Adversary Intelligence — 2026-10-27

European Investigation Maps Hundreds of Suspected Russian Hybrid Attacks Across Continent

BLUFEurope's fragmented attribution picture, with publicly mapped incidents capturing only a fraction of suspected Russian hybrid attacks, undercuts any coordinated threshold-setting for a collective response.

Journalists from 17 European public broadcasters, coordinated by the EBU's Eurovision News Spotlight, published a map on October 23 of hundreds of incidents in 17 countries between April 1 and October 15 that officials or reporting linked to Russia 12. It covers kinetic events such as sabotage, airspace violations, "disposable" agents and instrumentalised migration, excludes cyberattacks and influence operations, and the EBU calls it a "very conservative estimate" 1. Russia has repeatedly denied the attacks 13. Germany has four mapped incidents, including a September 3 firebombing near Munich defence firms, though internal papers seen by Correctiv record 163 suspected sabotage cases in 2026 through August 19 without a country breakdown 4. Moldova's defence minister reported 84 drone incursions in 2026 14.

Analysis
The map shows the scale of publicly attributed Russian kinetic activity but not the true caseload, so European governments still lack a shared attribution picture. Germany shows the gap: four mapped incidents against 163 suspected sabotage cases through August 19, with no country breakdown, and NATO's press office told the journalists it holds no public or unclassified record of hybrid incidents. Reliance on "disposable" agents lets Moscow deny direction, and Black Sea ship attacks with crew deaths and missing sailors raise pressure to set a response threshold. Confidence is high, based on two primary EBU publications and consistent secondary reproduction. That sourcing is convergent rather than independent, since all of it draws on one journalist-compiled database built from official statements and press reports that remain unverified. Apparent growth along the eastern flank could partly reflect which incidents officials publicized and which newsrooms participated, not a rise in Russian operations.
4 sources
  1. Hybrid war map: Attacks linked to Russia in Europe - EBU Eurovision News Spotlight
  2. Mapping Russia's hybrid war: 17 newsrooms, six months, hundreds of incidents - European Broadcasting Union (EBU)
  3. European Investigation Maps Hundreds of Suspected Russian Hybrid Attacks - EU Today
  4. 17 public broadcasters mapped Russia's hybrid war on Europe. Germany: four dots - Euromaidan Press

View in full brief →

UNCLASSIFIED // OPEN SOURCE