EU To Coordinate Response to Russia Hybrid Attacks
European Commission President Ursula von der Leyen gestures as she delivers a major state of the union speech at the European Parliament in Strasbourg, eastern France, Wednesday, Sept. 10, 2025. (AP Photo/Pascal Bastien)
On September 28, EU foreign ministers convened in Brussels to develop an emergency security protocol meant to help member states respond quickly to escalating Russian hybrid attacks. European Commission President Ursula von der Leyen outlined the mechanism in her State of the Union Address (SOTEU) speech in Strasbourg in mid-September. The talks followed a series of recent incidents, including a September 24 event where Finnish and Swedish fighter jets intercepted Russian military aircraft over the Gulf of Finland. Under the new protocol EU countries will coordinate their response together if a member state identifies a hybrid threat.
Finnish and Swedish Quick Reaction Alert jets on September 24 rushed to identify a Russian detachment made up of transport aircraft and fighter jets flying over the Gulf of Finland. This was the first joint operational identification mission for the two air forces. The incident occurred the same day the Danish Defence Intelligence Service warned the risk of Russian military action against NATO countries was growing. The agency's assessment concluded that Russia will likely "carry out more hybrid attacks" against targets in the West.
Hybrid warfare refers to “economic, political, informational and diplomatic activities” combined with conventional military action to “destabilize and weaken” an adversary. Since Russia's full-scale invasion of Ukraine in 2022 there have been 522 incidents in Europe that officials attributed to Moscow or that fit the pattern of Russian acts. In July the EU said Russia's FSB 16th Centre (Russia’s Federal Security Services) was behind several cyber threat groups whose activity has affected at least nine member states including Germany, France and Poland.
Russia's hybrid campaign against Europe has intensified since the summer, spreading beyond the countries closest to Ukraine and reaching targets across the continent. In August, Germany blamed Russia for a suspected drone attack at Leipzig/Halle airport. Shortly after, in late September, Spanish newspaper El Mundo reported that the CIA had warned southern European governments of a possible Russian operation targeting Spain, France or Italy. The plan reportedly involved ‘Gerbera’ drones launched from ships in the Mediterranean. The report described southern European countries as Europe's "weak point" against hybrid threats. According to El Mundo, the three countries were chosen because they hold elections in 2027. The most recent incident came on September 30 when Estonia announced that Russian special services were behind an arson attack on a building in Tallinn which was used by Milrem Robotics, a defence company which supplies unmanned ground vehicles to Ukraine.
Romanian F-16 fighter jets fly during an air policing exercise at Borcea Air Base 86, amid heightened security concerns over cross-border drone incursions linked to Russia's war in Ukraine, in Borcea, Romania, Friday, Aug. 7, 2026. (AP Photo/ Vadim Ghirda)
European officials link the escalation to Russia's effort to cut off Western support for Ukraine. The Danish Defence Intelligence Service said that Russia's hybrid attacks in the past have mainly aimed to create fear and weaken public support for aid to Ukraine. However, the agency underscored that the incidents now include actions meant to stop support from reaching Kyiv such as sabotage against defence companies and railway transports carrying military equipment. EU foreign policy chief Kaja Kallas described the attacks as an attempt to intimidate communities into withdrawing support for Ukraine. Furthermore, Swedish Defence Minister Pål Jonson argued that Russia is trying to "scare" and "intimidate" Ukraine's allies, but that the strategy will fail.
Von der Leyen has framed the protocol as Europe's own version of NATO's Article 4, which lets a member call for meetings with allies when it believes its security is under threat. In response to the escalation, Brussels is also set to expand its naval mission off Libya into a broader Mediterranean security operation targeting Russia's shadow fleet and threats to critical maritime infrastructure.
The Russian embassy in the UK told Newsweek on Thursday that Moscow "categorically rejects these accusations" and that technical failures, infrastructure faults, and criminal incidents are routinely blamed on Russia without evidence and often before investigations conclude. The embassy said Russia poses no threat to NATO and has no intention of confronting it, but would respond proportionately if the alliance took aggressive steps against it. EU member states are expected to approve the EU's next tougher sanctions package against Russia in October.