Russia's Hybrid War Strikes at Europe's Infrastructure

A Campaign Waged in the Shadows

When a train conductor on the Warsaw-Ukraine railway line spotted damaged tracks on a viaduct bridge in November 2025, he had no way of knowing he had just averted a potential mass-casualty attack. Polish investigators later determined that two individuals hired by Russian intelligence had planted explosive devices on the route. Had the damage gone unnoticed, a derailment could have killed dozens of passengers.

The foiled attack was not an isolated incident. Across Europe, Russian hybrid operations — blending sabotage, drone intrusions, cyberattacks, and disinformation into a single, deniable campaign — have surged to levels that are forcing NATO governments to fundamentally rethink how they defend their own territory.

Dozens of Attempts a Day

Poland has emerged as ground zero for Russia's covert offensive. The country's Internal Security Agency now tracks dozens of daily attempts to disrupt electrical, transportation, and digital infrastructure, according to officials cited by NPR. Poland's geographic position — a critical corridor for Western military aid flowing to Ukraine — makes it a prime target.

Russian military intelligence has adopted what the International Institute for Strategic Studies (IISS) describes as a "gig economy" approach to sabotage: recruiting third-country nationals through Telegram, paying them modest sums, and directing operations remotely to maintain deniability. One documented case involved a 27-year-old Colombian national arrested after being recruited online, trained to make incendiary devices, and tasked with burning construction-supply depots — then filming the aftermath for Russian state media.

The IISS, which compiled what it describes as the most comprehensive open-source database of confirmed and suspected Russian sabotage operations in Europe, found a four-fold increase in such operations in 2024 compared to the prior year, with the pace accelerating through 2025.

Drones and Airspace Violations

The aerial dimension of Russia's hybrid campaign has grown equally alarming. In September 2025, unidentified drones — widely attributed to Russia — forced the closure of airports in Warsaw, Rzeszów, Lublin, and Modlin, causing hundreds of flight cancellations. NATO Secretary General Mark Rutte announced the Eastern Sentry initiative in response, deploying forces from Denmark, France, the UK, and Germany to reinforce the alliance's eastern borders.

Russia's MiG-31 jets also briefly violated Estonian airspace in September, prompting Tallinn to invoke NATO's Article 4 consultations. GPS jamming broadcast from Russia's Kaliningrad enclave continues to disrupt Baltic aviation and shipping on a near-daily basis. Drones have also been spotted over military installations in Belgium and Denmark's largest air base.

Cyberattacks on Energy and Utilities

In December 2025, a large-scale coordinated cyberattack struck dozens of energy infrastructure facilities across Poland. Polish authorities attributed the operation to Electrum, a Russian hacker group with documented ties to Russian intelligence. The attack formed part of a broader pattern of probing water utilities, energy grids, and communications networks across Spain, Italy, France, and Eastern Europe throughout 2025.

The Baltic states — Estonia, Latvia, and Lithuania — have taken some of the most proactive countermeasures, including disconnecting entirely from Russia's Soviet-era BRELL power grid and synchronizing with the European electricity system. Latvia established a dedicated Crisis Management Center; Lithuania followed with a similar institution. Yet security analysts at the Center for European Policy Analysis warn that Baltic coordination still lags behind the pace of Russian operations.

The Strategic Logic

Security analyst Ulrike Franke argues the Kremlin's objective is fundamentally political: "If the population gets scared, they may push for a more conciliatory stance towards Russia and maybe become less supportive of Ukraine." By inflicting economic disruption and stoking public anxiety, Moscow aims to erode the political will of European governments ahead of any future ceasefire or peace negotiations over Ukraine.

The IISS notes that despite the escalating threat, European capitals have "struggled to respond" — finding it difficult to agree on unified countermeasures, coordinate intelligence, or impose sufficient costs on the Kremlin. As the hybrid campaign intensifies heading into 2026, Europe faces a defining test of whether it can defend its infrastructure as effectively as it has defended its rhetoric.