Last Monday, the German government held Russia responsible for the entry of three drones at Leipzig airport, which occurred in early August. It is one of the latest cases in which the Kremlin would be trying to destabilize European countries that support Ukraine: since the beginning of the invasion in February 2022, the Armed Conflict Location & Event Data Project (ACLED) has recorded at least 150 incidents including sabotage, cyberattacks, or drone attacks.
In many cases, experts talk about “hybrid warfare”: a strategy that combines military intimidation with sabotage, cyberattacks, disinformation, and economic pressure to weaken the adversary without the need for open confrontation. These actions do not seek to cause civilian casualties but to erode the European environment that supports Ukraine. Their targets are critical infrastructures — such as water facilities, power plants, submarine cables, and telecommunications networks — as well as the logistical chains that transport weapons and supplies to the front.
According to ACLED, September 2025 saw the highest number of actions since the start of the war (23), and after a sustained decline, until August 2026, incidents allegedly carried out by Russia maintain an average higher than in previous years.
Many of the incidents are still under investigation: attributing an explosion or a drone crash directly to Russia is complicated, and therefore, there are discrepancies about the actual Russian activity among organizations dedicated to monitoring this hybrid war. Even an organization experienced in analyzing these episodes, such as ACLED, tries not to assert that such an action is related to Russia until sufficient evidence is gathered.
Despite this, most public databases show an increase in the use of hybrid warfare as a complement to frontline actions. Russian pressure on Europe has become more visible and physical: at the beginning of the invasion, espionage, influence, and covert operations predominated, representing half of the records in 2022. In 2025, almost 50% corresponded to physical attacks or impacts, and in 2026, territorial incursions or violations do. The strategy has shifted towards airspace, borders, and European infrastructures, although not all these episodes can be considered deliberate attacks against European territory.
The countries most affected by this type of action are Poland and Romania. Together, they concentrate around 62% of the cases recorded by ACLED since the beginning of the war. This concentration is due to their geographical position.
Poland is the main affected country. It is acting as a corridor for military aid to Ukraine and has suffered at least 40 incidents with documented Russian influence (and another 8 suspected). Just a week ago, on August 31, a fire destroyed the WB Electronics facility, the main private Polish drone manufacturer and a key supplier to Ukraine: Prime Minister Donald Tusk pointed to sabotage and blamed the Kremlin.
This is not the first sabotage attempt the country has suffered. Two years ago, on May 11, 2024, Daniil B., a 20-year-old Ukrainian, received instructions via Telegram to place explosives in the Marywilska 44 shopping center, north of Warsaw. Nearly 80,000 square meters burned. Three days earlier, the same cell had used a similar method in an Ikea in Vilnius.
Cyberattacks also play a relevant, though almost invisible, role, accounting for 12% of all cases recorded by ACLED. One of them occurred at the end of 2025, when the Sandworm group, linked to Russian military intelligence (GRU), penetrated the system of a Polish power plant using a SIM card connected to a private network.
Read more Morocco, emboldened: Mohammed VI grows stronger thanks to the support of Trump (and Israel)
Planes, drones, and cables
The conflict between Russia and Ukraine has allowed testing and perfecting the use of drones to attack targets. These devices are not only used on the front but are a cheap and effective tool to penetrate the airspace of other countries without compromising the integrity of their own troops.
According to data from the Ukrainian think tank SahaSec, air incidents attributed to Russia in European countries have steadily increased. In the first eight months of 2026, there were already 65, a figure much higher than any previous year.
Since the beginning of the war, the monthly average was less than three such episodes. But in September 2025, the incursion of more than a dozen Russian drones that penetrated Polish airspace caused an increase. The Polish Armed Forces and allied country planes intercepted them, and only a few managed to impact, causing only material damage.
In the following months, the frequency of these episodes decreased, but since April 2026 the trend has risen again, mainly driven by the increase in flights and interceptions of Russian military planes in the Baltic and drone incursions in Romania. Between July 24 and 27, the country recorded four consecutive incursions: three drones were shot down and a fourth crossed the airspace without being intercepted.
The Baltic Sea is another vulnerable area for neighboring countries. According to Windward, between February 2024 and February 2025, 2,313 vessels linked to Russia navigated its waters, although only 19% flew the Russian flag. These ships are used to sabotage gas pipelines or submarine cables, or as drone launch platforms.
One of the most notable cases occurred when Finland intercepted the vessel Fitburg, coming from Saint Petersburg, after it allegedly damaged two telecommunications cables between Finland and Estonia. Police initially detained two crew members and found sanctioned Russian steel in the hold.
Disinformation
Hybrid operations do not always cause physical damage. They also seek to destabilize countries by influencing public opinion and weakening trust in institutions. In 2025, the European External Action Service detected 540 incidents of foreign information manipulation. 29% were attributed to Russia, while 65% had no apparent authorship, although they showed connections with the Kremlin and China. These incidents mobilized thousands of channels and contents, allowing messages to be replicated and amplified across many platforms.
Ukraine was the main target of these Russian campaigns. 177 accounts or channels attributed to Russia had Ukraine among their target countries, according to investigations by the EUvsDESINFO project. These data do not represent attacks but the number of Russian assets dedicated to each country. The same account can target several countries and adapt its messages depending on the recipient and context.
Read more Tamales and tomatoes
