Russia’s covert operations reveal the scale of its hybrid war on Europe

A drone with explosives and a trigger was found near a Ukrainian army cargo plane in a German airport. The Ukrainian Antonov cargo plane was parked at Leipzig airport, a key logistics hub for military shipments to Ukraine, and was loaded with ammunition for onward transport. Additionally, another approaching cargo plane was hit by an unidentified object, right after the finding at Leipzig airport forced it to deviate from its course, reporting minor damage after the incident.

Although the explosion was averted due to a faulty detonator, the likely attempted sabotage suggests the involvement of professionals, with the German Interior Ministry noting that the drone was likely modified to bypass the airport's security systems. The German interior minister added that these episodes represent a new threat scenario, marking a significant escalation from previous cases of unauthorized drones near airports. While the pilot of the drone is still not found, counterterrorism investigators are examining whether foreign actors are involved.

Although these incidents are alarming for the level of threat they pose, they are the latest of a long series of acts of sabotage and hybrid attacks that have been increasingly occurring in Germany and Europe. However, the attacks also mark a bigger threat in case of a direct war outbreak with Russia. Analysts from an Estonian research institute warned that in this scenario, Russia would try to neutralize the rear before striking a Nato border, with Germany being the primary target. This is because in the event of a Russian invasion of Nato borders, Germany will become a key node for supporting allies, with its logistics centers such as ports and transport hubs. Notably, there are about three and a half million Russian speakers in the country and significant groups sympathetic to Russia, a sentiment also reflected in the German controversial political party AFD. Hence, the hybrid attacks suggest that sleeper cells could rapidly activate in case of war, paralyze the rear, and recruit from target groups to expand operations. For this reason, the German government has begun to put countermeasures in place, such as planning increased anti drone surveillance at airports and assessing the menace of Russian friendly actors in the country, including local politicians in positions of power. Most importantly, Germany created a dedicated intelligence department focused on countering Russian hybrid warfare.

In the meantime, acts of sabotage in Europe have continued to increase, often targeting Ukrainian support and loud voices speaking out against the Kremlin regime. German intelligence agencies have recently indicated that there was an attempt by Russia on the life of Stefan Tumann, the head of a German defense startup that supplies reconnaissance drones and kamikaze drones to Ukraine. German infrastructure has also been targeted frequently, such as railways, power plants, and attempted attacks against two warships in port. In Czechia, a fire broke out at a drone production plant directly supplying Ukraine. In Vienna, Austrian authorities have expelled Russian embassy staff amid suspicions of espionage, carried out by intercepting data transmitted by international organizations through satellite Internet. In France, a Russian journalist who escaped from Russia,  named Yevgeny Safronov, was found dead near Paris, a week after his social media accounts were hacked. He was known for covering pressure tactics against journalists, and the intensifying clampdown on free expression in Russia.

In Poland, Polish authorities concluded that the massive arson attack that destroyed Warsaw's Marywilska forty-four shopping center was orchestrated by Russian intelligence. Similarly, an explosion on the vital Warsaw Lublin railway line supplying Ukraine pointed the responsibility at Russia backed operatives. In Italy, a cyberattack that paralyzed the train ticketing system for several days was identified by Italian intelligence to be the responsibility of Kremlin aligned cyberwarfare groups. In Sweden, authorities foiled a Russian cyberattack that targeted a critical thermal power plant to disrupt the regional heating infrastructure. In the United Kingdom, British courts convicted a network of six local proxies for executing a Wagner Group-ordered arson attack against a London logistics warehouse storing humanitarian aid for Ukraine. An investigation conducted in the Netherlands, found that Russia systematically hacked private and commercial video surveillance cameras on NATO military routes to track the supply of weapons to Ukraine.

Moreover, European intelligence services noted that Russia linked people are actively buying properties in European countries, which are close to military bases and other strategic nodes. GPS interference ranging from Iceland to Italy has also become another emerging tool of the Russian sabotage campaign. US intelligence agencies report that these jamming efforts could be the cause of Ukrainian drones deviating into Nato territory in the Baltics and Black Sea area.

Overall, the pattern emerging across Germany and Europe shows that Russia’s hybrid campaign is not a collection of isolated incidents but a sustained effort to target Ukrainian support and create general disruption. The mix of sabotage, espionage and space‑based interference reveals a playbook designed to target Europe from many angles, while also testing how far Russia can push without triggering a direct confrontation. These signals point to a future in which possible confrontation with Russia could start from the very rear, with Russian agents reaching deep into European infrastructure. Europe’s challenge now is to treat these warnings as indicators of intent and build resilience before a potential escalation forces a reactive response.