European journalists map hundreds of suspected Russia-linked hybrid attacks
Journalists from 17 European public-service broadcasters created an interactive map documenting hundreds of suspected hybrid attacks linked to Russia. The project covers incidents reported from April 1 to October 15, 2026, including airspace violations, sabotage attempts, arsons and attacks on ships, but excludes cyberattacks and information operations.
Key points
- Seventeen European public-service broadcasters created the interactive map.
- Researchers verified reports of incidents from April 1 to October 15, 2026.
- The database covers physical hybrid activity, including sabotage attempts, arsons and use of one-time agents.
- Cyberattacks and information operations were excluded.
- The map shows only some publicly known cases, and Russian involvement is confirmed to varying degrees.
- German cases include explosive or incendiary devices in Munich and near Leipzig Airport, plus a drone near the Bundeswehr air base in Wunstorf.
- Other incidents include Black Sea drone attacks on cargo ships near Romania and Bulgaria and incidents on the EU border with Belarus.
Why it matters
The map brings publicly reported incidents across Europe into a shared view of suspected Russian-linked hybrid activity. It highlights threats to critical infrastructure, transport, military sites, borders and migration systems, while providing a basis for closer European coordination and debate over deterrence.
What happened
Journalists from public-service broadcasters in 17 European countries documented hundreds of incidents across Europe that were linked to Russia. Researchers checked reports published from April 1 to October 15, 2026, and included physical activity such as airspace violations, attempted sabotage, arsons, use of one-time agents and the instrumentalization of migration. Cyberattacks and information operations were not included. Cases include explosive or incendiary devices in Munich and near Leipzig Airport, a drone found near the Bundeswehr air base in Wunstorf, violations of airspace in the Baltic states and Moldova, drone attacks on cargo ships in the Black Sea near Romania and Bulgaria, and incidents on the EU border with Belarus.
How Ukrainian sources describe it
The reporting presents Russia's hybrid activity as part of a broader effort to weaken Western support for Ukraine. Particular attention is given to incidents involving German infrastructure and a defence facility, the EU border with Belarus, the Black Sea and areas near NATO's eastern flank, alongside institutional calls to replace reactive responses with active deterrence.
Background
The European Parliament called on the EU and its member states to recognize hybrid attacks as a possible form of war and move from reacting to them toward active deterrence. Teya Tiilikaiinen, head of the European Centre for Countering Hybrid Threats, said Russia uses hybrid tools to weaken Western support for Ukraine and undermine Western values and unity.