Author: Nata Koridze, UGSPN Senior Research Fellow
The attempted drone attack on Leipzig Airport on 4 August may prove significant for what it reveals about the evolving nature of the Russia-Ukraine war, whereby Russia is resorting to malicious activities and direct attacks across Europe. Germany attributed the incident to Russia, amid growing concern across Europe about Moscow’s increasingly aggressive use of hybrid methods against European states. Alongside intensified Russian attacks on Ukraine, increasingly direct threats against European countries and growing Ukrainian strikes inside Russia, these developments point to an escalation whose consequences may extend well beyond the battlefield.
What makes the current phase potentially more consequential is not any single incident, but the convergence of several forms of escalation. While the current situation on the battlefield is sometimes described as a stalemate, some of aspects of the war are intensifying: Ukraine is striking targets deeper inside Russia, Russia is expanding its hybrid activities in Europe, and its rhetoric towards NATO countries is becoming more explicit. Taken together, these developments suggest that the conflict is increasingly affecting the wider European security environment.
The Leipzig incident and Germany’s response
On August 4, a drone carrying explosives was found next to a Ukrainian cargo aircraft operated by Antonov Airlines at Leipzig Airport and was subsequently defused with the help of a robot. The airport, which is also used by European and NATO military aircraft, was temporarily shut down. A second drone reportedly collided with an aircraft nearby and was destroyed. Ten days later, German media reported that a third drone carrying traces of military explosives had been found in a field near the airport. Following an investigation by the German Interior Ministry, on 1 September the German government officially accused Russia of attempting to carry out a drone attack at Leipzig Airport. Berlin closed a Russian consulate in Bonn and the Russian House in Berlin, tightened controls on Russians entering Germany and summoned the Russian ambassador.
Several NATO allies, including the United Kingdom, Italy, the Czech Republic, France, Sweden and Poland, subsequently backed Germany’s assessment.
Germany has already taken a firm position against Russian diplomatic and intelligence activity. Since the beginning of the war, it has expelled around 400 Russians, including more than 80 diplomats and 313 citizens. Moscow denied the accusations, describing them as an escalation in Russian-German relations and warning that there would be consequences. Russian officials also claimed that evidence had been planted to frame Russia.
The Leipzig incident is not an isolated development, but part of a wider pattern increasingly described by European governments as Russian hybrid warfare.
Europe under pressure
Despite its internal contradictions, Europe has emerged as Ukraine’s most consistent and reliable ally, something that has been an unpleasant surprise for Moscow, which has traditionally viewed Europe and the EU as unprincipled, mercantile and easily manipulated. Russia has since employed methods designed to remain below the threshold of conventional military confrontation. These include cyberattacks, espionage, disinformation, sabotage, arson and interference with critical infrastructure. Their purpose is to impose costs, create insecurity and undermine European political cohesion.
Since Russia’s 2022 full-scale invasion in Ukraine, the Associated Press has documented around 200 incidents of sabotage and malicious activity in Europe. In March 2024, for example, a warehouse storing aid for Ukraine in east London was set on fire. Prosecutors attributed the attack to individuals with links to the Kremlin-backed Wagner Group. In August 2026 signs of Russian hostile activities were allegedly found in Romania, Slovakia, Estonia, the United Kingdom and Bulgaria, among others. These include not just so-called active measures, but direct measures such as arson, sabotage, and violence, the tradition of which comes from the Soviet KGB. Some analysts have gone further, suggesting that Russian actions commonly described as “hybrid warfare” should instead be viewed as state-sponsored terrorism, others yet note similarities in hybrid warfare methods of ISIS and Russia. Irrespective of terminology, the broader concern is clear: Russia is seeking to pressure and intimidate European states without necessarily crossing the threshold that would trigger direct military confrontation with NATO. Meanwhile, Russian rhetoric towards European states has also become increasingly confrontational, coming both from state sponsored propagandists and officials in a mix of nuclear blackmail, intimidation and psychological pressure.
European concern is reflected, among other things, in efforts to reduce Russia’s diplomatic presence. Russian diplomatic missions in Europe are increasingly being viewed not only through the traditional lens of diplomacy, but also in terms of intelligence gathering, influence operations and possible support for covert activities. Polish Foreign Minister Radosław Sikorski has proposed reducing Russian diplomatic representation in Europe, arguing that Russia has an excessive number of diplomats in the EU. According to Polish estimates, there are more than 2,000 Russian diplomats in the EU, at least 40 percent of whom Sikorski claims are engaged in activities incompatible with diplomatic status. Polish Prime Minister Donald Tusk has warned that Russia is escalating tensions across Poland, the Baltic states, Romania and Germany.
After the EU defense ministers’ meeting on 1 September the EU High Representative for Foreign Affairs and Security Policy Kaja Kallas has described Russia’s air strikes against Ukraine as “terror by design” noting that Russia’s conduct was becoming increasingly ruthless and destructive and aims to intimidate European countries into reducing their support for Ukraine. She also spoke of the need to restrict visas for Russians, noting that tourist visas were being used to carry out acts of sabotage against Europeans.
Escalation reaching Europe: Why now?
The timing of the Leipzig incident is important. The war has now lasted for four and a half years, much longer than anybody could have predicted when the 2022 invasion started, and most certainly longer than Moscow had hoped for. The Kremlin now increasingly faces the disgruntled society, which is feeling the effects of the war, be it casualties, direct economic effect or drone attacks. On the other hand, the Ukrainian officials have warned that the coming winter could be particularly difficult. With the US support largely diminished, Russia’s covert operations in Europe aim to contribute to political and public fatigue, sow fear and undermine European support for Ukraine at a critical moment.
As for the situation on the battlefield, the military and international affairs experts are increasingly seeing the signs of a stalemate, as Russia is unable to make territorial advances. Meanwhile, reports of Russia’s economic and financial problems suggest that it may find it increasingly difficult to sustain the war effort over time. However, this situation may also make the Kremlin more inclined to escalate while it still can.
As both sides are adapting their methods and broadening the geographical and technological scope of their attacks, the war is characterized by both military stalemate and strategic escalation.
The latest mediation efforts by the US
The German accusation came shortly after CIA Director John Ratcliffe’s unannounced visit to Moscow in August. Neither side publicly disclosed details of the discussions. According to Politico, Ratcliffe warned Russian officials against escalating tensions with US allies, particularly the Baltic states. Other sources claim the aim was to assure Putin that US military remains strong despite the war in Iran, and press the case that Russia is losing the war in Ukraine, urging it to cut a deal.
This is significant because Russia might be expected to test NATO’s resolve through means other than a conventional attack, including subversion, sabotage and coercion in the Baltic states, Poland or Finland. The reasoning behind such scenarios is straightforward: ending the war without an acceptable victory could create serious political difficulties for President Vladimir Putin. Some analysts therefore argue that Moscow could seek alternative ways to pressure Europe and weaken NATO cohesion.
Another recent US attempt at mediation, the visits by Steve Witkoff and Jared Kushner to Moscow and Kyiv on 5–6 September, produced little indication of a near-term settlement. The visits may also reflect the US administration’s push for a tangible result before the mid-term elections in November, as well as Washington’s concern about further Russian escalation. However, Moscow showed no readiness to compromise and continued to pursue maximalist objectives, while Kyiv welcomed renewed dialogue, rejected Russian territorial demands and emphasized the need for security guarantees.
European Support for Ukraine continues
So far, the European support for Ukraine seems to be only increasing. The visit by European leaders to Kyiv on 24 August, marking the 35th anniversary of Ukraine’s independence, was one of the visible manifestations of European political support for Ukraine. It took place against the backdrop of intensified Russian ballistic missile and drone strikes on Ukrainian cities, which resulted in civilian casualties on a scale comparable to the early months of the 2022 invasion. At the Coalition of the Willing meeting, Ukraine’s urgent need for advanced interceptor missiles was the central topic. British Prime Minister Keir Starmer, French President Emmanuel Macron and German Chancellor Friedrich Merz emphasized that strengthening Ukraine’s air defenses was an urgent priority. The EU has agreed on providing additional military assistance, including 6.1 billion Euros for Ukraine’s air defenses as part of a wider 90 billion Euros loan package.
The EU has recently adopted the 21st package of additional sanctions against Russia, indicating that the European response is likely to become more comprehensive. The bloc also reached an agreement paving the way to ban the entry to the EU for Russian combatants. Ursula von der Leyen, the President of the European Commission, said that the EU will not tolerate such acts and stressed that “if the intention was to make the EU think twice about supporting Ukraine”, the result was the opposite, and that the EU will increase the pressure it puts on Russia.
European support is increasingly moving beyond the supply of existing weapons. The UK has permitted MBDA to declassify information on components for the Storm Shadow /SCALP missile as Ukraine and France seek to establish production lines in Ukraine. Britain and Ukraine have also announced a new military technology partnership under which British experts will gain access to Kyiv’s Avengers AI Labs database – a war-tested military AI database containing a vast repository of real-world battlefield data.
Former UK Prime Minister, Boris Johnson, who himself was recently allegedly targeted by Russian drone, and a long-time supporter of Ukraine, called for the unfreezing of Russian assets and their allocation to Ukraine. He recalled that more than 162 billion USD is held in a Belgian bank account and around 13.5 billion USD in London.
Ukraine has meanwhile stepped-up long-range attacks on Moscow and other Russian regions throughout the summer of 2026, including strikes on oil refineries and Wildberries warehouses. Russia has responded with intensified drone and missile attacks, including daytime drone attacks on the Ukrainian capital. Meanwhile Kyiv confirmed it used domestically Pelican ballistic missile for the first time in its strike on Russia on September 20.
What does this mean for Europe?
The significance of the current escalation lies not only in the intensity of the fighting in Ukraine, but in the growing pressure it places on Europe’s wider security environment. Russia does not need to launch a conventional attack on a NATO member to create serious security challenges. Sabotage, cyberattacks, infrastructure attacks, intelligence operations, disinformation and other forms of coercion can impose economic and political costs while remaining below the threshold for an Article 5 response.
The individual incidents may appear limited and manageable, while their cumulative effect can be far more consequential. Repeated sabotage and intimidation could test European resilience, expose vulnerabilities in critical infrastructure, increase the political cost of supporting Ukraine and generate disagreements over how strongly Europe should respond.
Following the Leipzig incident and Russian kinetic attacks affecting Europe, the Lithuanian Minister of Defense said Lithuania would respond in self-defense once attribution, intent and damage met the relevant criteria. His comments reflect a broader concern among Russia’s neighboring NATO members that ambiguity cannot become a permanent shield for increasingly assertive Russian activity. The central question is therefore no longer simply whether the Russia-Ukraine war will escalate on the battlefield. It is whether the consequences of that escalation are becoming embedded in Europe’s own security environment and whether Europe is prepared to respond.
Conclusion
Against the backdrop of a relative stalemate on the battlefield and intensifying Russian air attacks, the coming winter will be particularly important. Ukraine will need to withstand another potentially intensive campaign of Russian missile and drone strikes while preserving its ability to hit military targets and disrupt Russia’s capacity to sustain the war. European support will be critical to both objectives. Ukraine’s security is increasingly inseparable from Europe’s own. Supporting Ukraine is not simply a matter of helping Kyiv sustain its war effort; it is also a means of limiting the extent to which the costs and risks of the conflict are transferred into the wider European security environment.
Yet the broader challenge extends beyond the immediate military balance in Ukraine. The war is increasingly affecting European security directly. The defining feature of the current phase is the convergence of more intensive Russian strikes on Ukraine, including Kyiv, deeper Ukrainian strikes inside Russia, and expanding Russian hybrid operations in Europe. Taken together, these developments demonstrate the interconnectedness of the Ukrainian and larger European security. This presents Europe with a strategic choice. It can continue to treat sabotage, direct attacks, intimidation and coercion as separate incidents, responding to each as it occurs. Or it can recognize them as interconnected elements of a broader security challenge and strengthen its collective resilience accordingly. The latter is becoming increasingly necessary.
A more effective response also requires stronger sanctions and more effective measures to prevent their circumvention, alongside better protection of critical infrastructure, deeper intelligence cooperation and continued and strengthened military support for Ukraine. So far, the price that Russia is paying for the war in Ukraine and for undermining Europe’s security appears to be bearable, and has not deterred Moscow’s efforts.