than many had anticipated.
Chancellor Merz had indicated beforehand that the accusation was coming, but he did not speak publicly on the day. Instead, the interior and foreign ministers delivered the message, with Berlin apparently keeping harsher measures in reserve should Russia strike again.
“This is also an expression of the appropriateness of our reaction,” Foreign Minister Johann Wadepuhl said.
“Germany can show a stronger reaction at any time.”
What has Germany’s response been?
Following the Leipzig incidents, Interior Minister Alexander Dobrindt doubled the number of specialist anti-drone police to 300. Their operational footprint will be expanded, alongside the creation of a new drone research centre at Magdeburg-Cochstedt Airport.
Two weeks ago, Berlin also introduced legislation proposing a fundamental and far-reaching overhaul of the federal foreign and military intelligence service, the BND, specifically to strengthen its ability to counter hybrid warfare.
For now, the immediate instinct is to impose more sanctions — and to make them tougher.
Minister Wadepuhl said Germany would seek additional EU measures and travel restrictions targeting Russian nationals. Berlin also plans to increase pressure on Russia’s so-called shadow fleet of oil tankers, which have long been suspected of serving as offshore launch platforms for drones.
German Foreign Minister Johann Wadephul (L) and Interior Minister Alexander Dobrindt held a press conference on Wednesday to address the incident
Yet officials acknowledge that, after 21 sanctions packages, the EU is running short of relatively easy targets. Further measures could begin to collide with the domestic interests of member states.
Securing agreement on the 21st package in July was reportedly especially difficult. Athens objected to measures affecting Greek vessels involved in shipping Russian LNG, while Austria insisted that Vienna-based Raiffeisen Bank International be permitted to access sanctioned assets tied to its Russian subsidiary in order to offset fines imposed by Moscow.
“There’s a certain reflection going on in Brussels about whether it is really smart to continue doing this,” one EU diplomat said.
“It’s getting more and more difficult and divisive. They are meant to be about holding Russia to account and eliminating its ability to wage war against Ukraine, when actually it’s dividing us.”
Even so, expectations remain high that the EU will proceed with a 22nd sanctions package.
Have hybrid attacks been on the increase?
Evidence suggests that hybrid incidents are becoming more frequent and more audacious.
On 26 August, Romanian F16 fighter jets destroyed an explosives-laden drone that was loitering several hundred metres from Netpun Deep, Europe’s largest natural gas platform, located inside Romanian territorial waters.
It was the fourth drone allegedly linked to Russia to be shot down over Romania this year.
Across the continent, officials have also described a series of covert attacks targeting countries that support Ukraine.
On 16 November last year, an explosion damaged the Warsaw-to-Lublin railway, a route used to move equipment to Kyiv. Polish authorities blamed two Ukrainian men whom they said were working for Russia’s foreign security service, the FSB.
Two months earlier, Lithuanian prosecutors said they had disrupted a Russian plot to send homemade incendiary devices through logistics companies, including DHL. One device exploded in Leipzig, while another caught fire at a DHL hub in Birmingham.
Intelligence agencies say dozens of other suspected sabotage and drone-related incidents have occurred.
A train from Warsaw to Lublin in Poland was damaged in an explosion last year blamed on men working for the Russian foreign security service
Carnegie Europe, an international think tank specialising in foreign and security policy, has recorded 151 cases of sabotage and shadow warfare since 2022 that were either publicly attributed to Russia or suspected of involving Russia or actors linked to it.
“Between 2023 and 2024, the number of such attacks quadrupled, and the tally for the following years continued on an upward curve. That is in addition to the daily informational warfare and intense political and election interference Europe is subjected to from various quarters,” said Rym Momtaz, Carnegie’s Strategic Europe editor.
The Institute for International Institute for Strategic Studies (IISS) reported in July that, between August 2024 and February 2026, suspected Russian drones entered the airspace of a dozen NATO members and Ireland. The incidents “forced the closure of aviation hubs including Brussels, Copenhagen, Munich, Oslo and Vilnius”, it said.
The drones disrupted smaller airports in Denmark, Germany and the Baltic states. They were also spotted over European naval installations and air bases, including sites hosting US nuclear weapons and a French base for ballistic missile submarines.
The IISS characterised the incidents as a tactical victory for the Kremlin and a strategic setback for Europe’s allied air-defence network.
The campaign, the report said, seeks to “probe the response times and decision-making thresholds of allied air defence and civil-military command structures; map vulnerabilities around critical infrastructure, including dual-use civilian hubs, military logistics nodes supporting Ukraine, and facilities associated with allied nuclear deterrence; impose economic and psychological costs on European societies through the disruption of civilian aviation and public confidence in airspace security”.
The Danish prime minister said Russia’s involvement in drone sightings at Copenhagen Airport last year could not be ruled out
More broadly, hybrid — or shadow — warfare refers to a relatively inexpensive collection of offensive tactics intended to weaken and confuse an adversary without crossing the threshold into open war.
Those tactics are said to include election interference and social media campaigns aimed at fuelling division, hostility and political apathy.
“Much like a hybrid vehicle, which seamlessly switches between gasoline and electricity without being noticed, hybrid warfare blends tools of statecraft and conflict,” said Eitvydas Bajarūnas, a non-resident senior fellow at the Centre for European Policy Analysis (CEPA).
“Information manipulation campaigns segue into cyber attacks, which give way to political influence operations, economic pressure, or covert sabotage. The combination is designed to be adaptive, continuous, and hard to attribute, keeping the target off-balance.”
At the same time, establishing where drones come from is difficult, and Moscow has repeatedly denied any role in the incidents.
But the IISS report concluded that “the aggregate pattern of [drone] sightings cannot be adequately explained by misidentification, hobbyist activity or opportunistic harassment alone”.
Danish authorities stopped short of definitively attributing a series of drone incidents in September last year involving Copenhagen Airport and several military bases. One earlier episode, however, appeared more troubling.
As many as 20 large drones were seen flying in formation over the port of Køge before vanishing rapidly into the bay.
The port had previously been Denmark’s main departure point for troops and equipment sent to NATO’s Enhanced Forward Presence in eastern Europe.
How have sabotage operations worked?
UK counter-terrorism police say Russia has used proxies to carry out attacks, creating another layer of deniability between the Kremlin and the operation itself.
Last October, Dylan Earl, 24, and Jake Reeves, 21, received combined prison sentences of 29 years for an arson attack on a Ukrainian-owned business in east London. The March 2024 blaze caused €1.16 million in damage.
Two men, who police found were working for the Wagner Group, were found guilty of an arson attack on a Ukranian-owned business in London in 2024 (Photo: London Fire Brigade)
Investigators found that the two men had contacted the Russian mercenary organisation Wagner Group through Telegram. The organisation paid them to carry out the attack and prepare further operations.
Commander Dominic Murphy, head of Counter Terrorism Policing London, said: “This case is a clear example of an organisation linked to the Russian state using ‘proxies’ — in this case British men — to carry out very serious criminal activity in this country on their behalf.”
Authorities suspect that many other acts of sabotage across Europe may also have been carried out by local proxies recruited through intermediaries.
How long has Russia been operating a hybrid warfare doctrine?
There is no consensus among experts over when Moscow formally embraced the concept of hybrid warfare.
In 2019, Nicole Ng of Carnegie’s Russia and Eurasia Programme and Eugene Rumer, a former US national intelligence officer, traced its origins to 1996, when Yevgeny Primakov became foreign minister after serving as director of Russia’s foreign intelligence service.
In the years after the Soviet Union collapsed, Russia had sought a degree of accommodation with the West. Primakov, however, argued that a unipolar international system dominated by the United States was unacceptable.
“He envisioned a multipolar world managed by a concert of major powers, with Russia as an indispensable actor with a vote and veto on key issues.
“Securing Russia’s primacy in the post-Soviet space and opposing NATO enlargement were also crucial to Primakov’s vision.”
That outlook also aligned with the instincts of Vladimir Putin, the former Soviet intelligence officer in East Germany who became president of the Russian Federation in January 2000.
At the Munich Security Conference in 2007, Mr Putin launched a fierce attack on the idea of a unipolar world, saying it was not only unacceptable but “impossible in today’s world”.
A year later, Russia invaded Georgia.
In February 2013, General Valery Gerasimov, Russia’s chief of staff, published a 2,000-word article in an obscure military journal titled “The Value of Science Is in the Foresight”.
General Gerasimov combined Soviet-era methods with a modern theory of warfare designed to undermine an adversary’s society without requiring a direct assault.
Russian Chief of the General Staff Valery Gerasimov presented a new theory of modern warfare
“The very ‘rules of war’ have changed,” he wrote.
“The role of non-military means of achieving political and strategic goals has grown, and, in many cases, they have exceeded the power of force of weapons in their effectiveness.
“All this is supplemented by military means of a concealed character.”
A year later, Russia invaded and annexed Crimea. The operation had many characteristics of hybrid warfare: Mr Putin denied that Russian troops were present on the peninsula, referring to them as “little green men”, and acknowledged their involvement only after the operation had succeeded militarily.
Senior intelligence officials say there is little doubt that Russia is now waging a hybrid war against Europe.
“We are in the middle of a hybrid war,” former BND vice-president Ole Diehl told a podcast produced by the German Council on Foreign Relations.
“Russia has not declared this war, but Russia is leading this war against us. The Russians say so quite clearly, they openly declare that there is no difference between a conventional military war, and a hybrid war.
“Russia wants to destabilise our society, to stop our support for Ukraine, it wants to increase its influence not just in the former Soviet republics and Warsaw Pact countries, but also its influence on us, on Europe.
“This hybrid war requires that we think differently about what the Russians are doing and what we are doing in response.”
What is Europe doing in response?
Hybrid warfare has a major advantage for the aggressor: conventional defence and deterrence systems are often designed for a different kind of threat.
Because the campaign can take many forms — from drone incursions and sabotage to assassinations, online disinformation and electoral interference — governments face an unusually broad range of challenges.
That makes a coordinated response difficult.
Critics argue that if the Kremlin is conducting these operations through a coherent strategy, Europe must respond with the same degree of coordination.
British forces intercepted a sanctioned oil tanker belonging to Russia’s shadow fleet in the English Channel earlier this year
In March this year, EU leaders agreed to strengthen Europe’s ability to confront hybrid threats.
They pointed to a broad range of measures, including the new Hybrid Toolbox; the Critical Entities Resilience (CER) directives; the Cyber Diplomacy Toolbox; the Digital Services Act; the Foreign Information Manipulation and Interference (FIMI) framework; and the European Democracy Shield, led by Irish commissioner Michael McGrath. Other strategies cover maritime security, airspace, cyber threats, critical infrastructure, artificial intelligence and quantum technologies.
“It is about organising [the response] around a clearer theory of how vulnerabilities interact in the same operating environment,” argued Raluca Csernatoni and Alicia Wanless of Carnegie Europe.
“What is missing is a strategic vision matched by an operational logic that can make sense of and connect infrastructural disruptions, technological dependencies, information manipulation, and practices of economic coercion as disturbances in the same wider ecosystem.”
EU intelligence services face their own structural obstacles, including major differences in how member states respond to threats.
When an officer with Germany’s BND receives intelligence about a possible sabotage operation, the information can be sent only in a classified report to the Chancellery and other government departments.
In France, by contrast, agents are expected to take action immediately.
“In the future, this will be the BND’s job,” said former BND vice-president Ole Diehl.
On drone threats, the IISS report said: “Europe’s… air-defence and civil-aviation radar infrastructure was designed for a different era and was focused on fast, high-altitude aircraft operating in known corridors, cooperating with aviation and surveillance systems that depended on electronic self-identification”.
Kaja Kallas said the Leipzig attacks had ‘all the hallmarks of state-sponsored terrorism’
Drones present a different challenge. They fly at low altitude without broadcasting their identity or location, and may be launched from vessels in international waters rather than entering from across a land border.
That allows drone operations to test national air defences while forcing governments to deploy highly costly fighter aircraft or missile-based interceptors.
Last year, the European Commission proposed a European Drone Defence Initiative (EDDI), envisaging a continent-wide, 360-degree counter-drone network with an initial operational capability due by the end of this year.
The European Parliament has warned that intercepting drones can be prohibitively expensive and that the technology could be outdated by the time the system is funded, built and tested.
For now, responsibility remains fragmented. Each EU member state has its own rules governing who may shoot down a drone — whether military personnel or police — and under what circumstances.
Ireland’s response
Ireland is considered especially exposed, both because of the danger posed to vulnerable undersea cables and because roughly 30% of EU data is hosted in the State by US technology companies headquartered there.
The National Cybersecurity Strategy, first published in 2015, was updated in 2019.
It acknowledged Ireland’s dependence on globally connected technology networks, which create “a complex and evolving set of risks”, including “deliberate actions by organised groups, including nation states, seeking to subvert or compromise these systems”.
Taoiseach Micheál Martin has been more explicit about the Russian hybrid threat
Although Russia was not named, concern about Moscow’s interference in the 2016 US presidential election — carried out through the Internet Research Agency in St Petersburg, which was linked to Wagner Group founder Yevgeny Prigozhin — was already widespread in Europe.
Russia’s full-scale invasion of Ukraine sharply increased the Government’s focus on hybrid threats, including cyber attacks, disinformation, interference in elections and the vulnerability of maritime infrastructure.
Two weeks before the invasion, Russia had planned naval exercises inside Ireland’s Exclusive Economic Zone (EEZ), before agreeing to move them beyond the zone.
The 2022 report of the Commission on the Defence Forces warned of a “continued blurring of the lines between internal and external security, accelerated by the increased use of hybrid forms of aggression against Western democracies”.
Following the Taoiseach’s Consultative Forum on International Security Policy, its chair, Professor Dame Louise Richardson, concluded: “Russian military manoeuvres within Ireland’s Economic Exclusion Zone (EEZ) shortly before the invasion of Ukraine also laid bare our vulnerabilities.
“Ireland’s EEZ is host to fibre optic cables that carry 97% of global communications, while three-quarters of Ireland’s natural gas is imported via pipeline.
“In all, Ireland’s territorial waters and EEZ are almost seven times the size of our land area. This area is of critical strategic importance and is vulnerable to attack.
“It has also become clear that deliberate foreign disinformation campaigns can also impair a country’s ability to respond quickly and effectively to threats.”
Protesters gathered to celebrate the closure of the Russian House for Science and Culture in Berlin following the Leipzig incident
Within two years, Government warnings about undersea cables and the need to strengthen national defences had become more urgent.
Without naming Russia, the 2024 Defence Policy Review referred to “the increase in suspicious activity by foreign militaries in Ireland’s Exclusive Economic Zone (EEZ)”.
“The security of undersea fibre optic cables, which represent vital but vulnerable components of the international communications infrastructure are a particularly important feature in this regard,” the review said.
When the Ministerial Council on National Security was established in March 2025, Taoiseach Micheál Martin spoke more directly about the Russian hybrid threat and said it would be addressed across government departments.
“We are facing new cyber and hybrid threats, as well as an ongoing bloody and immoral invasion by Russia of Ukraine, which poses an existential threat to EU member states,” Mr Martin said.
On 1 December last year, four military-grade drones were tracked loitering above the naval vessel LÉ William Butler Yeats as it patrolled the Irish Sea before moving towards the east coast.
The crew chose not to open fire because of the danger to civilians. But the drones were on or near the flight path of the aircraft carrying Ukrainian President Volodymyr Zelenskyy to Dublin for his first official visit, making the incident potentially the most serious suspected targeting of Ireland to date.
Experts expect the hybrid campaign to intensify.
“The Kremlin is aware of Russia’s diminished military status as its war in Ukraine fails to achieve meaningful strategic goals,” said Michael Newton of the Centre for European Policy Analysis (CEPA).
“Planned confrontation in the West through instigated shadow war crises, and a paralysed response, remains one of its remaining options to achieve its objectives.”
