Russia's campaign against Europe escalates beyond hybrid terminology

The phrase "hybrid war" has served European capitals well since 2022. It describes a threat serious enough to justify sanctions, diplomatic expulsions and increased defence spending, yet vague enough to avoid the legal and political consequences of acknowledging armed conflict. That utility is wearing thin. In the space of a single week in August 2026, German investigators uncovered a third drone carrying explosives near Leipzig airport, a naval drone was shot down approaching a gas platform in the Black Sea, and details emerged of an assassination plot against Armin Papperger, chief executive of Rheinmetall. The pattern is no longer deniable. The question is whether the vocabulary used to describe it still matches reality.

A week of escalation

The Leipzig airport investigation began in early August when German security services detected unusual drone activity. By 20 August, investigators had recovered three unmanned aerial vehicles and explosive devices they believe were staged for a coordinated attack on the airport's logistics hub, a key node for military aid transiting to Ukraine. Chancellor Friedrich Merz addressed the Bundestag on 21 August, stating Germany faced "very real threats" amid "increased scrutiny from hybrid attackers." Two days later, a Ukrainian naval drone targeting a Russian Black Sea Fleet vessel was intercepted near the Boyko Towers gas platform, operated by a Romanian-Ukrainian consortium. The platform supplies gas to both Moldova and Romania. On 24 August, German prosecutors unsealed an indictment detailing a Russian GRU operation to assassinate Papperger, whose company produces the Leopard 2 tank and artillery ammunition critical to Ukraine's defence. The suspects, two Russian nationals and a German citizen, were arrested in Cologne and Bavaria.

These events followed the assassination of Semyon Skrepetsky, a Russian-born artist and vocal critic of Vladimir Putin, in Warsaw on 12 June. Polish authorities attributed the killing to Russian intelligence. In December 2025, a cyber operation brought Poland's national grid within minutes of total collapse, according to Pawel Wieczynski, chief executive of Warsaw-based defence technology firm DataWalk. "Last December, they almost shut down the whole of our country's energy grid. We were minutes away from having no electricity in our country," he said. Poland's National Cyber Security Centre confirmed a "sustained, state-sponsored campaign" against energy infrastructure but declined to attribute it publicly.

The terminology trap

The term "hybrid warfare" entered Western strategic discourse through a 2007 paper by Frank Hoffman, then a Pentagon analyst, though its intellectual lineage is disputed. The European Commission defines it as "the mixture of coercive and subversive activity, conventional and unconventional methods (i.e. diplomatic, military, economic, technological) which can be used in a coordinated manner by state or non-state actors to achieve specific objectives while remaining below the threshold of formally declared warfare." That threshold, the line between hybrid operations and armed attack, is where the political utility lies. A senior EU official, speaking on condition of anonymity, told reporters: "We can say very clearly the European services do not see any risk of attack on European countries." The same official acknowledged that "hybrid threats" and "hybrid warfare" are used precisely because they describe actions "that fall short of direct attacks on European military or civilian targets." The formulation allows the EU and NATO to respond with counter-measures, expulsions, sanctions, infrastructure protection, without invoking Article 5 of the North Atlantic Treaty or the EU's mutual defence clause under Article 42.7 of the Treaty on European Union.

There is an economic dimension. Insurance markets treat "war" and "hybrid operations" differently. A formal determination of armed conflict would trigger war-risk exclusions in commercial policies, spike premiums for shipping, aviation and energy infrastructure, and potentially trigger force majeure clauses in long-term contracts. One EU official estimated that reclassifying the current threat level could increase insurance costs for Baltic Sea energy infrastructure by 300 to 400 percent. The official spoke anonymously because the assessment has not been published. The European Insurance and Occupational Pensions Authority (EIOPA) has not updated its war-risk guidance since 2022.

NATO's calibrated response

NATO has not been passive. Since 2023, the alliance has expelled more than 600 Russian diplomats and intelligence officers declared persona non grata across member states. In April 2024, NATO launched Operation Baltic Sentry, deploying frigates, maritime patrol aircraft and underwater surveillance assets to protect undersea cables and pipelines after the severing of the Estonia-Finland gas connector and several telecommunications cables. James Appathurai, NATO's deputy assistant secretary-general for innovation, hybrid and cyber, defended the alliance's vocabulary. "We tend to use the term 'hybrid actions' because we are well beyond just threats, as we can see from the range of cyber attacks, sabotage and drone incursions," he said. "We respond to these hostile acts, for example when allies coordinated the expulsion of Russian 'diplomats' and when we deployed military assets into the Baltic Sea to deter damage to undersea infrastructure." NATO's 2024 Washington summit declaration described Russia's activities as "a pattern of hostile hybrid operations" but stopped short of calling them armed attacks.

The alliance's restraint is deliberate. Article 5 requires a consensus that an armed attack has occurred. The North Atlantic Council has not made that determination. Some allies, particularly the Baltic states and Poland, have argued privately that the threshold was crossed in 2024. Germany, France and the United States have resisted, fearing escalation and the loss of diplomatic off-ramps. The CIA director's visit to Moscow in late August, the first by a US intelligence chief since 2021, was framed by the White House as "strategic deconfliction." John Ratcliffe delivered a private message to his Russian counterpart, Sergei Naryshkin, that any lethal attack on NATO territory would trigger a "proportionate and consequential" response. The Kremlin acknowledged the meeting but denied involvement in European sabotage.

Industry on the front line

European defence executives have become targets. Camille Grand, who served as NATO's assistant secretary-general for defence investment from 2016 to 2022 before moving to the European Aerospace, Security and Defense Industries Association, described a mood shift among his members. "My CEOs have all increased their personal security details in recent months," he said, citing threats against Papperger and Micael Johansson, chief executive of Sweden's Saab. Grand drew a direct parallel with the evolution of Western military aid to Ukraine. "We started by sending helmets and sleeping bags, and we ended up with long-range missiles. It's a method of boiling the frog." The metaphor, a frog placed in slowly heating water fails to perceive the danger, captures his assessment of both Western escalation management and Russian probing. "What we found shocking yesterday becomes the norm tomorrow, and so on until you find yourself in a much more intense situation. They are testing the limits."

The critics' case

Critics argue the hybrid label has become a comfort blanket. Wieczynski, whose firm provides analytics to Polish security services, rejects the terminology outright. "We should be simply talking about a conflict," he said. "How can you say you are not in a conflict if a foreign nation is killing citizens, blowing up its rail tracks?" He referenced the Skrepetsky assassination and a December 2025 derailment in southern Poland caused by explosives on a freight line carrying military equipment to Ukraine. Polish prosecutors charged three men with links to Russian intelligence. "There's a massive amount of cyberattacks: Poland is the most cybernetically attacked country in Europe," Wieczynski added. The Polish government's 2025 cyber security report recorded 12,400 incidents against critical infrastructure, a 47 percent increase on 2024, with 68 percent attributed to state-aligned actors.

Grand agrees the language obscures more than it clarifies. "We are indeed in a hybrid war which is no longer all that 'hybrid' anymore," he said. The distinction matters because it shapes public understanding and political will. If the threat is "hybrid," it can be managed by intelligence agencies, cyber commands and police cooperation. If it is war, it demands military readiness, civil defence, and a societal mobilisation that no European government has yet asked for. The German government's 2024 defence policy guidelines, updated in June 2026, still refer to "hybrid threats" as a category distinct from "armed attack." The French strategic review published in January 2026 uses similar language.

Intelligence assessments diverge

The gap between public language and classified assessment is widening. The EU official's statement that "European services do not see any risk of attack on European countries" contradicts the view of several national intelligence agencies. Germany's Bundesnachrichtendienst (BND), in its 2026 annual threat assessment leaked to Der Spiegel in July, judged that "Russia is preparing capabilities for direct kinetic strikes on NATO territory in the event of a wider conflict." The BND did not assess such strikes as imminent. Poland's Internal Security Agency (ABW) and Sweden's Säpo have issued similar classified warnings. The discrepancy reflects a genuine analytical dispute: whether Russia's current operations are preparation for war or a substitute for it. The GRU's Unit 29155, implicated in the 2018 Salisbury poisoning, the 2020 Czech ammunition depot explosion, and now the Papperger plot, has a history of operations that blur the line.

The CIA's assessment, briefed to the Senate Intelligence Committee in closed session on 15 August, reportedly concludes that Russia has "crossed the Rubicon" in its willingness to conduct lethal operations on NATO soil but retains "escalation control", the ability to calibrate violence below the threshold that would compel a collective military response. Ratcliffe's Moscow visit was partly intended to signal that the US believes it can detect and attribute such operations. Whether the Kremlin believes that deterrence holds is the unanswered question.

The economic calculus

European leaders' reluctance to reclassify the threat is not purely semantic. The European Central Bank's financial stability review in May 2026 noted that "geopolitical risk premia" in European corporate bonds have risen 85 basis points since 2022, but a formal war designation could add another 150 to 200 basis points. For highly leveraged sectors, commercial real estate, renewable energy project finance, airline fleets, that difference determines solvency. The European Commission's 2026 stress test for insurers included a "hybrid escalation" scenario but not a "state-on-state conflict" scenario. EIOPA's chair, Petra Hielkema, told the European Parliament's economic affairs committee in June that "the current framework assumes a clear distinction between peacetime and wartime perils. The Russian campaign challenges that distinction."

Businesses are acting without waiting for governments. Rheinmetall has moved critical production lines for 155mm artillery shells from its Unterlüß facility in Lower Saxony to a new plant in Hungary, citing "security of supply chain." Saab has dispersed its Gripen fighter final assembly across Linköping and a newly hardened facility in Luleå, above the Arctic Circle. Both companies declined to comment on security costs. The European Defence Agency estimates that security hardening, physical protection, cyber resilience, personnel vetting, now adds 4 to 7 percent to major defence procurement programmes.

What the threshold protects

The hybrid label protects three things: political flexibility, insurance markets, and the illusion of peacetime. It allows governments to sanction, expel, harden and deter without answering the question that follows a declaration of armed attack: what military response is proportionate? NATO's Article 5 does not prescribe automatic retaliation; it obliges allies to take "such action as it deems necessary, including the use of armed force." That ambiguity is deliberate. But it also means that acknowledging an armed attack does not compel a specific military response, it compels a political decision. European leaders have so far decided that the cost of that decision exceeds the cost of absorbing the current level of violence.

The calculation may change. The Leipzig airport plot, if proven to be a GRU operation targeting a NATO logistics hub, would be the most direct Russian action against alliance infrastructure since the invasion of Ukraine. The Black Sea drone incident occurred near Romanian and Turkish waters, both NATO members. The Papperger plot targeted a German citizen on German soil. Each incident tests the collective willingness to maintain the fiction. The next NATO summit, scheduled for The Hague in June 2027, will confront a new strategic concept. Draft language seen by diplomats replaces "hybrid threats" with "sub-threshold aggression", a term that admits the aggression while preserving the threshold. Whether that semantic shift survives contact with heads of state and government remains the clearest indicator of where Europe actually stands.