Russia Escalates Hybrid War Targeting European Civilian Infrastructure With Sabotage Campaign

Analysis
Confidence is high, based on consistent reporting from four outlets on the Leipzig, Brașov and Starlink cases and a steady pace of attributions in recent weeks. Russian targeting has shifted from cyber and disinformation toward explosives, arson and drones, and Moscow appears to accept being named. Only Ukrainska Pravda gives a primary, incident-specific account of the Romanian case, while the Atlantic Council, Foreign Policy and The Hill supply secondary commentary on the wider pattern. A European government will very likely publicly attribute a new sabotage, arson or drone incident against civilian or military-industrial infrastructure to Russia or Russian-directed actors between October 29 and November 28. Attribution alone has not slowed the tempo, so Poland, Germany and the Baltic states must harden communications hubs and arms-supply sites before the next incident. The rise in attributions may instead reflect better European detection and greater willingness to name Moscow, and recruited low-skill proxies make many incidents hard to trace to the Kremlin. Denmark's warning of a limited attack on NATO border states is contested, since Estonia reports no change in its threat assessment. If attributions continue, ministries have grounds to speed up hardening, information-sharing and sanctions; if not, the escalation case weakens and emergency spending could be deferred.