Hybrid warfare A test for Europe's defences

Introduction: Conceptual framework

The concept of hybrid warfare has evolved considerably since former Pentagon analyst Frank Hoffman's 2007 formulation. It gained renewed prominence following Russia's 2014 annexation of Crimea, which brought greater attention to state‑led campaigns combining military and non‑military instruments. The European Commission and the European Centre of Excellence for Countering Hybrid Threats (Hybrid CoE) conceptualise hybrid threats as an umbrella concept; covering coordinated activities that combine different instruments to exploit vulnerabilities, influence decision‑making and advance strategic objectives. Their model analyses such activity through the interaction of actors, objectives, tools, targeted domains and phases of action, explicitly stating that 'not every tool and activity that targets a domain may be classified as hybrid threat'. Therefore, an activity is not labelled as a hybrid threat if a particular tool is used, but if different instruments are deliberately combined to pursue a strategic objective and generate cumulative or synergistic effects. That is to say, a cyber intrusion conducted for espionage or data theft, an unrelated foreign information manipulation and interference (FIMI) campaign and economic pressure do not necessarily constitute a single hybrid campaign, merely because they originate from the same actor. Conversely, a sequence in which a cyber operation disrupts infrastructure, an information operation amplifies uncertainty surrounding the disruption, and another act exploits the resulting pressure, may be more clearly part of a hybrid campaign.

Within this framework, hybrid warfare represents a 'hard end' of the escalation spectrum of hybrid activity; an escalated phase in which activities may increasingly involve military means and move from under‑detection towards overt coercion, i.e. progressing beyond phases of priming and destabilisation. Hybrid threats, by contrast, do not necessarily have a military dimension or involve the use of force. The distinction between the two terms therefore primarily concerns coordination, strategic purpose and escalation. The term has since been applied to an increasingly broad range of activities and its proliferation has generated debate about its analytical value – with concerns that 'hybrid' can become a catch‑all label that obscures the actor, instrument, objective, legal status and appropriate response.

Instrumentalising migration: Exerting pressure on the EU's external borders

The instrumentalisation of migration can exploit political, legal and societal vulnerabilities by generating or redirecting migratory pressure, straining border and reception capacities, consuming resources, amplifying societal divisions and increasing polarisation. According to the Hybrid CoE, this can involve manipulating 'push' and 'pull' factors, using cross‑border movements to create a pretext for intervention, and exerting diplomatic pressure by highlighting the target's response. The Hybrid CoE generally uses the term 'instrumentalisation of migration', which focuses on the manipulation of migratory flows as a tool of coercion, whereas the EU has also used 'instrumentalisation of migrants', which places greater emphasis on the individuals subjected to such manipulation.

Belarus provides a clear example of state‑sponsored instrumentalisation of migration. In 2021, Belarusian authorities facilitated travel to Belarus and onward transport towards its borders with Poland, Lithuania and Latvia, where groups of migrants from countries, such as Iraq and Afghanistan, were directed towards EU crossing points. The situation escalated in November 2021, when several thousand people gathered on the Belarusian side of the Polish border, amid reports of Belarusian security personnel assisting crossing attempts. By mid‑November, the EU had recorded 7 698 arrivals from Belarus in 2021, alongside more than 40 000 migrants prevented from repeated crossing attempts. Belarusian authorities reportedly facilitated the arrival of migrants by issuing short‑term visas and increasing flight connections, arranging accommodation in state‑owned hotels and then organising transport to the EU border. President von der Leyen called the incident a 'hybrid attack' and condemned the exploitation of vulnerable people for political purposes, while the EU attributed the organisation and facilitation of migrant movements to the Belarusian regime. The EU also imposed sanctions on the individuals and entities involved. The European Council subsequently called for stronger external‑border protection, action against smuggling and trafficking, humanitarian support and the return of migrants from Belarus. The EU also supported affected Member States through Frontex deployments and technical assistance, while working to halt flights to Belarus and cooperate with countries of origin and transit to facilitate returns. The pattern has persisted beyond 2021, although it has shifted geographically: in 2026, attempted crossings declined sharply at the Polish border, while Latvia has experienced a renewed increase. The 2025 European Annual Asylum and Migration Report confirmed that 'actions by Russia and Belarus continue to influence migratory dynamics at the Eastern border'.

More recently, the events in Ceuta raised concerns about the exploitation of migration and the information environment. On 30‑31 July 2026, an unprecedented mass crossing into Ceuta saw an estimated 80 000 (primarily Moroccan) migrants enter the Spanish autonomous city. With the circumstances and responsibility for the crossing under investigation, Spain's National Court opened a criminal investigation into the events, whilst Prime Minister Pedro Sánchez described the incident as an attack on Spain's territorial integrity. The crisis also raised questions about maritime activity in the area, with Sánchez, in October 2026, confirming that a Moroccan frigate and several patrol boats had sailed in Spanish waters without authorisation during the influx. Some reports also alleged that Moroccan intelligence personnel operating as civilians had been involved in coordinating or monitoring the movement. Furthermore, social media reportedly carried misleading claims about facilitated asylum procedures, with fact‑checkers having identified disinformation circulating in Morocco, that distorted a June 2026 Spanish Supreme Court ruling. Facebook was reportedly used for mobilisation, while logistical discussions took place in WhatsApp groups.

The Commissioner for Internal Affairs and Migration, Magnus Brunner, characterised the crossings into Ceuta as a test of the EU's resilience and border management. Member States responded by strengthening air, maritime and police border patrols, while some temporarily reintroduced internal Schengen border controls. In early August 2026, EU members committed to supporting Spain, taking action against smuggling networks, and strengthening return procedures, common situational awareness, media monitoring and measures to counter FIMI. In her 2026 State of the Union address, President von der Leyen called for stronger Frontex capabilities, improved early warning systems, and deepened partnerships with third countries. She emphasised addressing irregular migration, alongside the need for greater EU capacity to detect online threats. Von der Leyen also proposed a 'European Emergency Response Framework', which could be activated under defined criteria to allow 'time‑limited and strictly defined flexibility in standard [asylum] procedures' in circumstances involving 'engineered and weaponised' mass movements. This would complement the Crisis and Force Majeure Regulation, applicable from July 2026, which is to provide for specific adjustments to asylum and migration procedures in crisis situations. On 29 September, the Commission proposed a related 5‑point plan to prevent, anticipate and respond to sudden, mass illegal arrivals, which was presented at the Justice and Home Affairs Council of 1‑2 October 2026. The information dimension of the crisis prompted a parallel response: Commissioner for Tech Sovereignty, Security and Democracy Henna Virkkunen called on social media platforms to take greater responsibility and held meetings with Meta and TikTok on removing digital channels allegedly used by smugglers to encourage crossings. The EU also called on platforms to strengthen real‑time monitoring, cooperate with independent fact‑checkers and rapidly remove content facilitating migrant smuggling.

Exploiting emerging technologies: Recurrence of UAVs

Since 2022, Member States have recorded intensifying missile and drone incursions and repeated airspace violations by Russian military aircraft. At least 16 NATO members have reported drone airspace violations or found remnants of drone technology over the past two years, mostly near military facilities and infrastructure. Such incidents can put pressure on air‑defence response times and decision‑making thresholds of defence and civil‑military command structures, expose vulnerabilities around critical infrastructure and military logistics, disrupt civilian aviation and generate economic costs, as well as undermine public confidence in airspace security. Their cumulative effect may also normalise low‑level airspace violations below the threshold of a direct military response.

Recent incidents illustrate how unmanned aerial vehicles (UAVs) can blur the boundaries between military and hybrid activity. In August 2026, Germany found an explosive‑laden drone on the runway at Leipzig/Halle airport, one of Europe's largest cargo hubs and supply line for Ukraine. According to the German Federal Minister of the Interior, the attack was carried out by professionals, and was likely a 'hybrid threat scenario'. In December 2025, the head of Germany's Federal Criminal Police Office said that over 1 000 suspicious drones had been registered in 2025, representing a 'significant situation of danger'. On 1 September 2026, Germany formally blamed Russia for the Leipzig incident: it then announced the closure of the Russian House in Berlin and Russian Consulate in Bonn. However, Russia denied responsibility. That same month, Romania rushed to assemble jets to destroy a naval drone sailing close to its gas platform in the Black Sea. In addition, a Russian Gerbera 2 drone was found off Poland's northwestern coast carrying a warhead with a detonator. Subsequently, NATO air policing fighter jets shot down a drone that entered Lithuanian airspace, prompting temporary warnings of a possible air threat in several municipalities; and a Russian frigate fired flares at a Danish military helicopter off the southern coast of Denmark, described by Denmark's Prime Minister as part of a 'hybrid war against Europe'. Furthermore, in October 2026, a series of drone attacks targeted merchant vessels in Romania and Bulgaria's exclusive economic zones in the Black Sea, causing civilian casualties and leaving crew members missing, further extending the incidents from airspace and critical infrastructure, to maritime traffic.

This challenge is compounded by the difficulty of attribution and the relatively low cost of UAVs. Europe's air defence architecture was traditionally designed to detect and counter conventional air threats operating within a relatively predictable battle space. Russia's UAV campaign is seen as having exposed gaps in allied air defences, detection, legal authority and political cohesion, 'revealing that the threshold for collective punishment was higher than European deterrence postures have assumed'. Experts also urge paying attention to the possibility that Russia might get hold of Ukraine‑manufactured UAV s and direct the attack against NATO member countries under false flag operations, which could provoke an asymmetric reaction. Furthermore, vertical take‑off and landing drones can operate from vessels with limited deck space, making them potentially suitable for covert operations from Russia's 'shadow fleet'; illustrating how different domains and activities can reinforce one another.

The EU has moved towards strengthening both its ability to use and counter unmanned systems. In Versailles in March 2022, EU leaders committed to invest in critical and emerging technologies. Uncrewed systems feature prominently in the EU's 2023 capability development plan, as well as in NATO‑interoperable air‑defence systems capable of addressing 'slow, small, and low‑altitude threats' and drone swarms. The 2025 white paper for European defence identifies drones and counter‑drone systems as one of seven priority areas, while the Commission's February 2026 action plan on drone and counter‑drone security focuses on preparedness, detection and a coordinated response. The EU is also pursuing concrete capability development. As part of the so‑called readiness 'flagship' defence projects, the European Drone Defence Initiative (EDDI) is set to establish as a multilayered network of sensors, electronic warfare systems and interception drones along the EU's eastern border, alongside a longer‑term 360‑degree counter‑drone architecture. The EDDI is expected to begin operating by the end of 2027, with basic radar and infrastructure deployed by the end of 2026. In October 2026, the Commission announced an additional €130 million under the border management and visa instrument for counter‑drone capabilities, bringing total EU financing for surveillance and counter‑drone technology under the Home Affairs funds to more than €500 million. Permanent Structured Cooperation (PESCO) projects complement these efforts – for example: EURODRONE for medium‑altitude, long‑endurance, remotely piloted aircraft; C‑UAS for detecting and neutralising hostile drones; the Next Generation Small RPAS project (NGSR) for tactical unmanned systems, and MAS MCM, integrating autonomous technologies countermeasures against sea mines.

The response depicts a movement beyond treating drones as a niche capability, towards recognising them as a structural feature of Europe's security. The EU strategic compass and the NATO strategic concept both identify emerging and disruptive technologies, including drones, as priorities in cooperation. The European Defence Agency (EDA) works with NATO's joint capability group on unmanned aircraft systems (UAS), and the EU has also joined NATO‑led drills like REPMUS, focusing on maritime autonomous systems. NATO has developed several key frameworks addressing the use and countering of UAS, including the strategic concept of employment for UAS and the layered counter‑UAS initiative. Simultaneously, NATO is racing to adopt new technologies capable of detecting drones at greater distances and neutralising them without wasting expensive weaponry, as part of NATO's drone edge announced at the 2026 Ankara summit. Until then, fighter aircraft remain the principal, high‑speed response to drones entering allied airspace, with F‑16 and F‑35, as well as Eurofighter Typhoons, having been deployed in counter‑drone missions. Member State responses have also been strengthened. For example, Belgium is equipping its F‑16 fighter jets with specialised Thales rocket pods to improve and lower the cost of countering large drone swarms. Denmark is developing an AI‑supported drone defence system, and Poland is changing procedures to allow fighter pilots or the operational commander to engage foreign aircraft based on radar and other indicators of hostility, without requiring visual identification.

Not every hostile drone incident is necessarily part of 'hybrid warfare'. A drone may represent conventional military activity or vulnerability exploitation, or it may be part of a hybrid campaign, depending on its purpose, coordination and intended effects. In other words, when a drone is deliberately directed against a NATO member, it can be classified as a hybrid attack depending on whether the incident forms part of a wider strategy generating cross‑domain effects, rather than whether it constitutes a kinetic attack. The challenge is not only to detect more objects in European airspace, but also to adapt deterrence and decision‑making to calibrated, low‑cost threats. Distinguishing an isolated disruptive act from a coordinated campaign may become as important as detecting and defeating the drone itself.

Weaponising cyberspace: Critical infrastructure attacks

Cyberspace is increasingly recognised as an enabler of hybrid activities. NATO recognised cyberspace as a domain of operations in 2016, while the EU refers to it as the fifth 'domain of warfare'. Although these designations reflect different institutional frameworks, both recognise the growing importance of cyberspace for Euro‑Atlantic security. Cyber capabilities can disrupt critical infrastructure and essential services, enable espionage and information manipulation, compromise military command and communications, and support or complement covert and kinetic operations. The 2022 Russian cyberattack on Viasat's satellite network, launched shortly before the full‑scale invasion, illustrates how cyber operations can accompany broader military campaigns and produce effects beyond the digital domain.

In July 2026, EU Member States denounced Russia's malicious cyber activities 'encompassing state and non‑state actors, ranging from intelligence services to cybercriminals groups, hacktivists and private companies', attributing sustained cyberattacks to the 16th Centre of Russia's Federal Security Service. The service is said to have controlled multiple cyber threat actors, including the Turla group. Reported activities included infiltration of governmental networks and sabotage of critical infrastructure in France, Germany, Poland, Cyprus, the Netherlands, Austria, Slovakia, Romania and Finland. In Poland, the 16th Centre was linked to disruptive operations against infrastructure, including combined heat and power plants; in France, it targeted the defence industry in 2025; and in Germany, governmental entities were targeted also.

Cyberattacks can constitute espionage, cybercrime, 'hacktivism', disruption or sabotage within the cyber domain, without forming part of a broader hybrid campaign. The European Union Agency for Cybersecurity (ENISA) recently published the 2026 Threat Landscape, covering incidents recorded from 1 January to 31 December 2025, which illustrates these blurred boundaries. It found that 73 % of targeted organisations were essential or important entities under the NIS2 Directive. Public administration remained the most targeted sector, followed by business services, transport, manufacturing and banking and finance. Public administrations were particularly affected by ideology‑driven distributed denial‑of‑service (DDoS) attacks. Many hacktivist claims against EU Member States coincided with political developments, including elections, protests and Member States' support for Ukraine. ENISA observed similar techniques, infrastructure and access mechanisms across cybercrime, hacktivist and state‑nexus activity, further complicating attribution and creating opportunities for plausible deniability. ENISA also noted the growing use of AI by malicious actors to enhance cyber operations and extend the scope of attacks. Related to this, President von der Leyen highlighted the hacking incident with the start‑up Hugging Face, linking it to wider concerns about AI versus the resilience of ICT networks.

Member States have responded by raising awareness and strengthening preparedness. In September 2026, Denmark raised its threat level for destructive cyberattacks from medium to high, citing assessments of Russian plans for acts of sabotage. This follows the 2024 cyberattack on Danish waterworks by pro‑Russian hackers, which temporarily left around 450 households without water. The EU has strengthened its ability to prevent, deter and respond to malicious cyber activity through its cyber diplomacy toolbox, adopted in 2017 and further strengthened in 2023. It enables Member States to use common foreign and security policy measures in response to cyberattacks, including restrictive measures through a dedicated sanctions regime. The 2022 EU cyber defence policy and the white paper on European defence both place cyber capabilities within the wider defence capability framework. The white paper identifies cyber (along with AI, quantum and electronic warfare) as one of the defence capability domains. It argues in favour of developing a voluntary support scheme for Member States' offensive cyber capabilities that can function as credible deterrence – recognising that 'both defensive and offensive cyber capabilities are needed to ensure the protection and freedom of manoeuvre in cyberspace'. The EU has also committed financial and operational resources in this area, including €700 million of the €150 billion Security Action for Europe loan. It has also dedicated €200 million through the European Defence Fund to cyber‑related research and development; focused on enhancing awareness, investing in skills development and building secure military cloud and communications networks. Moreover, the Digital Europe Programme supports wider cybersecurity capacities with a €7.5 billion budget for 2021‑2027. The cyber solidarity act has established an EU cybersecurity reserve for major incidents, while PESCO's cyber rapid response team's project provides an assistance mechanism for responding to cyber threats.

The EU and its Member States face a dual challenge: strengthening the resilience of civilian and defence systems; while developing capabilities, partnerships, and legal and diplomatic tools to deter and respond to state‑ and non‑state‑sponsored cyber operations. The aim is to maintain the ability to operate under persistent cyber pressure and respond in ways that discourage further attacks or exploitation of compromised systems. The decisive question is not whether an attack is 'cyber' or 'hybrid', but how it fits into a wider campaign and what strategic effect it is intended to produce.

Expert views: Responding to grey‑zone threats

Experts differ on terminology, but broadly agree that Europe's response to grey‑zone activities remains constrained by difficulties in attribution, coordination and proportionality. Some warn that an incorrect or excessive use of the term 'hybrid' can complicate responsibility‑sharing and blur the allocation of institutional roles. The think tank GLOBSEC identifies Europe's limited ability to impose 'meaningful costs' below the threshold of NATO's Article 5 as a deterrence gap and argues that clearer definitions and red lines could support a more effective response. Experts from the Center for European Policy Analysis similarly advocate proportional and coordinated responses based on intelligence and pattern recognition, rather than relying exclusively on evidentiary standards associated with criminal proceedings 'built for peacetime stability'. Alongside Hybrid CoE, they emphasise the need for leaders to analyse the broader campaign and responsible actors, rather than respond to incidents in isolation, while maintaining ambiguity over specific retaliatory measures. Addressing Parliament's Security and Defence Committee in September 2026, NATO's Supreme Allied Commander Europe (SACEUR) called for greater public attribution and calibrated responses to hybrid incidents. He cited Denmark's fast-tracked €250 million support package for Ukraine following the September incident as an example of an asymmetric response that can impose costs without direct military escalation. He also stressed that where several allies are affected, responses should be coordinated, to avoid divergent levels of escalation that undermine collective posture and deterrence. On 12 October 2026, SACEUR unveiled the 'Theory of Victory', under which NATO Commander Alexus Grynkewich outlined a resolve to 'block, blunt and break' any Russian attack.

With regard to addressing crises and force majeure, an expert at the European University Institute (EUI) stresses the difficulty during mass arrivals at EU borders; of identifying vulnerable applicants, applying expedited procedures, as well as ensuring adequate reception conditions and procedural safeguards. On Ceuta specifically, the European Digital Media Observatory (EDMO) highlights the value of the rapid action against disinformation as a potential model for future crises, stressing the need for adequately resourced FIMI monitoring structures and specialised expertise. On aerial threats, the International Institute for Strategic Studies identifies uneven drone detection, fragmented legal authorities, disproportionate response options and attribution 'too slow to support timely deterrence' as key weaknesses, alongside highlighting limited public attribution. It also questions whether the EDDI can deliver scalable results without greater agility and operational coherence, noting that interception capabilities do not necessarily address the platform from which a drone is launched – i.e. it could only target a UAV after it enters European airspace. A former Slovak defence minister suggests asymmetric measures against covert operations attributed to Russia, such as restrictive measures or detaining vessels linked to Russia's 'shadow fleet' in response to allied airspace violation. On cyberspace, the Royal United Services Institute notes the increased use of attribution and cyber sanctions. It further recommends calibrating economic measures according to the relationship with the targeted actor and their potential to influence behaviour, strengthening coalition‑building, and improving public communication on the implementation of proactive measures across the EU and NATO's cyber toolkit. An associate with the Center for Strategic and International Studies, meanwhile, believes that resilience and 'deterrence by denial' should be complemented by independent European cyber capabilities, including the capacity to conduct proportionate cyber countermeasures under international law.

European Parliament position

In its January 2026 resolutions on the EU's common security and defence policy (CDSP) and common foreign and security policy (CFSP), Parliament stressed that hybrid activities extend beyond cyber and information operations, highlighting UAV and balloon incursions, sabotage, military provocations, smuggling and the instrumentalisation of migration. Parliament called for an EU action plan to counter Russian hybrid warfare, stronger EU‑NATO cooperation, enhanced resilience and civil preparedness, and to take lessons from Ukraine on countering Russia's information operations. That month, Parliament also called for expanded electronic warfare units and jamming protection, drone defence zones near critical infrastructure, national drone testing hubs, and for the integration of drones into CSDP missions. It recommended stronger sanctions targeting Russian drone supply chains and technological transfers. In September 2026, Parliament adopted resolutions on EU's territorial integrity and critical security and defence infrastructure, and on the instrumentalisation of migrants, linked to the events in Ceuta. The former highlighted gaps in the EU's real‑time monitoring of FIMI and proactive response capabilities, and called for cognitive vulnerabilities to be addressed in the forthcoming EU security strategy, alongside an investigation into the 'assault on the EU's southern border' in Ceuta. On drones, Parliament noted the high cost of interception and fragmented counter‑drone frameworks, calling for faster implementation of the relevant EU action plan, including dedicated funding for layered defence in frontline Member States. The latter resolution condemned the instrumentalisation of migration as a tool of hybrid warfare, and urged increased funding – including for external border protection, stronger Frontex capabilities and a rapid deployment of relevant EU instruments during crises, hybrid threats and instrumentalisation. Parliament also called on the Commission and EEAS to assess possible facilitation, deliberate inaction or involvement by state or non‑state actors in Ceuta. In June 2026, Parliament condemned Russia's provocative actions on the eastern flank, recommended integrating C‑UAS into joint training and EU civil protection planning, and called for a horizontal EU sanctions framework for hybrid threats.