Europe is struggling to respond to Russia’s growing use of hybrid warfare

Since August, Europe has seen a sharp rise in the number of aerial incursions into its territory in which Russia’s involvement is suspected, from swarms of drones appearing near military bases, airports, and energy facilities to far more obvious airspace violations by Russian fighter jets. Novaya Europe has collected and analysed all known incidents of Russian hybrid warfare over the past three months.

Since August 2025, the number of incidents involving airspace breaches and unidentified drones near critical infrastructure has grown noticeably across Europe. At least a dozen countries, most of them NATO members, have reported sightings of suspicious drones flying over military bases, Russian fighter jets violating airspace, and temporary airport closures prompted by drone collision risks.

European governments are ramping up aerial surveillance, discussingnew rules for the use of military force, and increasingly describing these events as part of a hybrid war waged by the Kremlin. At the same time, there is no official confirmation of Russia’s involvement in most of the incidents.

Over the past three months, such episodes have been recorded in various countries: from Ukraine’s neighbours Poland and Romania to Belgium and France. Novaya Europe has compiled an exhaustive list of these incidents and attempted to assess whether they could be considered part of a coordinated campaign.

The sky over Europe

Since the outbreak of war in Ukraine, European countries have regularly recorded such incidents. In 2022, unidentified drones were spotted near oil platforms in Norway, in 2023, a Russian missile violated Polish airspace, and in 2024 the US Air Force detected drone flights near its bases in the UK.

At the time, these cases were seen as isolated incidents, but they had become so frequent by this autumn that many began to speak of the provocations as a new Kremlin strategy to unnerve Europe.

According to our research, between early August and late October this year, there have been at least 67 incidents in Europe involving aircraft and drones believed to be linked to Russia. In recent months, the number of cases has increased steadily: from just 1-3 incidents per week in August to a peak of 17 in a single week at the end of September.

What’s particularly notable is how the geography of these incursions is constantly expanding: Novaya Europe found that, in recent months, incidents had been recorded in at least 17 European countries. Below are the most high-profile episodes during that period:

● 18 August, Norway. An Su-33 fighter jet entered Norwegian territory for one minute near Vardø, the country’s eastern border 170 kilometres from Murmansk. The incident was the third Russian aerial incursion into Norwegian airspace this year alone. Before that, there had been no violations of this kind for over 10 years.

● 9-10 September, Poland. Around 20 Russian drones breached the border. Some were shot down, but most crashed on their own, with their wreckage recovered.

● 19 September, Estonia. Three armed MiG-31s remained in Estonian airspace for 12 minutes.

● 22–26 September, Denmark. Numerous unidentified drones were detected over military bases and critical infrastructure; five civilian and military airports were closed for a week.

● 25 September – 4 October, Germany. Initially, drones were spotted over critical infrastructure including military bases, a hospital, and energy facilities in northern Germany; then, for two consecutive days, Munich Airport had to be closed due to drone threats. Over 10,000 passengers were affected.

● 3 October, Belgium. 15 drones flew over the Elsenborn military base near the German border

● 21–27 October, Lithuania. A series of smuggling balloons from Belarus closed the airspace over Vilnius several times: the airport suspended operations four times in a single week and the country closed its border with Belarus until 30 November.

● 31 October–1 November, Belgium. Kleine-Brogel, a NATO air base where US nuclear weapons are likely stored, recorded two drone flights, though attempts to shoot them down were unsuccessful.

Found objects

We divided all suspected Russian-linked aerial incursions into three main categories: airspace incursions, the discovery of combat drone wreckage (if a border violation was not recorded), and suspected surveillance of critical infrastructure.

● Airspace violations

Since August 2025, the airspace of EU countries has been violated at least 15 times. Five of these incidents involved manned Russian military aircraft — a total of seven fighter jets, one refuelling plane and one military helicopter. Another five incidents involved balloons, likely launched by smugglers from Belarus into Lithuania. The remaining cases were brief incursions by drones, both Russian military drones and unidentified drones from Russia or Belarus. Russia denies any deliberate violation of airspace in all these cases.

Intercepts of Russian aircraft approaching European borders — where a European fighter approaches the offending aircraft and escorts it away from the border — occur frequently, up to hundreds of times a year. However, actual airspace incursions, even lasting only a few seconds, are extremely rare. Such events are considered serious violations of a country’s territorial integrity and can trigger immediate and decisive responses.

For example, in 2015, one crew member was killed when a Russian fighter jet entered Turkish airspace for 17 seconds and was shot down by Turkish air defences after being instructed to change direction 10 times.

● Military drone debris

Remnants of Russian drones have been discovered on at least 10 different occasions in various places across Europe, mostly in Poland and Romania, both of which border Ukraine. For the most part, those that were found turned out to be Geran-1 and Geran-2 drones, modified from Iranian Shahed drones, and not always equipped with explosives. These so-called decoy drones are used by Russia to overwhelm Ukrainian air defence systems.

Sometimes, mass drone incursions appear to be deliberate provocations. On the night of September 9–10, around 20 drones entered Polish airspace, local authorities reported. Ukrainian President Volodymyr Zelensky claimed that over 90 drones were involved, some of which were intercepted by the Ukrainian military.

In some cases, drones were found far from the theatre of military operations, such as in Bulgaria or Latvia. Evidently they sank in territorial waters and were washed ashore.

● ‘Spy’ drones

Unlike the first two categories, “spy” drone incidents are much harder to trace back to the operator. Indeed, some drones that were detected by the authorities turned out to have been flown by TikTok content creators or used to film animals in the wild. In cases where such drones approach critical infrastructure, their pilots face heavy fines that can run to tens or even hundreds of thousands of euros.

Nonetheless, most suspicious incidents have markers of deliberate espionage or sabotage. Typically, it was groups of 10–15 drones which moved in coordinated patterns and were often noticeably larger than typical civilian models that were observed near critical infrastructure.

According to Novaya Europe’s calculations, at least 49 such incidents have been recorded in Europe since August 2025. They were most frequently spotted near airports (23 incidents), military bases (17), and various government buildings (5).

In most cases where drones have been found, investigations are still ongoing, and no official conclusions have yet been reached about who was behind them. European leaders, however, have repeatedly said they believe a professional actor or state is behind the launches. Former German chancellor Olaf Scholz directly linked the wave of drone incursions to Russia, while admitting that definitive proof of Moscow’s involvement had still not been established.

Some experts suggest that the launches may be originating from Russia’s Baltic exclave of Kaliningrad, while most investigations point to the involvement of the country’s so-called “shadow fleet” — vessels sailing under the flag of a third country that are used to export Russian oil in breach of international sanctions.

For example, in August a cargo ship, the Scanlark, was detained in Germany; investigators believe it may have been used to launch a drone over a German Navy ship on 26 August.

How Europe is responding

The true scale of Russian surveillance of military and critical infrastructure in Europe may be far greater than media reports suggest. In some countries, lists of such incidents are classified: the Czech authorities have acknowledged increased drone activity near strategic sites but do not make their details public.

Even when suspicious incidents are not considered secret, not every report of a drone makes it into the press. In Denmark, the police received more than 500 reports from citizens during a barrage of recent drone incursions, but they were unable to process all of them promptly.

In response to the surveillance and provocations, European governments are passing laws that permit the shooting down of drones violating airspace and threatening infrastructure.

Heads of Europe’s largest defence firms including Airbus and Thales Belgium have also confirmed that they have noticed increased drone activity near their facilities, but they add that they have not been given clear instructions about what to do in such situations.

In response to the surveillance and provocations, European governments are passing laws that permit the shooting down of drones violating airspace and threatening infrastructure. Germany is preparing legislation that would allow police to neutralise such drones using firearms, lasers, or signal jamming. Likewise, both Lithuania and Romania have authorised their armed forces to shoot down drones illegally entering their airspace.

At the same time, defence infrastructure is being upgraded and expanded, and the EU is to make additional funding available, allowing it to assemble a “drone wall” — a system of sensors, interceptors and countermeasures along its eastern flank — by the end of 2027. NATO is also bolstering its eastern presence by launching Operation Eastern Sentry to expand air-defence capabilities, improve its own drone reconnaissance and upgrade its military hardware on NATO’s eastern border.

European politicians say the rise in aerial incidents is aimed at increasing pressure on Europe, diverting attention and weapons away from the front in Ukraine, and sowing fear and doubt about the EU’s ability to protect its own airspace. The objective of this pressure is not to destroy infrastructure but to demonstrate the opponent’s vulnerability.