This is how the hybrid war that attacks us Europeans works

Barcelona"Europeans are facing a hard truth: that this is the new normal." This phrase from the President of the European Commission, Ursula von der Leyen, brings to mind that "new normal" of restrictions on individual freedom in favor of public health to which we had to adapt during the COVID-19 pandemic. The statement, however, is not from six years ago, but from this week. Now, the new normal to which we must get used is that of systematic attacks by Russia. "We are in a new era of European security," insisted the leader of the EU executive. The message came after German authorities directly blamed Moscow for an attack with an explosives-laden drone at Leipzig airport at the beginning of August, one of the most serious sabotage attempts recorded so far on European territory, in a key NATO logistics hub.

But this incident is not, by any means, an isolated event, nor a one-off provocation by Russia, but one more attack within the so-called "hybrid war" of Vladimir Putin's regime against its enemies in the West. Already in September of last year, the German Chancellor, Friedrich Merz, stated: "[In Europe] We are not at war, but we are not at peace either." A few months earlier, a similar statement had already been made by the Swedish Prime Minister, Ulf Kristersson: "Sweden is not at war, but there is no peace either." "We and our neighbors are exposed to hybrid attacks, carried out not with missiles and soldiers, but with computers, money, disinformation, and the risk of sabotage," he argued.

The concept of "hybrid threats" or "hybrid war" refers to the sustained strategy of using different tactics and means to attack an adversary without reaching the level of armed conflict. Sabotage of critical infrastructure, cyberattacks, airspace violations, assassinations, interference in electoral processes, disinformation, military maneuvers... Any hostile action that does not amount to a military attack that triggers a declaration of conventional war. These are attacks intentionally designed to be ambiguous and difficult to attribute, to increase confusion and reduce the possibilities of an effective response. According to the definition provided by NATO, hybrid threats "are used to blur the lines between war and peace and attempt to sow doubt among target populations," with the aim of "destabilizing and undermining societies."

"It is part of Russia's toolbox when it wants to weaken the West: polarizing public opinion, supporting parties that favor it, weakening public trust in institutions... In short, weakening democracies", summarizes to ARA the director of the European Centre of Excellence for Countering Hybrid Threats (HybridCoE), Teija Tiilikainen, who highlights that this is not a strategy exclusive to Russia, but that other actors such as China and Iran, with the same objectives, use similar actions.

Increasingly serious attacks

The Putin regime, however, is the most active today in Europe. European analysts and political leaders state without hesitation that this strategy has intensified and worsened since the start of Russia's war against Ukraine in 2022 and, especially, since last year. According to the Finnish analyst, these Russian operations have increased "because there is a more specific goal: to reduce Western support for Ukraine". And she also points out that instruments linked to the military sphere are increasingly being used, such as drones with explosives, whereas a few years ago what predominated were disinformation operations, manipulation of public opinion on social media, and electoral interference.

However, it is impossible to quantify all hostile actions. Especially because one of the characteristics of hybrid warfare is that in most cases it is very difficult to attribute authorship with evidence. "Denial is part of the tactic: the actors do not assume responsibility and if an act of sabotage cannot be attributed, it is much more difficult to react to it or agree on punitive measures", states Tiilikainen.

Sabotage and assassination attempts

In recent months, however, some reports have been published that confirm the increase in physical attacks. A report by the International Institute for Strategic Studies (IISS) on the scale of Russian sabotage operations against critical infrastructure in Europe, published in August of last year, documented a hundred incidents of this type since 2018, with a very significant increase starting in 2023, coinciding with the moment when restrictions were lifted for Ukraine to use Western weaponry, particularly long-range missiles, to attack Russian territory. According to IISS data, confirmed Russian sabotage increased by 246% between 2023 and 2024.

Another report by the International Center for Counter-Terrorism (ICCT) and Globsec also confirms an intensification starting in 2023, with a peak of attacks in the first half of 2024. Among the most high-profile cases, the smuggling of incendiary devices onto planes with the apparent intention of causing them to crash, a fire at the largest shopping center in Poland, and the attempted assassination of Armin Papperger, the CEO of the German company Rheinmetall, one of the largest arms manufacturers in Europe, stand out.

The interactive platform The Everywhere War Sub-Threshold Warfare Tracker from the think tank Ukrainian Sahaidachny Security Center attempts to keep track of hybrid attacks in Europe since 2022, and so far they have counted more than 400. Cyberattacks and airspace violations are the most numerous. Among the examples of the most serious cyberattacks is one against a Norwegian dam last April, which caused the floodgates to open, and a coordinated attack last December against more than thirty Polish energy facilities.

Poland, the most affected country

Geographically, these attacks are not only focused on Europe, but numerous actions have also been recorded in the United States, especially cyberattacks. But the country most affected is Poland, followed by Germany, the Baltic states, and the Nordic countries. Just this Thursday, the Polish air forces intercepted a Russian reconnaissance plane over the international airspace of the Baltic Sea, an event that has already become common in this area: in July, NATO alert sorties increased by 250% compared to last year. As in other incidents in this area, the Russian spy plane was flying with its identification devices deactivated and without a registered flight plan, which hinders remote identification and complicates the task of civil air traffic control and, therefore, can pose a danger to passenger planes.

Poland and the Baltic republics have also been the most affected by the use of immigrants as a weapon by Russia and Belarus. And the Baltic area also repeatedly suffers cyberattacks on aircraft GPS systems (with the tactics known as GPS jammingand GPS spoofing ). The case with the most repercussions was the one that caused the plane in which Ursula von der Leyen was traveling to have to make an emergency landing in Bulgaria with analog maps, after the navigation system stopped working. Furthermore, cases of sabotage to cables and other underwater infrastructure have also become a new normal, in many cases damaged by vessels of the Russian ghost fleet.

What is the appropriate response?

Some experts use different terms to describe this hybrid war: omnipresent war, non-traditional war, shadow war... What they have in common is the use of the word war, although always accompanied by an adjective that nuances it. Some analysts have warned lately that this may minimize the sense of gravity and reduce the perception of the Russian threat among the European population. The director of the HybridCoE believes that in recent months the tone of European leaders has hardened, but warns that the term war cannot be used lightly. "The border between peace and war in authoritarian regimes is very different than in democracies: Russia says it is at war against the West, but if Europe declares it is at war against Russia, this has huge legal implications.".

She states that Moscow is provoking to escalate the conflict, "but European countries cannot respond with all the instruments they have at their disposal." Fredrik Wesslau, an analyst at the European Council on Foreign Relations (ECFR), agrees: "Democratic societies cannot respond symmetrically to Russian attacks." That is to say, a European country cannot respond to an assassination with another assassination. Nevertheless, Wesslau considers that the European response has been so far "too weak and too late," and gives the example of Germany after the Leipzig airport case, "only with a diplomatic response," which he considers insufficient. He believes that Europe has room to respond offensively in the cyber realm and to pursue the Russian shadow fleet. Furthermore, he considers that a possible countermeasure could be to further increase aid to Ukraine.

This Wednesday, Von der Leyen promised that Europe and NATO will increase the "pressure" on Russia, without further specifics. So far, one of the main tools used by the EU has been sanctions, which include the prohibition of entry into community territory and the freezing of assets. Hundreds of Russian intelligence agents have also been expelled: according to an estimate by the British MI5, between 2022 and 2024 more than 750 Russian spies were expelled from Europe.

NATO, for its part, has increased its presence on the eastern flank, with a naval mission in the Baltic Sea to protect critical underwater infrastructure, and another to increase aerial surveillance. Faced with the escalation of tensions by Russia, Admiral Giuseppe Cavo Dragone, Chairman of the NATO Military Committee, stated last December that the organization is considering more proactive countermeasures and aggressive responses to Russia's hybrid warfare. Its Secretary General, Mark Rutte, repeats like a mantra that the Atlantic Alliance will defend "every inch" of its territory, but makes no more aggressive statements, while European leaders tremble at the distance of their great traditional ally, a United States increasingly unconcerned about Europe.