These days, barely a week goes by in Europe without a drone sighting, a fire or a power outage being blamed on Russia. We’re told that these incidents are all part of a relentless, and escalating, “hybrid war” that Moscow is waging against the continent.
Tensions escalated dramatically last month after Germany formally attributed to Moscow a “failed” drone attack on Leipzig/Halle airport. But does the evidence support Western claims that Russia is engaged in a systematic hybrid war against Europe?
Various datasets and reports are regularly cited as evidence, including from Leiden University, the Soufan Center, the Associated Press and defense-related think tanks like the IISS, CSIS and GLOBSEC. Taken individually, each paints a bleak picture. Read side by side, however, they tell a very different story. For starters, the numbers don’t add up: depending on the report, Russia has launched between 52 and 255 hybrid attacks in Europe since February 2022, a fivefold discrepancy for what is supposed to be the same campaign.
The reason is that there is no agreed-upon definition of what a hybrid attack even is. The IISS itself admits that the term is “amorphous.” Some reports only count acts of physical sabotage; others include pro-Kremlin stickers, graffiti, peace demonstrations and even the Russian Navy passing through the English Channel. In other words, it is a concept that can be used to include almost anything. Moreover, in most cases, the evidence linking Russia is very weak or, in fact, non-existent. Evidence of Russian responsibility usually consists of news articles reporting that Western officials suspect so. If a government claims “Russia did it,” the case ends up on the list.
Yet many of the most widely publicised cases of alleged Russian sabotage — the “jamming” of the GPS signal of von der Leyen’s plane, the Baltic cable incidents in late 2024, a crashed DHL cargo plane, a fire at Heathrow Airport in 2025 — ended up collapsing upon basic scrutiny. In each case, Russian involvement was ultimately ruled out. The signal of von der Leyen’s plane, it turned out, was never lost. The Baltic cables were damaged by anchors dragged by Chinese- and Hong Kong-flagged ships, with investigators finding no evidence of intent. The DHL crash in Vilnius was caused by pilot error, and the Heathrow fire by a fault in a substation that had been identified years earlier but never fixed.But how many people actually know this, considering that such retractions generally receive a fraction of the coverage of the original allegations?
The same goes for the drone panic that swept Europe in the fall of 2025, when near-daily sightings caused the closure of several airports across the continent. Leaders openly blamed Moscow, yet virtually all the “Russian drone” sightings turned out to be unfounded: a Dutch investigation of some 60 incidents found “much panic and hardly any evidence of Russian involvement,” with many sightings turning out to be hobby drones, planes, helicopters, satellites or even stars.
Where Russian drones have indeed entered NATO airspace — in Poland, Romania, Moldova and Lithuania — this has almost always occurred near the Ukrainian border, during attacks on Ukrainian targets. Even the Lithuanian president has stated that the latest such incident was likely caused by a drone that veered off course because of Ukrainian jamming. This appears much more like fallout from the war next door than a deliberate campaign of incursions. There was one incident where a Russian drone was shot down deep in Polish territory, but even in this case Western intelligence officials “privately” admitted that the Russian incursion was probably not intentional.
And then there’s the Leipzig/Halle case. Following Germany’s official accusation of Russian involvement, NATO’s Secretary General Mark Rutte was quick to declare that “the evidence is clear.” This may very well be true, but since no evidence has actually been made public, we simply have to take the German authorities’ word for it. As a German professor told EUobserver, the attribution “may be plausible, but there is evidently no proof.”
Ultimately, once all the speculative and unproven “incidents” are set aside, what remains are a handful of demonstrable sabotage cases that have led to convictions, from a warehouse arson in London to torched buses in Prague,an IKEA fire in Vilnius and some GPS-tracker parcels sent toward Ukraine, allegedly to scout targets and transport routes for sabotage. Even in these cases, however, the courts have convicted low-level recruits, often contacted by anonymous handles on Telegram, and a connection to the Russian state or its proxies was established at a contested trial in only a handful of cases — notably the London warehouse fire and the GPS-tracker parcels in Germany — while elsewhere it rested on guilty pleas or closed hearings. But even assuming that Russia is indeed behind all these cases, the picture that emerges is one of few sporadic incidents with limited damage — hardly the “war” that European leaders routinely invoke.
So is this just a case of collective panic fuelled by click-addicted media? Or, given that the claims of a Russian “hybrid war” against Europe appear to rest on little more than propaganda, is there a concerted effort by the European Union-NATO establishment to condition citizens to believe that Europe is under attack from Russia?
The narrative clearly serves a variety of interests. For starters, it helps governments maintain support for an increasingly unpopular war in Ukraine and for a continental rearmament campaign that will require painful cuts to spending on other sectors. As a report by the Latvian Institute of International Affairs put it, the “nebulous tagline” of hybrid warfare would appear to be driven “by the need to goose flagging defense budgets and waning NATO cohesion.” It has worked: the drone panic has led to increased counter-drone spending at both the EU and NATO levels. Meanwhile, intelligence services have invoked the threat of sabotage to gain broader powers.
The specter of “Russian interference” also offers a broader authoritarian dividend, justifying everything from online censorship to the repression of dissent to election management — most egregiously in Romania, where an entire election was annulled because of an alleged Russian disinformation campaign for which no evidence of Russian involvement was ever provided. More recently, British Prime Minister Andy Burnham, amid a push for greater EU ties, said it was “clear” that Russia interfered in the Brexit referendum, without providing any evidence, even though several investigations have found little or no evidence to support this claim.
One may conclude that, to the extent that a “hybrid war” is being waged against Europe, it is being waged by the EU-NATO establishment itself against its own population, in the form of a prolonged campaign of psychological warfare aimed at inflating the Russian threat.
What is most concerning is the risk that this becomes a self-fulfilling prophecy. NATO countries continue to enable — through intelligence, satellite and targeting support — Ukrainian deep strikes on Russia, including on civilian infrastructure, and each attack makes Russian retaliation against NATO territory more likely. If and when such an attack comes, it would be framed as an unprovoked escalation of Russia’s ongoing “hybrid war,” leaving little room for European restraint.
This is a classic security dilemma. In such a climate, it would take very little for a “hybrid war” that so far largely exists only on paper to rapidly evolve into a hot war between nuclear-armed powers.
In Italy, the expression “strategy of tension” evokes a dark period, from the late 60s to the early 80s, in which intelligence services and secret paramilitary networks operating under NATO auspices inflated the terrorist threat to frighten the electorate, including by engaging in terrorist acts that in some cases were then blamed on the left. European leaders should be wary of reviving such a strategy.
This article draws on an in-depth investigation published on the author’s Substack.