Russia's Hybrid Attacks Escalate, Europe Says — But No NATO Attack Seen as Imminent
European ministers say Russia is intensifying sabotage, cyberattacks and other hybrid attacks across Europe to undermine support for Ukraine.
That assessment, reported on Sept. 23, 2026, was paired with a second judgment. Europeans warned of rising Russian sabotage but saw no imminent NATO attack, according to Reuters. Hybrid attacks, as The New York Times describes them, are drone incursions, cyberstrikes and acts of sabotage that stop short of open warfare. Think of them as pressure tactics that hurt and disrupt without starting a full war.
The Sept. 23 warning followed a series of statements through September. French President Emmanuel Macron warned that the threat of hybrid attacks by Russia against Europe and France has intensified, in remarks reported Sept. 18. On Sept. 19, leaders of France, Poland and other European nations warned of escalating Russian hybrid attacks, according to NPR.
EU High Representative Kaja Kallas stated that since Russia began its full-scale invasion of Ukraine in 2022, there has been a steady increase in hybrid attacks against Europe, in a statement to the European Parliament dated Sept. 23. Earlier, on Sept. 1, Kallas said "Russia is hitting Europe with a wave of increasingly kinetic hybrid attacks," according to the European External Action Service. Kinetic here means physical or destructive, not only digital. The Service separately states that Russia's use of hybrid threats and campaigns against the EU has intensified since Russia's full-scale invasion of Ukraine.
NATO states that the Russian Federation uses "sophisticated hybrid strategies including political interference, malicious cyber activities and economic pressure." NATO also states that Russia has been testing NATO's resolve and responsiveness along the eastern flank, and that Article 5 collective defence — NATO's rule that an attack on one member is treated as an attack on all — may apply to attacks to, from or within space.
Brussels has also taken policy steps. On July 13, 2026, the European Union exposed Russia's malicious cyber ecosystem and adopted new restrictive measures. Restrictive measures are the EU's term for sanctions. Debate over retaliation continued. The New York Times published an article about mounting sabotage in Europe and calls to retaliate on Sept. 13, 2025, and followed with an article titled 'Europe Wants to Get the Word Out: Russia Is to Blame for Sabotage' on Dec. 3, 2025.
Moscow rejects the premise. Russia has dismissed European allegations of hybrid attacks as baseless and the result of anti-Russian hysteria, as reported Sept. 18 by Reuters. On Sept. 2, 2026, Russia was blamed for an attempted airport attack amid growing fears of hybrid warfare.
The broader context here is a problem of thresholds and proof. European capitals are describing a campaign that is persistent, deniable and increasingly physical, while also saying it does not meet their test for imminent armed attack. That helps explain the parallel tracks: public attribution to raise political costs, cyber exposure plus sanctions to raise material costs, and references to eastern-flank readiness and to Article 5 in space to shape deterrence. Looking at what this means for alliance management, the test will be whether members agree on what counts as enough evidence for joint action, and what responses stay below open warfare while still changing Russian calculations.
