Russia’s alleged sabotage campaign in Europe raises fears of escalation

European officials describe a widening set of alleged Russian operations below the level of open war. These include airspace incursions, drone flights, border pressure, sabotage, cyberattacks and information campaigns. The reported aim is to test Europe’s reactions and weaken support for Ukraine and confidence in NATO and the EU.

Examples include suspected Russian drones downed over Poland, Finland and the Baltic states. Officials also allege Russian aircraft entered Polish, Lithuanian and Estonian airspace. Ukraine accused Russia of using aerial and surface drones to sink four cargo ships near Bulgaria. Reports further alleged incendiary devices at two Munich defence companies and plans to target European defence bosses.

The allegations remain part of an escalating security warning. Since the Leipzig/Halle airport plot in August, European officials have warned of more serious attacks. They say Russia may target factories, logistics hubs, technology companies and infrastructure that support Ukraine.

A shadow war, often called hybrid warfare, is a campaign that mixes military and non-military tools. It may include sabotage, cyberattacks, espionage, disinformation, covert operations and pressure at borders. The purpose is to create disruption and fear while keeping actions deniable or below the threshold of conventional war.

The article describes suspected drones, airspace incursions, attacks on ships, migrant pressure from Belarus, damaged border infrastructure and possible plots against defence companies. These actions can look separate, but together they test reactions and strain political support for Ukraine. They also make attribution and response more difficult.

A formally declared war is openly announced and usually involves acknowledged armed forces fighting in sustained operations. A shadow war works through ambiguity and scattered incidents. The article warns that these activities may represent early stages of a multidimensional conflict, even without a declared war.

The reported campaign is geographically broad and uses many forms of pressure. Officials cite incidents involving Poland, Lithuania, Estonia, Finland, Latvia, Bulgaria and Germany. The article also discusses the Baltic states collectively and warns that European defence supply chains could become targets.

In the air, Russian aircraft allegedly entered Polish, Lithuanian and Estonian airspace, while suspected drones were downed over Poland, Finland and the Baltic states. At sea, Ukraine accused Russia of sinking four cargo ships near Bulgaria. On land, Belarusian actors allegedly pushed migrants toward Latvia and damaged border equipment. Germany’s Leipzig/Halle airport and Munich defence companies also feature in the allegations.

The campaign’s alleged methods extend beyond physical attacks. The article names cyberattacks and information warfare, alongside sabotage and manned or unmanned military operations. This combination makes the challenge harder to detect, attribute and deter.

Incidents near NATO territory matter because they test whether the alliance can protect its borders and critical systems. Even a limited action can create pressure to respond. If governments do too little, Russia may judge that further operations are affordable. If they respond forcefully, a covert confrontation could become an open military crisis.

The article cites suspected drones over Poland and other states, plus alleged attacks on cargo ships near Bulgaria. It also reports claims that Russia planted incendiary devices at Munich defence companies and sought to target European defence leaders. These sites support Ukraine’s war effort, so disruption could affect weapons, logistics and technology.

European officials therefore fear escalation from testing and sabotage toward attacks that cause deaths or larger damage. A Czech intelligence chief warned Russia might attack a NATO member within “months, not years,” while Moscow called European defence industries legitimate targets.

Poland and the Baltic states are especially alert because the article describes them as direct sites of alleged airspace, drone and border incidents. Latvia also faces pressure from Belarus, which officials accuse of helping push migrants across the border. These events make sovereignty and border control appear vulnerable.

The article says Russian aircraft allegedly entered Polish, Lithuanian and Estonian airspace. Suspected Russian drones were downed over Poland, Finland and the Baltic states. In Latvia, masked people allegedly threatened guards, damaged border infrastructure and removed surveillance equipment. Ukraine also accused Russia of attacking ships near Bulgaria, a NATO and EU member.

Officials see these incidents as tests of resilience rather than isolated events. Latvia’s ambassador linked them to Russia’s war in Ukraine, arguing that Moscow tests Europe more when it appears weaker on the battlefield. The concern is that repeated tests could weaken resolve.

European governments can deter sabotage through stronger protection and better investigations. The article specifically points to protecting critical infrastructure, strengthening intelligence services and preventing attacks. It also says governments should identify the networks behind operations, expose command structures and disrupt financing and logistics.

Practical targets include data centres, telecommunications, defence companies, transport hubs and other vulnerable networks. Financial investigations could reveal who pays for covert operations and how equipment or personnel move. Publicly exposing those links could reduce deniability. Sanctions and other consequences could then raise the cost for organisers and supporters.

The article says European governments have discussed resilience but have not spoken about retaliation. Olena Tregub argues that deterrence requires more than stopping the next incident. It requires making continued operations costly. The article does not specify particular sanctions, so their exact form remains unstated.

Deterrence is the effort to prevent an attack by convincing an adversary that the consequences will outweigh any benefit. It can rely on protection, detection, exposure, sanctions or other responses. The central idea is not simply to absorb the next incident, but to change the attacker’s calculation before another operation begins.

The article explains this through Olena Tregub’s warning that Russia must see continuing operations as too costly. If investigators trace networks, expose command structures and disrupt money and logistics, they can reduce the campaign’s effectiveness. Stronger protection can also make attacks harder to carry out and less rewarding.

Tregub says she is not sure Russia currently sees costs as high enough. That creates a risk of repetition and escalation. European governments are therefore urged to pair resilience with consequences, while the article notes they have not discussed retaliation. The goal is to prevent attacks without widening the conflict.