What is hybrid warfare – and is it already happening?

Hybrid warfare is hostility kept below the threshold of war – sabotage, drones, cable cuts, disinformation. And in Europe it is already underway.

That is not a metaphor or a forecast. Here is the documented record, and the logic behind it.

The incident log

Since 2024, undersea data cables in the Baltic have been cut repeatedly by ships dragging anchors – dual-use vessels from Russia’s sanction-busting “shadow fleet,” one crew caught by Finland while positioning to cut more. Some 144 suspected drone incursions have disrupted civilian aviation across Germany, France, Belgium, Denmark, the Netherlands and Britain, closing airports at the peak in late 2025; German authorities alone logged over a thousand suspicious drone sightings in a year, many over military bases and defense plants. Arsonists destroyed Rheinmetall military trucks in Erfurt. A network tied to Russian intelligence was accused of an attempted attack on Poland’s power grid in December 2025. A plane carrying the European Commission’s president had its GPS jammed over Bulgaria.

Investigators in Poland, Germany and Lithuania found the sabotage cells overlap – recruited, often for cash over Telegram, by Russian military intelligence. Western agencies documented a four-fold increase in operations in 2024, accelerating since.

The logic of staying below the line

Why this, instead of war? Because it works on three levels at once. It imposes real costs – closed airports, burned factories, repaired cables – for almost nothing. It maps European weaknesses and response times for a possible later conflict. And above all it tests: each unanswered incident teaches Moscow that the next, slightly larger one is safe too.

Deniability is not a bug but the entire method. A dragging anchor has plausible innocence; a Telegram-hired arsonist has no Russian passport. Each case alone stays below any treaty threshold – including Article 5’s, which is why NATO pointedly refuses to say where its line is.

What Europe does about it

More than nothing, less than enough. NATO launched the Baltic Sentry naval patrol after the cable cuts; states have expelled intelligence officers by the hundred, sanctioned the shadow fleet, arrested and convicted saboteurs. The harder problem is structural: twenty-seven national police forces, prosecutors and intelligence services each see one puzzle piece of a campaign that is run centrally against the continent as a whole.

That asymmetry – one attacker, thirty defenders comparing notes – is the actual vulnerability, and closing it is less about budgets than about acting as one. It is the same lesson every security question on this site keeps teaching, this time written in cut cables and drone tracks rather than treaties.

All questions →