Latest / ACLED Audio / REPORT: From sabotage to escalation: Russia’s hybrid threats ramp up across Europe

Transcript

REPORT: From sabotage to escalation: Russia’s hybrid threats ramp up across Europe · ACLED Audio

• 0:06
  SPEAKER_00: From sabotage to escalation, Russia's hybrid threats ramp up across Europe.
• 0:12
  SPEAKER_00: Executive Summary.
• 0:14
  SPEAKER_00: Russia's hybrid activity in Europe has focused on actively targeting critical infrastructure, defense production, and military logistics in an attempt to weaken Europe's support of Ukraine.
• 0:27
  SPEAKER_00: Russia has intensified its hybrid activity in Poland and Germany in particular.
• 0:32
  SPEAKER_00: In Germany, this has taken the form of increased activity targeting aviation, defense infrastructure, and military logistics.
• 0:41
  SPEAKER_00: Poland has been increasingly exposed to sabotage attempts against critical infrastructure and has faced continued airspace violations and drone incursions.
• 0:51
  SPEAKER_00: Drone incursions are also increasing in countries on Europe's eastern flank, particularly Romania and Moldova.
• 0:59
  SPEAKER_00: Over the next three to six months, Russia is expected to ramp up coordinated hybrid pressure, particularly along Europe's eastern flank and in countries that are the biggest providers of military and economic aid to Ukraine.
• 1:14
  SPEAKER_00: In particular, Russia is likely to target Germany, Poland, the Baltic states, and, to a somewhat lesser degree, Nordic countries, as it leverages and customizes its hybrid toolkit to local vulnerabilities.
• 1:29
  SPEAKER_00: Moscow will likely target critical infrastructure, defense infrastructure, military logistics, transportation nodes, especially railways, and maritime infrastructure, such as ports and undersea cables.
• 1:44
  SPEAKER_00: It is also likely to make use of cyber attacks.
• 1:47
  SPEAKER_00: Intensified aerial attacks against Ukraine, particularly western Ukraine, will increase spillover effects in Poland, the Baltics, Romania, and Moldova.
• 1:58
  SPEAKER_00: Moscow increasingly targets Europe's defense infrastructure supporting Ukraine.
• 2:04
  SPEAKER_00: Over the last six months, Moscow has stepped up its hybrid warfare campaign across Europe, making it increasingly aggressive, violent, and impactful.
• 2:15
  SPEAKER_00: While 2025 was marked by drone overflights, limited destruction of communications infrastructure in Sweden, failed railway sabotage in Poland, and symbolic sabotage of Ukrainian supporters' property, in 2026, especially the second half of it, Russia has carried out more destructive events targeting defense and communications infrastructure.
• 2:42
  SPEAKER_00: See the graph in the report for details.
• 2:46
  SPEAKER_00: Given NATO's lack of deterrence and clear thresholds for responding to Russia's hybrid attacks, Russia operates in a permissive environment and continues to view hybrid escalation as the most practical tool for sustaining pressure on Europe and substantially weakening European support for Ukraine.
• 3:07
  SPEAKER_00: The Kremlin's primary objective has been to intimidate European decision makers and sway public opinion to weaken the support that helps Ukraine continue its resistance against Russia's ongoing invasion.
• 3:22
  SPEAKER_00: The latest hybrid escalation is also consistent with Moscow's regime survival logic, which holds that other countries' increasing military, political, and economic pressure on Russia will not push Russia's leadership toward compromise and negotiations.
• 3:41
  SPEAKER_00: On the contrary, it will push Putin toward escalation and demonstrating his power.
• 3:47
  SPEAKER_00: Given Moscow's inability to secure a decisive conventional military success on the ground in Ukraine, Russia's application of hybrid warfare tools allows it to impose costs on European countries that support Ukraine economically and militarily, while avoiding direct military escalation with NATO.
• 4:09
  SPEAKER_00: Russia's hybrid activities have shifted from a wider and more diffuse campaign spanning espionage, cyber attacks, sabotage, and applying airspace pressure toward actively targeting critical infrastructure, defense production, and military logistics connected to military assistance for Ukraine.
• 4:29
  SPEAKER_00: To achieve its objectives, Moscow has increasingly combined hybrid means such as sabotage using disposable proxies, one-time agents recruited from diaspora and migrant communities, and financially vulnerable locals who are sympathetic to Russia, with drone incursions into European and NATO airspace to test, map its responses, and pressure Europe, particularly its eastern flank, as part of its hybrid campaign.
• 4:57
  SPEAKER_00: Refer to the chart in the report for details.
• 5:01
  SPEAKER_00: Recent incidents increasingly demonstrate that Russia's hybrid warfare campaign is focused on the industrial infrastructure that enables European countries to support Ukraine's defense.
• 5:13
  SPEAKER_00: Refer to the map in the report for details.
• 5:16
  SPEAKER_00: During August, Russia targeted at least 10 military industrial sites in Europe with acts of sabotage, both prevented and successful, as well as surveillance and reconnaissance attempts.
• 5:30
  SPEAKER_00: In Slovakia, authorities prevented an arson attack against Skaiten, a Ukrainian drone manufacturer.
• 5:38
  SPEAKER_00: In Estonia, local authorities are investigating a fire on August 15 at the premises of Milrem Robotics, which provides unmanned ground vehicles to Ukraine.
• 5:50
  SPEAKER_00: Earlier in August, an explosive-laden drone was discovered near a Ukrainian Antonov cargo aircraft at Germany's Leipzig Airport, an important freight and NATO logistics hub.
• 6:04
  SPEAKER_00: The same airport was targeted in July 2024 when an incendiary parcel ignited at its DHL Logistics Center as part of a broader European sabotage operation suspected of links to Russian intelligence.
• 6:20
  SPEAKER_00: Throughout 2026, Poland, in particular, has faced increasing sabotage attempts against infrastructure that supports military supplies to Ukraine.
• 6:31
  SPEAKER_00: ACLED records six incidents aimed at military and critical infrastructure that involved arson, sabotage, intrusions, and drone surveillance.
• 6:42
  SPEAKER_00: Moscow has recruited disposable agents to conduct hybrid activities ranging from surveillance of critical infrastructure assets, including Rzechov Yashanka Airport and the terminal at the Polish-Ukrainian border crossing at Malhovice-Nizankovice, to actual sabotage and arson attacks against industrial, railway, and communications infrastructure.
• 7:07
  SPEAKER_00: The most prominent arson attacks in August targeted storage facilities at an aircraft parts warehouse in Lublin and at the WB Electronics Plant, one of the largest European Union drone producers in the city of Skarzysko-Kamienna.
• 7:23
  SPEAKER_00: In September, Starlink infrastructure was targeted in Vola Krobowska, refer to the map in the report for details.
• 7:32
  SPEAKER_00: Poland has also experienced airspace violations by aircraft and uncrewed drones and balloons that have briefly entered Polish airspace from Russia's Kaliningrad region, Belarus, or from Ukraine's western regions during aerial attacks.
• 7:48
  SPEAKER_00: At the same time, incidents of Russian drones intruding into other countries' airspace, falling onto European territory, and posing risks to civilians and civilian infrastructure have increased in countries on Europe's eastern flank, particularly Romania and Moldova.
• 8:06
  SPEAKER_00: Maritime navigation along the western Black Sea coast and border infrastructure near the Danube Delta area are under particular stress from Russian drone strikes and frequent air alerts.
• 8:19
  SPEAKER_00: Given that Russia uses electronic interference against Ukrainian drones launched at Russia's Baltic Seaports, countries like Latvia, Estonia, Lithuania, and Finland have also faced the risk of drone incursions and accidental strikes.
• 8:36
  SPEAKER_00: The importance of these strikes lies in the cumulative effect of continuous incursions.
• 8:42
  SPEAKER_00: Moscow banks on continued disruptions to airports and other critical infrastructure to force European authorities to devote extra effort to maintaining higher readiness while increasing security and economic costs and threat perception for supporting Ukraine.
• 8:59
  SPEAKER_00: Outlook.
• 9:00
  SPEAKER_00: Poland, Germany, and the Eastern Flank face growing hybrid pressure.
• 9:05
  SPEAKER_00: In the next six months, Poland, Germany, the Baltic states, Moldova, Romania, and to a lesser degree the Nordics will be the most at-risk countries.
• 9:17
  SPEAKER_00: The kinds of infrastructure most likely to be targeted include defense production, military facilities and logistics, transportation networks, aviation, and energy infrastructure.
• 9:30
  SPEAKER_00: Russia will actively exploit weaknesses and political uncertainty among NATO countries to determine whether the threshold between hybrid activity and armed aggression has been crossed.
• 9:43
  SPEAKER_00: In its more systematic targeting of critical infrastructure, Russia will leverage the whole spectrum of its hybrid instruments, particularly sabotage, arson attacks, and cyber attacks.
• 9:56
  SPEAKER_00: Escalation scenarios over the next six months.
• 10:00
  SPEAKER_00: Scenario one.
• 10:02
  SPEAKER_00: Further escalation below the threshold of open conflict as the war in Ukraine continues.
• 10:09
  SPEAKER_00: Probability highly likely.
• 10:12
  SPEAKER_00: Over the next six months, attempts to destabilize critical infrastructure through sabotage are highly likely to become more coordinated while remaining below the threshold that would trigger direct military conflict with NATO.
• 10:26
  SPEAKER_00: Europe's eastern flank is expected to experience increased hybrid pressure from Russia amid its continued war in Ukraine, assuming no peace deal materializes in the next six months.
• 10:39
  SPEAKER_00: Russia is likely to expand hybrid activity in Poland, Germany, the Baltic states, Romania, and Moldova.
• 10:48
  SPEAKER_00: Poland and Germany will be increasingly exposed to Russian hybrid warfare activities around defense production, military logistics, aviation, and overall infrastructure supporting Ukrainian war efforts.
• 11:02
  SPEAKER_00: In Poland, the Podkarpatskia and Lubelskia Voivodeships, including Zheszov Yashonka and the Warsaw-Lublin-Khelm-Dorohusk Corridor, an important route for transporting aid and supplies to Ukraine, will most likely be targeted.
• 11:20
  SPEAKER_00: Recent suspected sabotage against aviation and drone-related facilities, alongside Moscow's broader hybrid pressure on energy facilities, suggests defense industrial and energy lines and substations feeding Ukraine's grid, such as the 400 kilovolt high-voltage power transmission, Zheshov Khmelnitsky line, are likely to become increasingly important targets this upcoming winter.
• 11:48
  SPEAKER_00: Poland is also likely to experience a spike in drone incursions and airspace violations in the next six months due to the intensification of Russia's provocations and aerial attacks in western Ukraine.
• 12:03
  SPEAKER_00: In Germany, the main targets are likely to be Leipzig slash-Halle Airport, a major military air transportation hub, Munich, the major hub for Ukraine-German drone production, and key defense production facilities in Lower Saxony, such as Rhein-Metal's industrial and defense manufacturing site in Unterlus.
• 12:27
  SPEAKER_00: Russian hybrid pressure on the Baltic states is likely to focus on military-industrial sites, telecommunications, and maritime infrastructure.
• 12:37
  SPEAKER_00: The risk of Russia carrying out provocative incidents along the Baltic states' borders should also not be ruled out, but remains unlikely.
• 12:47
  SPEAKER_00: Romania's wider Danube Delta area and its exclusive economic zone in the Black Sea, as well as Moldova's south and east, are likely to continue experiencing a high frequency of drone incursions and airspace violations, along with heightened risks to cross-border infrastructure and maritime navigation.
• 13:10
  SPEAKER_00: While Nordic countries are not considered primary targets, Russia is likely to change its hybrid priorities and begin identifying targets across the region.
• 13:22
  SPEAKER_00: This would likely take the form of increased Russian drones entering these countries' territories, particularly in Finland.
• 13:30
  SPEAKER_00: Sabotage against critical infrastructure, particularly defense infrastructure, and maritime activity aimed at disrupting undersea cables in the Baltic Sea.
• 13:42
  SPEAKER_00: Scenario 2.
• 13:44
  SPEAKER_00: Hybrid pressure increasingly focuses on causing disruption to non-military critical infrastructure in Europe.
• 13:52
  SPEAKER_00: Probability.
• 13:55
  SPEAKER_00: In this scenario, Russia is also likely to further target infrastructure in Poland and Germany.
• 14:02
  SPEAKER_00: However, unlike the more likely scenario in which Moscow's more coordinated hybrid operations would have limited operational implications, this scenario includes a concerted effort to cause more substantial damage, such as temporary airport or factory shutdowns, disruptions to military logistics, short-term electricity outages, and prolonged disruptions to defense production.
• 14:30
  SPEAKER_00: Russia would likely achieve this through a combination of sabotage and arson attacks carried out by one-time agents, as well as cyber attacks against multiple defense and other critical infrastructure nodes.
• 14:44
  SPEAKER_00: The aim would be to trigger cascading disruptive effects among defense, transportation, and communications sectors spanning multiple European countries.
• 14:55
  SPEAKER_00: The Nordic and Baltic countries will face heightened risks to maritime infrastructure, particularly undersea cables, along with increased Russian attempts to disrupt telecommunications, GPS, and navigation systems, while maintaining its naval presence in the Baltic Sea to secure its shadow fleet transports.
• 15:17
  SPEAKER_00: In this scenario, the Kremlin will use one-time agents and covert tactics such as sabotage, arson attacks, and cyber operations to keep disruption small enough to complicate attribution and minimize the likelihood of a response from NATO and EU member states.
• 15:36
  SPEAKER_00: Even if a partial ceasefire or peace settlement is reached and conventional fighting in Ukraine decreases, Russia is unlikely to stop its hybrid attacks, considering Moscow's long-term objectives of undermining European defense production capabilities and economic and military support for Ukraine.
• 15:57
  SPEAKER_00: Scenario 3.
• 15:59
  SPEAKER_00: Major hybrid provocations testing NATO's response threshold.
• 16:05
  SPEAKER_00: Probability.
• 16:08
  SPEAKER_00: In this scenario, Baltic countries are likely to experience a shift from sporadic hybrid activities to a wave of such activities, including sabotage, arson attacks, and airspace violations along their borders, ports, military facilities, telecommunications infrastructure, and critical infrastructure.
• 16:31
  SPEAKER_00: In this scenario, the Baltic states are particularly vulnerable as they are situated on NATO's eastern flank, neighboring Belarus and Russia, and have a substantial Russian-speaking population that could be targeted by Russian information influence operations that aim to trigger disinformation-fueled social unrest and inflame ethnic tensions between Baltic majorities and Russian minorities in the region.
• 17:00
  SPEAKER_00: As such, a possible provocation that pushes the narrative of protecting Russian populations in Baltic states or in Russia's own Kaliningrad exclave should not be ruled out.
• 17:14
  SPEAKER_00: In this scenario, Russian hybrid activities in the Suvalky Gap could intensify and potentially escalate to the point of affecting NATO states and the Baltic states' economies.
• 17:27
  SPEAKER_00: This would likely take the form of disruptions to telecommunications and power infrastructure that support military mobility, as well as intensified sabotage and arson attacks on transportation assets such as roads and railways and logistical nodes.
• 17:46
  SPEAKER_00: Another likely development in this scenario would be an intensive, well-coordinated attack against major NATO military infrastructure and logistics across Europe, with a particular emphasis on ports, airports, railways, energy hubs, and logistics corridors intended to discourage European leaders from continuing their support for Ukraine while making them shift their attention and relocate financial and military resources toward protecting their own infrastructure and territory.
• 18:18
  SPEAKER_00: This could take the form of a series of hybrid attacks across several NATO countries.
• 18:24
  SPEAKER_00: In particular, Moscow could resort to sabotage combined with cyberattacks against railway, port, and airport infrastructure, as well as infrastructure supplying energy to military hubs to achieve this objective.
• 18:38
  SPEAKER_00: It is unlikely that this scenario will unfold over the next six months as the Kremlin is focused on the war in Ukraine and benefits from deploying an asymmetric hybrid toolkit below the threshold of triggering direct military escalation with NATO.
• 18:55
  SPEAKER_00: Given the current stalled offensive in Ukraine, it is unlikely that Moscow would seek more active hybrid escalation that risks slipping into more conventional clashes with NATO with unforeseeable consequences.