Full Report
Russia is testing how far it can push Europe without triggering open war — from drones crossing NATO airspace to sabotage and cyberattacks across the continent. Experts warn that Europe has strengthened its defenses since 2022, but key gaps remain, including in air defense, communications, intelligence, and joint command.Russia
Analysis Summary
# Threat Actor: Russian Federation (State-Sponsored Hybrid & Military Operations)
## Attribution & Identity
**Actor Identification:** Russian State entities, including military (GRU) and intelligence services (SVR/FSB), acting under the direction of the Kremlin.
**Aliases:** Moscow, Russian Federation.
**Known Associations:** The article references a broad "sustained campaign" involving military forces, hybrid operatives, and state-directed saboteurs.
## Activity Summary
Based on the article dated October 2026, the actor is engaged in a "sub-threshold war" against Europe. Recent operations include:
* **Airspace Violations:** Repeated incursions of Russian drones into NATO airspace.
* **Sabotage:** An attempted drone attack at Leipzig Airport, Germany, in August 2026.
* **Hybrid Operations:** Intensified "audacious" campaigns across the European continent designed to test NATO's "red lines."
* **Kinetic Strikes:** Intensified aerial campaigns against Ukrainian civilian infrastructure using glide bombs and drones (specifically targeting Kyiv and Kharkiv).
## Tactics, Techniques & Procedures
* **Hybrid Warfare:** Blending cyberattacks, military provocations, and physical sabotage to stay below the threshold of open war.
* **Unmanned Systems Operations:** High-volume use of drones for both battlefield destruction and psychological signaling via airspace violations.
* **Infrastructure Targeting:** Deliberate strikes on civilian residential areas and energy/utility infrastructure.
* **Strategic Foresight Testing:** Probing specific gaps in European defenses, particularly air defense and joint command responsiveness.
## Targeting
* **Sectors:** Defense, Government, Transportation/Logistics (Airports), Civil Infrastructure, Energy.
* **Geography:** Ukraine, Germany (Leipzig), and broader NATO/European Union member states.
* **Victims:** Leipzig Airport, residential districts in Kyiv and Kharkiv, NATO airspace integrity.
## Tools & Infrastructure
* **Malware & Cyber:** While specific families aren't named in this summary, the actor is noted for sustained "cyberattacks."
* **Unmanned Aerial Vehicles (UAVs):** Identified as the primary tool delivering 80% of battlefield results; used for both reconnaissance and kinetic impact.
* **Kinetic Munitions:** Glide bombs.
* **Infrastructure:** Military training grounds such as the "Chebarkulsky training ground" in the Chelyabinsk Region.
## Implications
The actor is pursuing a long-term strategy to dismantle the "European model of freedom, equality, and solidarity." By conducting "war in small steps," Russia aims to normalize aggression and exploit gaps in European air defense, intelligence sharing, and joint command. Experts warn that if Europe does not bridge the gap between industrial capacity and modern drone-centric warfare, it remains vulnerable to a full-scale confrontation for which it is not yet fully prepared.
## Mitigations
* **Investment Realignment:** Redirecting defense budgets to reflect modern warfare realities (specifically increasing the ~2% allocation for unmanned systems and counter-drone tech).
* **Defense Alliances:** Strengthening initiatives like the **EU-Ukraine Drone Alliance** to combine battlefield experience with industrial production.
* **Capability Gap Closure:** Prioritizing the hardening of air defenses, secure communications, and joint NATO command structures.
* **Hybrid Resilience:** Establishing clear "red lines" for sub-threshold provocations (sabotage and airspace violations) to deter further escalation.