Europe struggles to punish Russia's escalating hybrid warfare campaign

Across Europe, a shadow campaign of sabotage is accelerating—and governments are running out of ways to respond without crossing into open conflict. In the past month alone, German authorities discovered an explosives-laden drone positioned next to a Ukrainian cargo plane at Leipzig airport. Poland has weathered a series of suspected sabotage operations. Defence facilities supplying Ukraine have been struck by a string of unexplained explosions and fires. Each incident carries Moscow's fingerprints, yet each one is designed to remain just ambiguous enough to avoid triggering a conventional military response.

The sophistication lies not in the attacks themselves but in how they are organized. Russian intelligence services have largely abandoned the model of dispatching professional operatives across Europe. Instead, they now recruit saboteurs remotely—often through Telegram channels—and pay them in cryptocurrency to execute individual tasks. This architecture keeps the directing officers safely at home, insulated from direct attribution. Denmark's authorities this week warned that Moscow was actively recruiting Danish citizens to carry out sabotage against defence companies with Ukrainian ties, a pattern that underscores how the operation has scaled and decentralized.

What has changed, noticeably, is the speed with which European governments are willing to name Russia publicly. When a parcel caught fire at DHL's Leipzig hub in July 2024, it took nine months for German investigators to report a concrete link to the GRU, Russia's military intelligence agency. This time, Berlin moved within days. German officials publicly blamed Moscow for the second Leipzig incident—a signal both of growing confidence in identifying Russian operations and of diminishing patience with what they view as an increasingly brazen campaign. Yet naming the culprit and punishing it are two different things.

Germany's response illustrates the constraint. Berlin closed a Russian cultural centre and a Russian consulate. Moscow retaliated by shutting down the already-gutted Goethe-Institut. The exchange was measured, calibrated to keep tensions in check—a reflection of the harder question that haunts European capitals: what can they actually do beyond sanctions and diplomatic expulsions without risking direct military confrontation? The toolkit is thin. Unlike the CIA, many European intelligence services are primarily tasked with collecting information and have far less latitude to conduct covert operations abroad. That leaves governments with a narrow band of options between economic and diplomatic punishment on one end and overt military action on the other. Several EU states, including the Netherlands, have recently proposed bills to expand their intelligence agencies' surveillance powers, an attempt to fill the gap.

One area where Europe has shown more tangible action is its willingness to seize vessels linked to Russia's shadow fleet. On Wednesday, Norwegian authorities detained a Russian vessel in the Arctic archipelago of Svalbard at Ukraine's request. But critics argue such measures remain insufficient as a deterrent. An unnamed EU lawmaker put it plainly: every time Europe does nothing, it invites Putin to continue.

Poland and the Baltic states have been the most vocal in pushing for a harder line. On Thursday, Polish foreign minister Radosław Sikorski described hybrid warfare not as a nuisance confined to the internet but as assassination squads, arsonists, explosions on moving trains, airspace breaches with drones and cruise missiles. "We need to convince Putin that such actions are not for free," he said. Yet Sikorski also acknowledged, with a touch of dark humour, the limits of Europe's existing arsenal. Recalling Poland's responses to previous suspected Russian operations, he noted that each time Russia committed arson or attempted to blow up a train, he closed one Russian consulate—but eventually ran out of consulates to close. The joke carried a real edge: Europe is approaching the boundary of what it can do without fundamentally changing the nature of its response.