Russia's Shadow War: 100 Hybrid Incidents Test NATO

On Monday, Europe's two halves of the same warning arrived within hours of each other. In Brussels, EU foreign policy chief Kaja Kallas said Russia is putting lives at risk across Europe with hybrid attacks, speaking alongside Moldova's prime minister after Russian drones crossed into Moldovan airspace again over the weekend (Reuters, October 5, 2026). In Berlin, the head of Germany's foreign intelligence service, Martin Jaeger, told lawmakers that Germany is in danger of becoming embroiled in a violent conflict with Russia. Neither statement was about a war that has started. Both were about a campaign that is already running, below the threshold that would trigger a collective response.

The incident count is roughly doubling

Allied and open-source counts put the number of hybrid incidents attributed to Russia at roughly 100 between January and August 2026, almost double the prior year, according to a Particle News summary of those counts. The mix matters more than the label: sabotage, cyber operations, airspace incursions, and drone probes are being used together, and the incidents are getting bolder. In September, a drone struck a passenger train at Yahodyn near the Polish border. In early August, three explosive-laden drones were found at Leipzig airport, the case Jaeger pointed to on Monday. On September 23, a Russian Mi-8 helicopter spent 42 seconds inside Polish airspace, about 300 meters across the border, and Poland scrambled jets anyway (The Parliament Magazine). Individually, none of these clearly triggers NATO's Article 5. That is the design.

The drone data tells the cleanest story. The International Institute for Strategic Studies documented 144 drone incidents across 13 European countries between August 2024 and February 2026, and concluded a coordinated campaign was highly likely. Germany alone logged 58 suspected reconnaissance flights, including over Ramstein Air Base.

Figure 1: Suspected reconnaissance drone incidents by country, August 2024 to February 2026. Source: IISS report, via The Guardian and Hungarian Conservative summaries.

The targets are bases, ports, and airports

What the drones flew over is the strategic signal. About 48 percent of the IISS-documented incidents were over military installations, 26 percent targeted critical infrastructure such as ports and energy sites, and 18 percent were near civilian airports. Several of the named sites are linked to NATO nuclear sharing or US forces, which reads less like random harassment and more like mapping: where are the cameras, how fast is the response, and who argues about what to do next.

Figure 2: IISS-documented drone incidents by target type. Source: IISS report as summarized by Hungarian Conservative and DroneXL, 2026.

Romania shows how the spillover from the Ukraine war compounds the deliberate campaign. Romania's defense ministry recorded 27 drone incursions in the first nine months of 2026, compared with nine in all of 2025, plus 73 Russian attacks close to its border this year against 28 in 2025 (ministry figures reported by the Associated Press). Sixteen NATO members have now reported drone violations or recovered debris in the past two years, by a Wall Street Journal tally. Moldova, which is not in NATO, has absorbed repeated crossings, including three drones in a single day around the September 30 strike wave on Ukraine's energy grid.

Figure 3: Top-count countries in the IISS dataset, shaded on an ETRS89 Lambert Azimuthal Equal-Area projection (EPSG:3035). Source: IISS via press summaries; boundaries from Natural Earth.

My read: the response gap is the vulnerability

I do not think the central risk this winter is a deliberate invasion of NATO territory. The risk is cumulative: each incident is cheap for Moscow, deniable, and just small enough to make a collective response look disproportionate, while each one forces real spending on air defense, base security, and investigation. Kallas used the phrase "putting lives at risk" because a drone over a passenger train or an airport stops being abstract. Jaeger's warning matters for the same reason: when an intelligence chief says the confrontation has taken on a more dangerous dimension in a public hearing, he is telling his own public to price this in. Watch three things next: whether NATO names a shared response threshold, whether the Leipzig investigation produces public attribution, and whether the incident pace holds at roughly double last year's. If it does, "hybrid" stops being a category and becomes the weather.

FAQ

How many hybrid incidents have been attributed to Russia in 2026? About 100 between January and August 2026, almost double the prior year, according to allied and open-source counts summarized by Particle News.

What did the IISS drone study find? It documented 144 drone incidents in 13 European countries from August 2024 to February 2026: Germany 58, Belgium 25, Denmark 16, the Netherlands 9, France 8, and the United Kingdom and Norway 7 each, with 48 percent over military sites.

What happened on October 5, 2026? Reuters reported EU chief Kaja Kallas warning that Russian hybrid attacks put lives at risk, and Germany's BND chief warning of a possible violent conflict, both citing drone incursions and the August Leipzig airport case.

Would a hybrid attack trigger NATO Article 5? NATO has said a hybrid or cyber operation of sufficient gravity could, but most individual incidents so far have stayed below that threshold, which analysts say is deliberate.