There’s a word European governments reach for whenever Russia does something nasty on our side of the border. The word is “hybrid”, and it’s become the most overworked adjective in European security.
A drone packed with explosives turns up at a German airport: hybrid. A Polish drone factory burns: hybrid. A Russian warship fires flares at a Danish helicopter: hybrid. A man in a tent in North Rhine-Westphalia fires home-made rockets at power lines: hybrid, until it turns out he probably wasn’t.
The word is doing an enormous amount of lifting, and it’s starting to buckle.
What “hybrid” was supposed to mean
The idea is simple enough. Hybrid activity is hostile action kept deliberately below the threshold of war. It’s deniable or ambiguous, and designed to pressure a state without handing it a clear reason to hit back: sabotage by proxy, jamming, disinformation, the odd fire nobody can quite pin on anyone. The point is the grey. You feel the damage, but you can’t prove who did it, and you can’t justify a military response to it.
That’s a useful concept. The trouble is what it has turned into: a catch-all for “anything Russia does to Europe that isn’t a tank column.”
Five different things, one lazy label
Look at the last three months, from mid-June to mid-September 2026, and sort the incidents honestly. They fall into at least five different piles.
Covert sabotage. This is the genuine article. Arson at Milrem Robotics in Tallinn. A foiled plot to torch a drone factory in eastern Slovakia. A masked man planting an incendiary device at WB Electronics in Skarżysko-Kamienna. Most of the people doing this were recruited online and paid in crypto, and are disposable. Add the constant GPS jamming across the Baltic. This is hybrid in the proper sense.
And the recruiting pool is getting younger. In September, research by the Institute for Strategic Dialogue found “multiple indicators suggesting possible Russian state-linked support” for parts of the “Com” networks, online groups of teenagers and young adults who compete for status by causing or filming extreme harm. The offers reportedly include money, guns, and training in explosives and poisons. At least two acts of vandalism in Britain have already been filmed and posted in the name of one of these groups. “Hybrid” doesn’t just hide what’s being done. It hides who’s being put in harm’s way.
State-directed violence. This is not “hybrid” in any meaningful sense. At Leipzig/Halle in August, a drone reportedly carrying PETN was found beside a Ukrainian cargo aircraft at one of NATO’s key logistics airports. Berlin has formally blamed Russia, and GRU-linked suspects have been named. In Warsaw, Polish services foiled a Russian plot to kill a Ukrainian-American. In September, US prosecutors charged a Russian intelligence network with murder-for-hire plots stretching from Vilnius to Washington. Using deniable methods doesn’t make an attempted bombing or an assassination a grey-zone nuisance. If the Leipzig device had gone off, nobody would have called it hybrid.
Open military intimidation. In July, the frigate Admiral Grigorovich fired warning shots near a British yacht; why is still unexplained. In September, a Russian warship off Gedser fired two flares at a Danish military helicopter, one passing within metres of it. Moscow then gave the commander a medal. There’s nothing deniable about a uniformed warship and a public decoration. That’s coercion, done in the open, on purpose.
The same logic now extends to Western visitors to Ukraine. When European leaders came to Kyiv for Independence Day on 24 August, Russian state media didn’t hide what it wanted. On Rossiya 1, a speaker complained that “the unfinished-off ones have come to Kyiv again” and asked why they travel there “as if it’s their own home”. On Radio Komsomolskaya Pravda, the answer offered was that to stop them coming, they would need to be “collected there in pieces”.
Less than two weeks later, as US envoys Steve Witkoff and Jared Kushner prepared to fly in, Russia struck the airports at Kyiv and Boryspil, forcing the delegation onto the train. On 13 September, a Russian drone hit a train at Yahodyn, on the Polish border, minutes after a diplomatic train carrying Boris Johnson and European security advisers had crossed over, with former CIA director David Petraeus still at the station. Nobody can yet prove Russia was trying to kill anyone in particular. But first the airports, then the railway, after state TV had spent weeks musing about blowing up visitors: that’s a pattern, not bad luck.
Preparation for war. Near Svalbard this spring, Russia’s deep-sea directorate, GUGI, was caught rehearsing a weapon designed to disable undersea cables without leaving a trace. British, Norwegian and American forces broke it up. That isn’t peacetime harassment. It’s Russia rehearsing for the first hours of a war with NATO.
War spillover. Russian drones keep crossing into Romania and Moldova as Moscow pounds Ukraine’s Danube ports. Romania shot some down this summer for the first time in its history. Dangerous, yes, but Bucharest itself doesn’t claim it’s being deliberately targeted.
Five categories. One word.
Why the word is dangerous
“Hybrid” does damage in both directions.
It shrinks the serious stuff. File an attempted bombing at a NATO airport in the same drawer as a warehouse fire, and it starts to sound manageable. “Hybrid” sounds like something handled by a working group and a press release, not something that nearly killed an aircrew. That suits Moscow perfectly. The whole design of the campaign is to stay just below the line where Europe would have to respond properly. Our vocabulary is helping it stay there.
It inflates the rest. In early September, a German man spent days firing timed rockets at high-voltage lines near coal plants. His claim letters were explicitly anti-fossil-fuel, and the Interior Minister called it very likely lone-actor climate terrorism. For days, though, the working assumption was Russia. In August, an explosion at the KNDS shell plant in Colleferro, Italy, was quickly slotted into the Russian narrative before prosecutors treated it as an industrial accident. Every false alarm spends credibility we’ll need when the real one comes.
It lets politicians dodge the threshold question. “Hybrid” is a label that doesn’t oblige anyone to do anything. Asked whether the Gedser incident warranted NATO consultations, Denmark’s defence minister said: “we are not there.” Maybe not. But when a word lets every incident be absorbed without anyone having to say where the line actually is, the line keeps quietly moving.
The escalation nobody wants to name
Stack the summer’s events in order and the direction is obvious.
It began with cheap proxy arson against companies supplying Ukraine, carried out by recruits who are now, it seems, being sought among British teenagers. Then came an explosive device on a drone inside the perimeter of a NATO logistics airport. Then plots to kill people on allied soil, including a US citizen. Then state television openly wondering why Western visitors haven’t been blown to pieces, followed by strikes on the very airports and railway those visitors use. Then two Russian warships, two months apart, firing towards allied craft. Behind all of it sits a rehearsal for cutting the cables Europe’s economy runs on.
Each step is more physical, more direct and more willing to risk a body count. Russia is testing what it can get away with, and so far the answer is: quite a lot, provided we keep calling it hybrid.
The danger isn’t a single dramatic attack out of nowhere. It’s normalisation: a fire here, a flare there, a train hit just after the diplomats have gone, each one filed and forgotten, until a device actually goes off, or a helicopter goes down, or a cable is cut in the middle of a crisis. At that point we’ll discover the threshold was crossed months ago, and we were too busy with the adjective to notice.
Call things what they are
This isn’t pedantry. Words shape responses. An attempted bombing should be called an attempted bombing. State-ordered assassination plots are state terrorism. Warships firing at allied aircraft, and missiles aimed at the routes foreign leaders travel, are military intimidation. Rehearsing to cut undersea cables is war preparation.
Keep “hybrid” for what it actually describes: deniable, below-threshold pressure. Everything else deserves its real name, and a response to match.
Europe doesn’t need a better adjective. It needs to stop hiding behind one.
My Full list: 17 June to 17 September 2026
1. Covert sabotage (hybrid proper)
Tallinn, Estonia, 15 Aug: arson at Milrem Robotics. Russia is a suspected line of inquiry; suspects were detained in Latvia.
Eastern Slovakia, 25 Aug: a drone-factory arson plot was foiled and three people detained, suspected of acting on someone’s orders.
Skarżysko-Kamienna, Poland, 31 Aug: arson at the WB Electronics drone plant. It’s being treated as sabotage, with a terrorism probe and Russia’s ambassador summoned.
Baltic Sea, ongoing: GPS jamming, including against the Polish minehunter ORP Albatros on 21 Aug. Suspected source: Kaliningrad.
2. State-directed violence
Leipzig/Halle, Germany, 4–5 Aug: explosive drone next to a Ukrainian cargo aircraft. Germany attributed it to Russia, and GRU-linked suspects have been named.
Warsaw, Poland, arrest 7 Aug: foiled plot to kill a Ukrainian-American. Attributed by Poland.
US DOJ “RIS” network, unsealed 16 Sep: five Russian intelligence operatives charged, including over the Vilnius and Washington murder-for-hire plots. Attributed by the US.
3. Military coercion and conflict preparation
UK waters, 14 Jul: the Admiral Grigorovich fired warning shots near a UK yacht. The event is confirmed; the reason isn’t.
UK waters, July: about three weeks of Royal Navy shadowing of Russian warships and submarines escorting shadow-fleet tankers.
UK waters, 23–26 Jul: HMS Severn shadowed the Neustrashimy.
Svalbard, spring 2026, disclosed 10 Sep: GUGI rehearsed a cable-sabotage weapon and was disrupted by the UK, Norway and US.
Russian state media, 24 Aug: Rossiya 1 and Radio Komsomolskaya Pravda openly discussed striking Western leaders visiting Kyiv for Independence Day. This is context for the next two entries, not an incident itself.
Kyiv and Boryspil airports, 4–6 Sep: strikes as a US flight for Witkoff and Kushner was being discussed. Zelensky called them deliberate, and ISW says they forced the delegation onto the train.
Yahodyn, Ukraine, 13 Sep: a Russian drone hit a train at the Polish border minutes after a diplomatic train carrying Boris Johnson and European security advisers had crossed, with David Petraeus still at the station. It was a deliberate strike on the diplomatic travel corridor and fits a pattern of targeting Western visitors’ routes. Intimidation is probable. An intent to kill specific people is unproven, though coincidence is hard to credit.
Off Gedser, Denmark, 14 Sep: a Russian warship fired flares at a Danish Fennec helicopter. Denmark summoned the ambassador; Moscow decorated the commander.
Yahodyn–Dorohusk corridor, 13, 16 and 17 Sep: repeated Russian jet-drone strikes at or near the crossing. On 13 Sep a train was hit minutes after the diplomatic train left. On 16 Sep and again on 17 Sep, Poland issued air-raid alerts, closed the Lublin and Rzeszów airports and scrambled jets. On 17 Sep sirens sounded in Lublin, officials confirmed it was not a drill, and a target near the crossing, probably a petrol station, was hit 3–4 km inside Ukraine.
4. War spillover
Romania, 24–26 Jul: three drones shot down, including at least one Shahed. These were the first shootdowns in Romania’s history.
Romania, 2 Aug and 21 Aug: further drone incursions, including a shootdown near a Black Sea gas project.
Moldova and Romania, 8 Sep: a Shahed-type drone crossed both countries and crashed in Moldova; Spanish F/A-18s were scrambled.
5. Espionage and counter-intelligence
Poland, 2026: about 55 arrests for aiding Russian intelligence, including suspected saboteurs held in August.
Germany, 1–2 Sep: 150+ Russian mission staff and family members expelled, and the Bonn consulate and Russian House closed.
Russia, September: tit-for-tat closure of Germany’s St Petersburg consulate and Goethe-Institut operations.
6. Not sure
EMCO, Bulgaria, 10 Aug and 12 Sep: two ammunition-site fires. The company alleges sabotage; officials haven’t said. The owner survived a 2015 Novichok poisoning.
Lublin, Poland, 30 Aug: fire at a helicopter-parts plant. Arson hasn’t been ruled out.
Grid saboteur Daniel V., Germany, 1–8 Sep: timed rockets aimed at power lines near coal plants. Called a lone climate extremist; a state link is unproven.
Wunstorf, Germany, 14–15 Sep: a drone crashed near a Bundeswehr airbase. Origin unknown.
Lithuania, 15 Sep: a drone was shot down in Lithuanian airspace. It could be spillover or deliberate.
UK “Com network” recruitment, reported 15 Sep: ISD research, via The i Paper, found indicators of possible Russian state-linked recruitment of teenagers, with offers of money, guns and explosives training. The two linked UK vandalism incidents in Bedford (April and May) fall outside the window and are context only.
Excluded
KNDS Colleferro, Italy, 13 Aug: officially an industrial accident.
Airport drone wave, Sep–Oct 2025: outside the window for this article.
Yantar shadowing, Jan and Nov 2025: outside the window for this article.
Trends
More physical risk: an explosive drone at a NATO hub, a plot against a US citizen, strikes on Western visitors’ travel routes, and two warships firing towards allied craft within two months.
Two campaigns at once: deniable proxy arson against the Ukraine supply chain, and overt military intimidation at sea and around diplomatic travel.
Younger proxies: recruitment is apparently moving from paid, desperate adults towards teenagers in online harm networks.
Undersea threat: no confirmed cable damage in the window, but the Svalbard disclosure shows Russia preparing the capability to cut cables in a war.
Hotspots: Poland, Germany, the Danish straits and Baltic, UK waters, Romania/Moldova, and the Kyiv–Polish border corridor.
Undercounting: the final week, 10–17 Sep, alone produced eight items, so this list is probably still incomplete for mid-September, still waiting on more details.