In recent months the security landscape of the continent has been reshaped by a surge of covert actions that stop short of open war. The Kremlin appears to be probing the resolve of the North Atlantic Treaty Organization by deploying a mix of drone incursions, sabotage of critical sites, and sophisticated cyberattack campaigns. While none of the incidents has yet crossed the threshold that would trigger a full-scale conventional response, the frequency and boldness of the operations have pushed European capitals into a state of heightened alert.
Analysts point to a series of high-profile events that illustrate the new level of aggression. In early September a Russian-laden drone was intercepted near a German airport where a Ukrainian cargo plane was slated to land, prompting Berlin to freeze diplomatic contacts with Moscow. Simultaneously, Estonia reported a suspected sabotage attempt on a drone-manufacturing plant, Poland saw a railway line near the Ukrainian border damaged by an unmanned aerial vehicle, and Germany’s power grid suffered unexplained disruptions that officials attribute to hostile actors. These episodes, many of which lack definitive attribution, have created a climate of uncertainty that blurs the line between espionage and outright hostility.
Political fallout and NATO’s strategic calculus
The pattern of attacks is forcing NATO members to reconsider how they interpret hybrid warfare—operations that combine kinetic and non-kinetic tools while maintaining plausible deniability. The Danish Defence Intelligence Service warned that Moscow could soon move from “low-intensity” sabotage to a “limited military strike” against one or more NATO states bordering Russia. At the same time, senior U.S. officials have signaled concern that the war in Ukraine could “metastasize” through such covert means, while also grappling with competing priorities in other regions. Polish Prime Minister Donald Tusk warned that the Kremlin may stage “accidental” drone and missile strikes to test the alliance’s response, a scenario that would place the collective defence clause Article 5 under unprecedented strain.
Intelligence alerts to southern European allies
In the wake of the German incident, intelligence services in Spain, France and Italy received warnings that Russia is developing the capability to launch long-range drones from merchant vessels operating in the Mediterranean. The alerts, which originated from U.S. agencies, describe the potential use of civilian-masked aerial platforms that could strike strategic targets while preserving a veneer of deniability. Both French President Emmanuel Macron and Italian Defence Minister Guido Crosetto publicly downplayed the immediacy of the threat, yet the European Commission acknowledged that repeated violations of airspace and a string of sabotage events signal a broader strategic intent from Moscow.
National preparedness and defensive postures
Countries on NATO’s eastern flank have begun concrete preparations. Lithuania announced evacuation plans for vulnerable populations and lifted a longstanding prohibition on the deployment of nuclear weapons on its soil. Finland urged citizens to adopt a “mental readiness” mindset against possible sabotage, while France unveiled a comprehensive protection plan for critical infrastructure and the defence industry. These measures underscore a growing consensus that the hybrid threat, though ambiguous, carries real risks for civilian safety and economic stability across the continent.
With the United States weighing a reduction of its forward presence, Moscow appears to be counting on a fractured alliance and a hesitancy to invoke collective defence. As the pattern of drone incursions, sabotage, and cyber intrusion continues, European leaders must balance deterrence with restraint, lest the “fire-starter” tactics ignite a broader confrontation.
