Russia’s Hybrid War on Europe Escalated. Germany Says It Has the Evidence

Sep 02, 2026 15:54

10 min read

Prefer U24 Media on Google

Authors

Jess Daly

Reporter

Germany has officially blamed Russia for orchestrating the explosive-laden drone attack at Leipzig/Halle Airport.

"Taken together, police investigations, patterns of the crime and intelligence findings substantiate Russian responsibility for the attempted attack at Leipzig Airport," Interior Minister Dobrindt said on September 1.

"The means used, such as the drone configuration, components, explosives and detonation systems, are known to us from other hybrid operations by Russia and its war against Ukraine," Foreign Minister Johann Wadephul added, stating that the attack fit the pattern of a "long series of destabilization operations" against Europe.

Germany responded by ordering the closure of Russia’s Consulate General in Bonn, ending the agreement governing the Russian House in Berlin, tightening entry restrictions on Russian nationals, and pushing for further expansion of EU sanctions against Russian nationals. 

What happened at Leipzig/Halle airport? 

Days before Germany’s announcement, Chancellor Friedrich Merz had issued a warning. “The German government is putting a price on the authors of hybrid attacks. You will pay for it,” he said, adding that Germany had “moved into the crosshairs of hybrid attacks” and pointing to the drone incident at Leipzig/Halle Airport.

On August 4, a drone carrying what investigators described as “professional” explosives and a detonator was found near an aircraft operated by Ukraine’s state-owned Antonov Airlines that was preparing to transport military cargo to Ukraine. The drone had characteristics associated with devices used by Russia’s military intelligence agency, the GRU. Investigators believe a second drone struck another aircraft, causing minor damage.

Berlin describes Russia’s escalating hybrid pressure as a “new dimension of threats,” and it’s unfolding as Moscow simultaneously continues waging its war against Ukraine.

“Russia is intensifying its attacks, making them more and more brutal, including against the civilian population and infrastructure,” the German government said on August 24, adding that Russia is openly threatening the EU and NATO with hybrid attacks.

Germany is not alone in sounding the alarm. The European Parliament says hybrid threats against the EU have “increased significantly in both frequency and sophistication,” identifying Russia as the principal source of such activity, alongside threats from China and Belarus.

The difficulty lies partly in the range of tools that can be deployed at once. Hybrid warfare can combine sabotage and other covert operations with cyberattacks, disinformation, political and economic interference, and, in some cases, military pressure. Together, they can exploit vulnerabilities and destabilize societies while remaining below the threshold of conventional war.

But how did Europe get here? August offered a disturbing answer, as suspected Russian hybrid operations unfolded across the continent, with airports, defense factories, energy networks, and government systems as targets.

August: A surge of Russia’s hybrid threats across Europe 

Germany—explosive drones found at airports

Leipzig was not an isolated incident. Throughout August, drones appeared over military bases, airports and critical infrastructure across Germany, as investigators began piecing together what officials increasingly describe as a broader campaign. On the night of August 6–7, six drone flights were observed by the German military over a key Bundeswehr facility in Mechernich, Germany. The site houses an underground depot storing military equipment and spare parts, and is also home to Bundeswehr specialists responsible for maintaining and repairing Germany’s Patriot air defense systems. No official attribution has yet been made, but German police, the Military Counterintelligence Service, and Berlin’s Joint Drone Defense Center are investigating the incident. On August 11, another drone intrusion triggered repeated runway and airspace closures at Hanover-Langenhagen Airport, prompting German authorities to investigate a potential foreign state-sponsored attack.

Ten days after the drone was discovered at Leipzig/Halle Airport, investigators found another nearby, alongside around 50 grams of suspected military-grade explosive hexogen. An antenna and electronic components taped to a tree are being examined as a possible drone-control device, while scorched earth and metal fragments found nearby are being investigated as a potential blast site. 

Read more

Category

World

Russia’s Hybrid War Has Already Hit Britain. Hospitals, Businesses, and Infrastructure Are Paying the Price

Aug 25, 2026 11:11

Bulgaria—explosion at an ammunition plant

On August 10, explosions tore through warehouses at an EMCO ammunition plant in Belitsa, central Bulgaria, after a truck caught fire on the factory grounds, according to local authorities. EMCO is one of Bulgaria’s largest private defence contractors, producing Soviet- and NATO-standard ammunition, including artillery shells, rockets and mortar rounds. Pro-Russian groups are attributing the fire to a Russian partisan group called “Sympathisers”.

Norway—cyber attacks on critical government services

The pro-Russian hacker group Server Killers claimed responsibility for a distributed denial-of-service (DDoS) attack targeting the Norwegian Digitalisation Agency (Digdir), declaring “cyber war” on Norway over its renewed security cooperation with Ukraine. The attack disrupted multiple Norwegian government digital services for nearly three days and was the third—and largest—DDoS attack against Digdir’s services that summer.

Digdir’s shared digital services are used across Norway’s public sector. “It is serious when we experience that the solutions are not available or there are major operational disruptions,” Digdir director Frode Danielsen said.

Romania—Russian drones push deeper into NATO territory

On August 11, two Russian Gerbera-type drones, suspected of carrying explosive payloads, were discovered drifting in Romania’s Exclusive Economic Zone near the strategically important Neptun Deep gas project, Romania’s Ministry of National Defense Information and Public Relations Directorate reported. Romanian Navy EOD divers destroyed both in controlled detonations and recovered a separate drone fragment. Romanian authorities contacted Ukraine, which confirmed the drones did not belong to its forces. A Russian attack drone crashed in Romania’s Tulcea County near the border with Ukraine on August 14 after flying at an altitude too low to be detected by Romanian military radar systems.

On August 16, two Spanish F-18 fighter jets deployed to Romania as part of NATO’s air-policing mission intercepted and destroyed an unidentified drone near the Moldovan border, Romanian Defense Minister Radu Miruță confirmed. The jets were authorized to intervene at 04:44 after the drone was detected around 24 kilometers north of Galați, before destroying it between Băleni and Cudalbi. Romanian authorities have not yet confirmed the drone’s origin. 

On August 20, a Romanian F-16 fighter jet destroyed a maritime drone detected just a few hundred metres from the Neptun Deep gas project in the Black Sea, where several hundred people were working. Romania scrambled two F-16s after the Coast Guard spotted the vessel, which authorities initially said was carrying explosives. President Nicușor Dan blamed Russia for the incident, accusing Moscow of endangering critical infrastructure and personnel working at the platform.

Estonia—defense facility hit by suspected sabotage 

On the night of August 14 to 15, a fire tore through a building used by defence technology company Milrem Robotics in Tallinn, Estonia. Estonian authorities are investigating the Milrem Robotics arson as a possible act of sabotage, while Latvian security services have detained three suspects and opened proceedings on suspicion that they assisted a foreign state in activity directed against another country. Neither security service has yet publicly attributed the operation to Russia. 

Slovakia—arson attack on drone factory foiled

On August 25, Slovak authorities foiled a planned arson attack against the Skyeton drone factory near Prešov, which produces unmanned systems for Ukraine’s military. Police said the hired attackers had prepared a large quantity of an incendiary mixture identified as napalm, alongside tools, a camera and a hand-drawn plan of the attack. 

Around 70 employees could have been at the factory had the attack gone ahead, potentially causing tens of millions of dollars in damage. Three foreign nationals have been charged over the alleged plot—two were detained in Slovakia and a third in Germany. Authorities have not publicly identified who commissioned the attack. 

Poland —arson attack on defense industry

Around midnight on August 30–31, a figure in a balaclava scaled the perimeter fence of a WB Electronics facility in Skarżysko-Kamienna, Poland. CCTV captured the intruder entering the site shortly after a blaze began in the production facility, while investigators later found a backpack and a sweatshirt nearby.

The facility belongs to WB Group, Poland’s largest privately owned defense technology company, which produces drone components and systems used by both Poland and Ukraine. Poland’s Internal Security Agency (ABW) and Military Counterintelligence Service are now investigating whether the fire was an act of sabotage.

Could a hybrid attack trigger NATO's Article 5? 

The Leipzig investigation has become about far more than a drone at one German airport. It has become a test case for how Europe responds when a suspected Russian hybrid operation moves closer to the boundary between sabotage and armed attack.On September 1, EU foreign policy chief Kaja Kallas directly connected that question to the attack at Leipzig/Halle Airport in Germany. 

“The Russian security services have no limits to the means at their disposal,” Kallas said.

But the implications extend beyond attribution.Asked whether Leipzig represented an escalation potentially relevant to NATO’s Article 5, Kallas said that if an incident does not constitute a military attack, invoking Article 5 would not be appropriate. But if investigators uncover “something more serious, then, of course, we will convene and take a decision,” Kallas said.

The comments force Europe to confront a question that has long surrounded Russia’s hybrid operations: where does hybrid warfare end and armed attack begin?Under Article 5 of the North Atlantic Treaty, an armed attack against one or more NATO members is considered an attack against all of them. But an “armed attack” does not necessarily have to take the form of a conventional military strike.

NATO deliberately leaves the precise threshold undefined, avoiding giving an adversary a clear line beneath which it can operate without risking an alliance-wide response.

The challenge is that many hybrid operations inhabit this grey zone precisely. NATO has warned that significant cyberattacks and other hybrid operations, individually or cumulatively, could reach the level of an armed attack and potentially trigger Article 5.

Not every fire, drone, or cyberattack recorded across Europe this August has been traced to Moscow. Some may never be. But taken together, the pattern is increasingly difficult to ignore: defense factories targeted, explosives appearing at airports, critical infrastructure approached by drones, and government systems attacked. Hybrid warfare thrives in the space between suspicion and certainty, where attribution takes time, and disruption happens immediately. August has shown that for Europe, this confrontation is no longer approaching its borders. It is already inside them. 

Help Ukrainian Units Hold the Drone Line

Download APP