'No longer hybrid' — As Russian sabotage grows bolder, Europe lacks red lines

Moscow's shadow war on Europe has intensified, with Russia's actions becoming bolder and more direct. Germany recently discovered explosives-laden drones at Leipzig Airport, believed to be Moscow-backed. Russian drone incursions into NATO airspace are regular occurrences, and a Russian warship even flashed flares at a Danish military helicopter. Western leaders have begun to describe this campaign as no longer merely hybrid, but an outright threat.

For the first time, Berlin labeled Russia as the perpetrator of a physical attack on its infrastructure, prompting allies to become more willing to take action against the shadow fleet ships and downed drones. However, Europe still lacks a clear strategy to deter Moscow's escalating campaign.

So far, the response has varied from symbolic measures like closing Russian cultural and diplomatic centers to imposing fresh sanctions and supplying arms to Ukraine. Analysts argue that Europe must toughen up its approach, with some calling for innovative retaliatory methods to catch the Kremlin off guard.

Edward Lucas, a British journalist, security analyst, and head of the Baltic International Security Center (BISC), suggests that Europe must make Russia realize the consequences of their actions. The escalating hybrid warfare from cyberattacks, GPS jamming, disinformation campaigns, and election meddling has become routine for NATO countries since the full-scale war began. Russia has intensified its operations, with suspected proxies causing fires, cutting cables, and launching drones at strategic targets across Europe.

The number of hybrid attack incidents has quadrupled between 2023 and 2024, with 151 recorded between the start of the full-scale invasion and March 2026. This slow and weak response from Europe allows Russia to continue testing its limits and probing the willingness of its allies to respond.

Polish Prime Minister Donald Tusk warned that Russia might launch further physical and drone strikes into NATO territory to demonstrate that Article 5 is more theoretical than practical. Security experts refer to this gap in European defense as the "deterrence gap" - the gap between current response capabilities and a full-scale military response against Russia.

European nations often struggle to find solid evidence to publicly blame Russia, as the country frequently uses proxies, such as vulnerable Ukrainian and Belarusian refugees recruited through Telegram messaging apps. However, some experts believe that delays in response are a deliberate tactic to avoid costly measures and prevent panic.

NATO has stated that a hybrid attack can trigger Article 5, but the alliance has not defined the specific red line that triggers this response. This ambiguity may leave European politicians unsure about where the line is drawn. Furthermore, NATO members may be reluctant to invoke Article 5 during a period of internal divisions, as a weak or absent response could undermine the alliance's credibility.

The U.S. under the Trump administration has shifted away from Europe, while Slovak Prime Minister Robert Fico recently stated that his country would not be drawn into a war due to Article 5. German officials noted that it is no coincidence that fresh instances of sabotage in Germany occurred shortly before regional elections, where far-right, Kremlin-friendly Alternative for Germany (AfD) party gained significant support.

Experts believe that Europe should respond more aggressively to deter Russia from repeating its tactics. Countering the impacts of the attacks, identifying the perpetrators, and deterring further aggression are the three key steps in responding to a Russian hybrid attack. Europe should aim to "blindside" the Kremlin by the scale and scope of its responses, as well as bolster protection of maritime infrastructure and detain suspected Russian shadow fleet vessels.