In recent weeks and months, discussions about Russia’s hybrid war on Europe have grown even louder. News cycles are dominated by reports from security and military officials about the latest incidents - many unexplained or cloaked in mystery.
European leaders understand such incidents are now more frequent in September, French President Emmanuel Macron declared “No one is safe,” convening an unprecedented meeting on Russia’s hybrid warfare against Ukraine’s allies, with presidential candidates and political parties in the Elysée Palace.
Against a background of rising geopolitical tensions and – in some cases – directly citing hybrid threats, some European governments have sent out emergency preparedness pamphlets or updated household readiness campaigns. “It’s a very serious situation,” Mikael Frisell, Director General of Swedish Civil Defence and Resilience Agency said to SVT reporters. “Russia has a strategy to destabilize our societies and focus on the western support to Ukraine. We need to take care of this with proactive actions and be prepared for the worst.”
There is no single agreed definition of the term ‘hybrid threats’ or ‘hybrid war’, but the European Centre of Excellence for Countering Hybrid Threats (Hybrid CoE) refers to these as “actions conducted by state or non-state actors whose goal is to undermine or harm a target by combining overt and covert military and non-military means.”
The think-tank divides threat operations into three categories. “Hybrid influence” includes “softer” tools like information operations or election interference. “Hybrid threat operations” include attacks on critical infrastructure or malicious cyber activity. At the most extreme end of the scale, “hybrid warfare” covers kinetic incidents and even military tools used for political and strategic purposes.
The latest suspected incidents in Russia’s hybrid war have centred on the Black Sea, where escalating drone attacks have repeatedly targeted commercial ships off the shores of Romania and Bulgaria. The total human cost is not yet known, since not all crew members have been recovered; since the beginning of October, two were confirmed as killed and at least 10 others were missing, presumed dead.
European Union (EU) chief Ursula von der Leyen said on October 13 that the Black Sea had become “another front of escalation of the Russian war in Ukraine.”
These are the latest incidents in what von der Leyen called a ramped up strategy, saying in the latest State of the Union address at the EU: "We should be under no illusions about what is happening here: hybrid threats facing Europe are less and less hybrid and less and less threats.”
While she did not attribute blame to Russia directly, EU foreign affairs chief Kaja Kallas said on the sidelines of the United Nations General Assembly: “Moscow is trying to scare Europe into winding down its support for Ukraine.”
‘New technologies being used’
Dr Teija Tiilikainen, Director of The European Centre of Excellence for Countering Hybrid Threats (Hybrid CoE), told Eurovision News Spotlight that both the volumes and tools used in these operations are increasing.
“There are new states being targeted and new technologies being increasingly used in the operations,” she said. “At the same time, the old tools don’t seem to go away either. The Russian war against Ukraine has clearly led to an increasing number of threats as Russia is using this tool also to weaken Western support (for) Ukraine, in addition to its general efforts to weaken the west and undermine its values and unity.”
Intelligence services have also been vocal about the trend they’re seeing on the ground. The head of Britain's domestic intelligence service MI5, Ken McCallum, said on October 13 that Russia was intensifying its hybrid threats against Ukraine’s allies, labelling Moscow the "number one aggressor.”
Russia has repeatedly denied involvement in the dozens of events recorded across Europe as “hybrid attacks”, saying instead that “Western capitals have declared a real hybrid war against Russia”, as Russia’s Ministry of Foreign Affairs spokesperson Maria Zakharova claimed in May 2026.
Wide array of hybrid incidents in Europe
Open-source research also gives a snapshot of increased activity in Europe in recent months, which has been linked to Russia directly or indirectly by European law enforcement or public officials.
Journalists from 17 European public service news organisations, coordinated by the Eurovision News Spotlight fact-checking and OSINT group, compiled a database of hundreds of reported incidents in 17 European countries between April 1 and October 15 2026. These incidents were categorised by type and the level and source of their attribution to Russia and verified through open-source research and fact-checking.
The events include airspace violations, sabotage attempts, the use of “disposable” or low-level agents with no formal intelligence training, instrumentalised migration, and brazen military activity by Russia near or across European borders.
The number of incidents shown on the map remains a very conservative estimate, and it does not include events which may be known to military and intelligence agencies, but which have not been publicly reported or officially announced. The data focuses on physical (or “kinetic”) incidents and plots, as distinct from cyberattacks, influence operations or espionage by trained intelligence officials. It shows a selection of incidents between April 1 and October 15, 2026, that illustrate the range of hybrid war threats linked by security and state officials, or agencies to Russia. Many of the single points on the map refer to clusters, where multiple incidents of the same type took place in nearby locations or in quick succession.
One example is Moldova, where Defence Minister Anatolie Nosatîi said in late September that the government had recorded 84 drone incursions in 2026, voicing the stark accusation that "Russia is putting the lives of our citizens at risk."
With the types of operations being carried out becoming increasingly physical, a question hangs in the air: when might an incident cross the line and be classified as outright military aggression?
Dr Tiilikainen said it is difficult to define a clear threshold, as it would depend on the overall security situation. “We could, however, assume that in case a hybrid threat operation or hybrid warfare attack led to casualties, there would be a lot of pressure to take more serious countermeasures.”
She added that EU and NATO members are generally not willing to define where that line in the sand might be. “Strategic ambiguity is seen to serve as a good form of deterrence against hostile states.”
Rutte: They want Ukraine’s allies ‘rattled’
Despite the recent indications from European leaders that Russian hybrid attacks are increasing and intensifying, NATO Secretary General Mark Rutte said that the alliance should not inflame the situation.
“Russia is not in a good place,” he told reporters at a press conference in Tallinn on October 14. “These hybrid attacks and whatever it is, are a sign of weakness. What they love us to do is to talk about it the whole day and to be rattled and to have press conferences on it. We are not going to do that. We will react where we need to react.”
However, Rutte acknowledged that the hybrid campaign is continuing, adding: “Putin is trying to weaken our resolve and stop our support for Ukraine.” When asked by one of our journalists if an official database of hybrid incidents in Europe existed, NATO press office replied that “there aren’t any public or non-classified records we can share with you on the matter.”
The recent escalation of hybrid war events is not only playing out in the numbers, but also in the types of incidents unfolding, said Dr Tiilikainen.
“The operations are getting more kinetic and even military forms are used. We can say that the grey zone between peace and war – and the zone for hostile activities below the threshold of armed attack – is getting broader. New tools are being tested, together with the tolerance of the Euro-Atlantic countries as well as their reactions and countermeasures.”
A collaboration by reporters from France Télévisions, RTVE (Spain), 3Cat (Spain), NRK (Norway), ORF (Austria), Radio France, TVP Vot Tak (Poland), ZDF (Germany), LRT (Lithuania), LSM (Latvia), SRF (Switzerland), VRT (Belgium), BR (Germany), SVT (Sweden), France 24, Yle (Finland), DR (Denmark), European Broadcasting Union.
This map and the underlying database is available for republication by EBU members. For access and conditions please contact spotlight@ebu.ch
METHODOLOGY: Journalists from public service media in the Eurovision News Spotlight network used open-source research and other reporting methods to gather and verify incidents on European territory between April 1 and October 15, 2026, that were publicly described as “hybrid attacks” and linked to Russia by security officials, government officials or news reports. The investigation focused on physical (“kinetic”) incidents and on “disposable agents” reportedly planning such attacks. It excluded cyberwarfare, influence operations and espionage attributed to trained intelligence officials.