For the first few years of the war in Ukraine, Russia’s hybrid warfare attacks in Europe remained just below the threshold that might trigger a collective response. As the United States’ permanent representative to NATO from 2021 to 2024, I watched the campaign develop: undersea cables cut, incendiary devices hidden in cargo packages, and arson attacks on weapons factories and depots across Europe. To address the threat, allies reinforced critical infrastructure, increased patrols in the Baltic Sea, and expanded intelligence sharing. But NATO’s approach remained largely defensive: these attacks were scattered, small in scale, and just deniable enough that Moscow could wave them away.
Today, that is no longer the case. In late July, a Russian cruise missile crashed into Polish territory. Days later, three explosive-laden drones were found at and near an airport in Leipzig, Germany. Two weeks after that, Romanian F-16s scrambled to intercept three Russian drones over Romanian airspace, and a Spanish jet shot down a fourth near the Moldovan border. If someone had described this state of affairs two years ago as where NATO would be now—drones over allied airspace, a Russian cruise missile in Polish territory, explosives at a German airport—without any meaningful collective response from the alliance, it would have sounded unbelievable.
There is little ambiguity about Russian President Vladimir Putin’s aims. These attacks are designed to fracture the alliance’s unity, test the strength of members’ commitment to Article 5—the principle that an attack on one member is an attack on all—and raise the cost of supporting Ukraine. Less expected, however, has been the speed with which his deniable campaign has become undeniable.
NATO has not looked away. The alliance tracks these incidents, investigates them, and sometimes intercepts attacks. But a response built incident by incident is not deterrence, and Putin knows the difference. As long as each provocation costs Moscow nothing more than a downed drone, Putin has every reason to keep escalating. And every escalation in turn increases the risk that one of these incidents will end in catastrophic loss of life. Mobilizing collective action to impose costs is the best chance the alliance has of preventing such a scenario.
MASK OFF
For Russia, hybrid tactics are far from a new tradecraft. As early as the 1920s and continuing throughout the Cold War, the Soviets relied on what they called “active measures”: the use of local proxies, front groups, and irregular forces to achieve political aims. Today, Putin follows essentially the same model, seeking to erode allies’ confidence in NATO’s Article 5 by relying on tactics that fall below the threshold of a conventional warfare and leave unaffected members hesitant to respond. Plausible deniability has always been a critical part of these operations. Whatever the method, whether it be severing undersea fiber-optic cables in the Baltic Sea, a coordinated cyberattack, or an explosion at a plant in eastern Europe that produces artillery shells for Ukraine, Russia is quick to deny its direct involvement. Often, it flips the script, accusing NATO members of “Russophobia” and directing blame at Ukrainian or rogue actors.
NATO members have long been familiar with this Russian playbook. Most European members have experienced multiple hybrid attacks over the past two decades. But since its 2022 invasion of Ukraine, Russia has changed its strategy in two meaningful ways. First, it has significantly increased the frequency of attacks; during the first year of the war, the number of Russian incursions in Europe quadrupled, according to the Center for Strategic and International Studies. It has also diversified its tactics. In addition to familiar disinformation campaigns, airspace violations, and cyberattacks, actors linked to Moscow have sabotaged railways, placed incendiary packages on cargo planes, and paid criminal networks inside Europe to burn down weapons depots.
By early 2023, in response to these trends, NATO stepped up the seriousness and urgency of its discussions on Russian hybrid activity. The 2023 NATO summit’s communiqué, which sets out the alliance’s shared positions and priorities, stated that Russia had “intensified” its attacks against allies and mentioned Russia’s use of proxies for the first time. The alliance also rolled out an array of new initiatives to counter hybrid activity: heads of state adopted new goals for protecting critical infrastructure and supply chains from strategic shocks across alliance territory. They also agreed to establish the NATO Maritime Centre for the Security of Critical Undersea Infrastructure and the Virtual Cyber Incident Support Capability, a coordination platform to help members respond to cyberattacks. What was missing was any measure to impose costs on Russia. Although NATO condemned Moscow’s hybrid warfare, it was not prepared to talk explicitly about consequences, such as targeted sanctions, a crackdown on Russia’s shadow fleet (the unmarked vessels Russia uses to bypass sanctions), offensive cyber-activities, or information operations.
In late 2025, Putin put his hybrid war into overdrive.
Part of the problem is structural. NATO was established and designed, in 1949, for collective defense against attributable armed attacks. It was not designed to impose costs after deniable acts. As a defensive military alliance, it lacks the authority to impose sanctions or expel Russian operatives from member countries. That power sits with individual member states and the European Union. Since its 2014 summit, NATO has maintained that a cyber or hybrid attack could trigger Article 5 on a “case by case basis,” but the alliance has never defined the threshold for action. Even in cases in which the alliance could act collectively, such as through offensive cyber-operations, doing so requires consensus among 32 countries that have very different histories, domestic politics, and appetites for risk.
In the year after the 2023 NATO summit, Russia continued to turn up the heat, tripling its hybrid attacks in Europe and testing new ways to target NATO territory, such as interference with European railway systems. Consequently, the alliance improved its detection, forensics, and response options. NATO members shared best practices, participated in tabletop exercises designed to test those options, and crafted a new strategy to counter disinformation. Many countries, such as Estonia, Germany, Poland, and the United Kingdom, independently opened investigations into, sought prosecutions of, and expelled Russian diplomats and suspected intelligence officers. These steps were important. But they were not enough to deter Russia.
In 2025, hopes for further NATO action stalled. When President Donald Trump returned to the White House, he was so intent on getting NATO members to spend more on defense that virtually every engagement with allies began and ended with that single issue. Such ruthless prioritization produced some admirable results. At the 2025 NATO summit at The Hague, all allies committed to spend five percent of GDP on defense by 2035. But instead of taking the win and directing the alliance’s attention back toward Russia’s hybrid warfare, the administration continued to badger allies to spend more and faster. When I visited NATO headquarters in November 2025 and asked former colleagues how they were spending their time, one country’s permanent representative answered, “We spend most of our time managing you.” Amid this upheaval, the alliance’s momentum on hybrid warfare slowed to a crawl. Despite an agreement among allies in 2024 to deliver a new Russia strategy at the 2025 summit at The Hague, it never materialized. The summit declaration didn’t even mention Russia’s hybrid war.
FROG IN A POT
The summer of 2025 seemed to mark a high point for Putin’s confidence. In addition to NATO’s waning focus on hybrid activity, Russia’s summer offensive in Ukraine was showing signs of success, NATO allies were bickering over tariffs and whether Europe was facing what Vice President JD Vance called “civilizational suicide,” and Putin was being courted by Trump, a dynamic on public display in a U.S.-Russian summit in Alaska in August.
By September 2025, Putin no longer seemed to care as much about plausible deniability, and Russia’s hybrid war campaign became increasingly brazen. That month, around 20 Russian drones entered Polish airspace, and three Russian fighter jets crossed into Estonian airspace before being shot down and chased out, respectively, by NATO forces. After each instance, NATO convened for Article 4 consultations, which, according to the treaty, take place when “the territorial integrity, political independence or security of any of the Parties is threatened.” NATO launched “Eastern Sentry,” an initiative to increase NATO’s vigilance over the alliance’s eastern flank with no set end date. The initiative placed additional allied air and counterdrone assets under NATO command to reinforce its existing integrated air and missile defense along that border. Although a much-needed addition to NATO’s efforts to combat hybrid warfare, this step also failed to deter Russian attacks.
NATO needs to mount a more forceful response to Moscow’s escalation.
In late 2025, as Russia’s battlefield momentum started to decline and Ukraine ramped up its drone and missile attacks against Russian oil infrastructure, Putin put his hybrid war into overdrive. In December, as temperatures dropped, Russian-backed hackers deployed “wiper” malware, which is designed to destroy data and disable operating systems, against 30 energy facilities in Poland. This past spring, Russian submarines were caught near Svalbard, a Norwegian archipelago, testing a new weapon designed to disable undersea cables without detection. In May, a Russian drone struck a residential apartment building in Romania, the first time such an attack had injured civilians.
The tempo of these incursions accelerated further during the summer months. In August, groups almost certainly linked to Russia launched arson attacks in Bulgaria, Estonia, Italy, and Poland, all likely designed to slow the flow of assistance to Ukraine. One of the most audacious cases was the attack on the Leipzig airport in early August: one drone found near a Ukrainian cargo plane was carrying explosives. In September, a Russian frigate off the coast of Denmark fired two flares at a Danish military helicopter, one of which came dangerously close to hitting the aircraft.
One would have expected such a series of events to produce an urgent, collective NATO response. But Russia’s gradual intensification of these attacks has allowed it to get away with ever more dangerous actions without paying much of a price. Allies have reviewed these incidents, debating and responding to each in some way, but they have continued to follow the case-by-case approach set out in 2014. Although that provision was meant to preserve the alliance’s flexibility, it has instead kept NATO members from looking at these attacks in the aggregate and making the case for collective action.
RALLYING THE ALLIES
There is no question that NATO needs to mount a more forceful response to Moscow’s escalation. Any new strategy, however, must start with the alliance’s most powerful member: the United States. But the Trump administration has sent mixed signals about the attacks, sometimes ignoring them, sometimes accepting Russia’s public excuses, and occasionally advocating for responses that include the use of force. After the September 2025 drone incursion into Poland, Trump said it “could have been a mistake,” an assertion that the Polish government adamantly disputed. Days later, during a press conference with Ukrainian President Volodymyr Zelensky, Trump said he believed allies should shoot down Russian aircraft that entered their airspace. When asked about the drone discovery in Leipzig, Trump responded that “Putin is not looking to attack NATO territory.” Such conflicted messaging is undermining the alliance’s ability to deter Russia. Convincing Putin to halt his hybrid war will require an unambiguous signal from NATO’s strongest member that future attacks will come at a cost.
The United States should treat Russian hybrid warfare as forcefully as it did Russia’s threat to use tactical nuclear weapons in the fall of 2022. At the time, Washington issued a direct and public warning to Moscow about the “catastrophic consequences” that would follow such action. According to some reports, CIA Director John Ratcliffe’s August 2026 trip to Moscow was intended to serve such a purpose for hybrid attacks, but the White House downplayed the trip, calling it “semi-routine.” Even if Ratcliffe did issue an ultimatum, Putin is likely to take such a threat seriously only if it comes from Trump himself.
Signaling resolve is just half the equation. Allies also need to make the costs of continued aggression tangible. Norway’s seizure of a Russian vessel in Svalbard, in September, as punishment for Moscow’s refusal to pay damages to a Ukrainian energy company it had seized in Crimea, is one model. France’s repeated boardings of Russian sanctioned tankers is another. NATO allies should look for more such steps. The United States could, for example, announce that it is restarting planning for offensive cyber and information operations against Russia, which Defense Secretary Pete Hegseth suspended in March 2025. NATO could also merge allies’ surveillance of Russia’s shadow fleet to create a common database of ships that are falsely flagged, uninsured, or linked to cable-cutting incidents. It could then share that data with individual capitals and the EU so they could implement more effective sanctions.
Washington’s NATO allies should continue building their defensive capabilities and calling out Moscow for its attacks, but they must stop reviewing each hybrid attack in isolation and instead identify patterns of Russian aggression that will trigger a NATO response. They should also extend the pre-designated authorities of the supreme allied commander for Europe, the head of NATO military operations. His responsibilities were recently expanded to cover policing of the Baltic states’ airspace, but they should also include the maritime domain, where Russia is escalating. Moscow has a standing patrol of armed vessels in the Gulf of Finland to escort shadow fleet tankers, making any attempt by an ally to stop a suspected tanker a possible direct confrontation with the Russian navy.
Finally, every Russian hybrid attack should drive allies to increase their support for Ukraine. Since 2022, Putin has used every tool imaginable to stop the flow of assistance to Kyiv. The steady stream of military and economic support, although still flowing, has thinned out considerably since the early months of the war. Returning to this shared project will demonstrate to Putin that burning down warehouses and drone factories will not break NATO’s resolve. NATO has been fortunate that none of Russia’s hybrid attacks has led to a catastrophic loss of life. But as Putin’s risk tolerance continues to rise, it’s not hard to imagine that luck finally running out.
Loading…
