During the first few years of the war in Ukraine, Russian hybrid attacks in Europe remained just below the threshold that could trigger a collective response. As the United States Permanent Representative to NATO from 2021 to 2024, I watched this campaign unfold: submarine cables were cut, incendiary devices were hidden in cargo shipments, and weapons factories and warehouses were set on fire across Europe. To address the threat, Allies reinforced critical infrastructure, increased patrols in the Baltic Sea, and expanded intelligence sharing. NATO’s approach, however, has remained largely defensive: these attacks have been scattered, limited in scope, and with sufficient scope for denial that Moscow could simply dismiss them. Julianne Smith, president and co-founder of Clarion Strategies and a distinguished nonresident fellow at the Chicago Council on Global Affairs, writes for Foreign Affairs. She is the U.S. Permanent Representative to NATO from 2021 to 2024, a senior adviser to the U.S. Secretary of State in 2021, and, during the Obama administration, deputy national security adviser to the vice president and principal director for European and NATO policy in the Office of the Secretary of Defense.
"Today, that is no longer the case. In late July, a Russian cruise missile fell on Polish territory. A few days later, three drones loaded with explosives were found at and near an airport in Leipzig, Germany. Two weeks later, Romanian F-16s were scrambled to intercept three Russian drones over Romanian airspace, and a Spanish fighter jet shot down a fourth near the Moldovan border. If someone had described this two years ago as the state NATO would find itself in today — drones over allied airspace, a Russian cruise missile on Polish soil, explosives at a German airport — without any significant collective response from the Alliance, it would have sounded incredible.
Russian President Vladimir Putin’s goals are clear. These attacks are designed to fracture the Alliance’s unity, to test the strength of member states’ commitment to Article 5 — the principle that an attack on one member is an attack on all — and raise the price of support for Ukraine. Less expected, however, was the speed with which his campaign has become something that can no longer be denied.
NATO has not looked away. The alliance tracks these incidents, investigates them, and sometimes intercepts the attacks. But a case-by-case response is not deterrence — and Putin understands the difference. As long as each provocation costs Moscow no more than a downed drone, Putin has every reason to continue escalating. And each further escalation increases the risk that one of these incidents will end in a catastrophic loss of life. Mobilizing collective action to impose a price is the Alliance’s best chance to prevent such a scenario.
The Masks Are Falling
For Russia, hybrid tactics are far from a new art form. As early as the 1920s and throughout the Cold War, the USSR relied on "active engagements": the use of local proxies, covert organizations, and irregular forces to achieve political goals. Today, Putin is essentially following the same model in an attempt to undermine NATO allies’ confidence in Article 5 by relying on tactics that fall below the threshold of conventional war and make unaffected member states hesitant to respond. Plausible denial has always been a key part of these operations. Regardless of the method — Whether it's a severing of undersea fiber-optic cables in the Baltic Sea, a coordinated cyberattack, or an explosion at a factory in Eastern Europe that produces artillery shells for Ukraine, Russia is quick to deny direct involvement. It often turns the tables, accusing NATO countries of "Russophobia" and shifting the blame to Ukrainian or other arbitrary perpetrators.
NATO countries have long known this Russian scenario. Most European members have been the target of numerous hybrid attacks over the past two decades. But since its invasion of Ukraine in 2022, Russia has changed its strategy in two significant ways. First, it has significantly increased the frequency of attacks; according to the Center for Strategic and International Studies, the number of Russian incursions into Europe has quadrupled in the first year of the war. It has also diversified its tactics. In addition to the familiar disinformation campaigns, airspace violations, and cyberattacks, individuals linked to Moscow have sabotaged railway lines, planted incendiary devices on cargo planes, and paid criminal networks in Europe to set fire to weapons depots.
By early 2023, in response to these trends, NATO had increased the seriousness and urgency of its discussions about Russian hybrid activity. The 2023 NATO summit communiqué, which sets out the Alliance’s common positions and priorities, said Russia had “stepped up” its attacks on allies and for the first time mentioned Russia’s use of proxies. The alliance also introduced a number of new initiatives to counter hybrid activity: heads of state and government adopted new goals to protect critical infrastructure and supply chains from strategic disruptions on Alliance territory. They also agreed to establish a NATO Maritime Centre for the Security of Critical Underwater Infrastructure and a Virtual Cyber Incident Support Capacity — a coordination platform to help member states respond to cyberattacks. However, there was no measure to impose a price on Russia. While NATO condemned Moscow’s hybrid warfare, the alliance was not ready to explicitly talk about consequences, such as targeted sanctions, going after Russia’s “shadow fleet” — and the unmarked vessels that Russia uses to circumvent sanctions — offensive cyber operations or information operations.
Part of the problem is structural. NATO was created and designed in 1949 for collective defense against detectable armed attacks. It was not created to impose a price for actions that can be denied. As a defensive military alliance, NATO does not have the authority to impose sanctions or expel Russian operatives from member states. Those powers lie with individual member states and the European Union. Since the 2014 summit, NATO has maintained that a cyber or hybrid attack can trigger Article 5 — — on a case-by-case basis,— but the Alliance has never set a threshold for taking action. Even where the Alliance could act collectively, such as through offensive cyber operations, this requires consensus among 32 countries with very different historical backgrounds, domestic policies and risk appetites.
In the year since the 2023 NATO summit, Russia has continued to step up the pressure, tripling its hybrid attacks in Europe and testing new ways to target NATO territory, such as interfering with European rail systems. As a result, the Alliance has improved its detection, forensic analysis and response capabilities. Member states have shared best practices, participated in command and staff exercises designed to test these capabilities, and developed a new strategy to counter disinformation. Many countries, including Estonia, Germany, Poland and the United Kingdom, have independently launched investigations, sought prosecutions and expelled Russian diplomats and suspected intelligence officers. These steps have been important. But they were not enough to deter Russia.
In 2025, hopes for further NATO action were dashed. When President Donald Trump returned to the White House, he was so focused on getting NATO countries to spend more on defense that almost every interaction with allies began and ended with that single question. This ruthless prioritization has yielded some impressive results. At the 2025 NATO summit in The Hague, all allies committed to spending 5% of GDP on defense by 2035. But rather than accept the gains and turn the Alliance’s attention back to Russia’s hybrid warfare, the administration has continued to pressure allies to spend more and faster. When I visited NATO headquarters in November 2025 and asked former colleagues how they spend their time, the permanent representative of one country replied: "We spend most of our time dealing with you". Amid this turmoil, the Alliance’s momentum on hybrid warfare slowed to a near standstill. Despite an agreement among allies in 2024 to present a new strategy toward Russia at the 2025 Hague summit, no such strategy has emerged. The summit declaration did not even mention Russian hybrid warfare.
The Frog in the Pot
The summer of 2025 seemed like the height of Putin’s confidence. In addition to NATO’s waning focus on hybrid activity, Russia’s summer offensive in Ukraine was showing signs of success, NATO allies were bickering over tariffs and whether Europe was facing what Vice President J.D. Vance called "civilizational suicide", and Putin was being courted by Trump — a dynamic that was publicly demonstrated at the US-Russia summit in Alaska in August.
By September 2025, Putin seemed less concerned with plausible deniability, and Russia’s hybrid warfare campaign was becoming increasingly brazen. That month, some 20 Russian drones entered Polish airspace, and three Russian fighter jets violated Estonian airspace before being shot down and forced out by NATO forces. After each of these incidents, NATO convened Article 4 consultations, which the treaty states are held when “the territorial integrity, political independence, or security of any of the parties is threatened.” NATO launched the Eastern Sentry initiative, which aims to increase NATO’s vigilance on the Alliance’s eastern flank, with no end date set. The initiative placed additional allied air and counter-drone assets under NATO command to bolster the existing integrated air and missile defense system along that border. While a necessary addition to NATO’s efforts to counter hybrid warfare, this step also failed to deter Russian attacks.
In late 2025, as Russia’s battlefield momentum began to wane and Ukraine stepped up its drone and missile attacks on Russian oil infrastructure, Putin accelerated his hybrid warfare to the limit. In December, as temperatures dropped, Russian-backed hackers deployed “wiper” malware, designed to destroy data and disable operating systems, against 30 energy facilities in Poland. Last spring, Russian submarines were spotted near Spitsbergen, a Norwegian archipelago, while testing a new weapon designed to cut underwater cables without being detected. In May, a Russian drone hit a residential building in Romania — the first time such an attack has injured civilians.
The pace of these incursions has accelerated even further over the summer months. In August, groups almost certainly linked to Russia carried out arson attacks in Bulgaria, Estonia, Italy, and Poland, all of which were likely aimed at slowing the flow of aid to Ukraine. One of the most audacious cases was the attack on Leipzig airport in early August: a drone found near a Ukrainian cargo plane was loaded with explosives. In September, a Russian frigate off the coast of Denmark fired two flares at a Danish military helicopter, one of which came dangerously close to the aircraft.
One would expect such a series of events to prompt an urgent and collective NATO response. But Russia’s gradual escalation of these attacks has allowed it to carry out increasingly dangerous actions without paying a significant price. Allies have reviewed these incidents, discussed them, and responded in some way to each one, but have continued to follow the "case-by-case" approach established in 2014. While this provision was intended to preserve the Alliance’s flexibility, it has instead prevented NATO countries from viewing these attacks as a whole and arguing for collective action.
Bringing Allies Together
There is no doubt that NATO must respond more strongly to Moscow’s escalation. Any new strategy, however, must begin with the Alliance’s most powerful member: the United States. But the Trump administration has sent mixed signals about the attacks — sometimes ignoring them, sometimes accepting Russia’s public justifications, and sometimes supporting responses that include the use of force. After the drones entered Poland in September 2025, Trump said that this “may have been a mistake” — a claim that the Polish government has strongly denied. A few days later, during a press conference with Ukrainian President Volodymyr Zelensky, Trump said that he believed allies should shoot down Russian aircraft that enter their airspace. When asked about the drones discovered in Leipzig, Trump replied that “Putin has no intention of attacking NATO territory.” These mixed messages undermine the Alliance’s ability to deter Russia. Convincing Putin to end his hybrid warfare will require a clear signal from NATO’s most powerful member that future attacks will come at a price.
The United States must treat Russia’s hybrid warfare with the same firmness with which it responded to Russia’s threat to use tactical nuclear weapons in the fall of 2022, when Washington issued a direct and public warning to Moscow of the “catastrophic consequences” that would follow such an action. CIA Director John Ratcliffe’s visit to Moscow in August 2026 was reportedly intended to serve a similar function with respect to hybrid attacks, but the White House downplayed the visit, describing it as “semi-routine.” Even if Ratcliffe had issued an ultimatum, Putin would likely take such a threat seriously only if it came from Trump himself.
Showing resolve is only half the equation. Allies should also make the cost of continued aggression tangible. Norway’s seizure of a Russian ship off Spitsbergen in September as punishment for Moscow’s refusal to pay compensation to a Ukrainian energy company it seized in Crimea is one possible pattern. The repeated boarding of French officials aboard sanctioned Russian tankers is another. NATO allies should look for more such moves. The United States, for example, could announce that it is resuming planning for offensive cyber and information operations against Russia — operations that Defense Secretary Pete Hegseth suspended in March 2025. NATO could also pool allied surveillance of Russia’s “shadow fleet” to create a common database of vessels that are falsely flagged, uninsured, or involved in cable-cut incidents. This information could then be shared with individual capitals and the EU so that they can implement more effective sanctions.
Washington’s NATO allies should continue to build up their defensive capabilities and publicly address Moscow’s actions, but they should stop viewing each hybrid attack in isolation and instead identify patterns of Russian aggression that will trigger a NATO response. They should also expand the pre-defined powers of the Supreme Allied Commander Europe—the head of NATO’s military operations. His responsibilities were recently expanded to include control of the airspace of the Baltic states, but they should also cover maritime space, where Russia has been escalating its activities. Moscow maintains a constant patrol of armed ships in the Gulf of Finland that escort tankers from the shadowy fleet, meaning any attempt by an ally to stop a suspected tanker could escalate into a direct confrontation with the Russian navy.
Finally, any Russian hybrid attack should prompt allies to increase their support for Ukraine. Since 2022, Putin has been using every means possible to stem the flow of aid to Kiev. The steady flow of military and economic support, while still ongoing, has significantly diminished since the early months of the war. Returning to this common project would show Putin that burning down warehouses and drone factories will not break NATO’s resolve. The alliance is fortunate that none of Russia’s hybrid attacks have resulted in catastrophic loss of life so far. But as Putin’s risk-taking continues to grow, it’s not hard to imagine that luck will eventually run out.
Source: news.bg