Hybrid warfare in Europe: false threats, sabotage and cyberattacks

Hybrid threats are mounting in Europe: false bomb warnings against commercial planes triggered emergency protocols, flight diversions and passenger evacuations, and this week threats were reported at more than 6,000 Italian schools. No explosives were found, yet security teams were mobilised and thousands of travellers were left uncertain. An analysis by LRT English says such incidents put pressure on European societies without a single bomb being planted.

Different threats, different origins

Russia features in many investigations, but it is not the only actor named. France attributes an attack on hundreds of supermarkets to Iran, China is developing influence and coercion operations, and Morocco's border pressure in southern Europe is also counted among hybrid threats. The source stresses that bomb threats, navigation interference and drone incursions are distinct phenomena, and that their occurrence in the same context does not prove a single perpetrator.

Since Russia's invasion of Ukraine in February 2022, the European Union Aviation Safety Agency (EASA) has recorded a significant rise in navigation interference, concentrated around the Baltic, the Black Sea, the Mediterranean, the Middle East and the Arctic. In October 2025, the Assembly of the International Civil Aviation Organization condemned Russia for harmful interference, on the basis of evidence from Estonia, Finland, Latvia, Lithuania, Poland and Sweden. That does not allow every GPS incident in Europe to be blamed on Russia.

Recruited agents and hacktivists

After dozens of Russian diplomats were expelled, reliance grew on intermediaries and people recruited online. In September 2026, the EBU Investigative Journalism Network exposed a network operating in Lithuania, Poland, the Czech Republic and Romania that lured young people, many of them Latin Americans. According to the Lithuanian Prosecutor's Office, it was linked to Russian military intelligence, the GRU.

The pro-Russian hacktivist group NoName057(16) carries out DDoS attacks that flood websites until they fail. In July 2025, Operation Eastwood, coordinated by Europol and Eurojust, disconnected more than a hundred of its servers, but the group has not disappeared. The source notes that screenshots do not prove access to infrastructure, though in April 2025 an intrusion into a Norwegian dam's control system allowed a valve to be opened for hours.