Detailed Management Report
Outlook on Hybrid Threats in Europe
(October 2026 – April 2027)

Target audience for this post:

Chief Security Officer (CSO), Chief Risk Officer (CRO), Head of Corporate Security / Information Security, Head of Communications / PR; Compliance & Risk Management Officers

This comprehensive report is based on the latest analyses fromthe “Hybrid Threat Outlook Europe”(as of October 2026) by our technology partner, Osavul. It combines insights from European security agencies, legal documents, and independent research data to help organizations and government agencies proactively secure their infrastructures.

1. The Evolution of the Threat Landscape: A New Level of Escalation

The data shows a brief decline in the first half of 2025 following a massive surge in hybrid acts of sabotage through 2024. Western intelligence agencies suspect that Moscow temporarily paused these operations to signal political goodwill toward the new U.S. administration. Since late 2025, however, the campaign has regained its full momentum—with one crucial change: the attacks no longer target sheer volume, but rather targets with potentially catastrophic consequences.

While the focus in 2024 was still on shopping centers, home improvement stores (e.g., an IKEA in Vilnius), and warehouses, the operations in 2025 and 2026 will primarily target trains in operation, airports, and defense companies.

2. Industry-Specific Key Hazards

Aviation: The New Hotspot for Hybrid Attacks

Civil and logistics aviation has come under intense scrutiny. While 0% of incidents linked to Russia involved aviation in 2022–2023, this share rose to 19% in 2024 and jumped to 50% in 2025–2026.

• Air freight and airports:

In July 2024, an explosive device detonated at Leipzig Airport shortly before it was to be loaded onto an airplane. In August 2026, an incident involving an explosive-laden drone occurred at Leipzig/Halle Airport, prompting Germany to close the Russian Consulate General in Bonn. In addition, in the fall of 2025, there were dozens of drone sightings across Europe, which at times led to the closure of five Danish airports as well as Munich Airport.

• Airspace violations & GPS interference:

Since October 2025, Lithuania has seen a massive increase in Belarusian smuggling balloons, which have disrupted hundreds of flights. At the same time, the European Union Aviation Safety Agency is reporting increased GPS jamming and spoofing activity in the Eastern and Black Sea regions.

Rail Transportation & Logistics

The rail network—particularly supply lines to Ukraine—is a primary target for sabotage:

• In November 2025, perpetrators in Poland placed a steel clamp on the Warsaw-Lublin line and detonated an explosive device to derail a train, forcing a passenger train to initiate an emergency stop.

• In Riga (Latvia), between October 2025 and January 2026, there were targeted acts of arson targeting train control cabinets, which the perpetrators filmed on video as evidence.

Defense Industry

In 2026, Europe experienced an unprecedented wave of fires and foiled attacks on weapons and drone manufacturers:

• Among the companies affected were LPP in the Czech Republic, Delair in France, EMCO in Bulgaria, Skyeton in Slovakia, and WB Electronics in Poland.

• The arson attack on the Estonian defense contractor Milrem Robotics in August 2026 was officially classified as an act of sabotage ordered by Russia.

Energy Sector: The Invisible Cyberwar

Interestingly, physical attacks on energy and water utilities (such as those carried out by the radical left-wing“Vulkan Group” in Germany) are predominantly the work of domestic actors. Russia operates almost exclusively in the digital realm within the energy sector:

• On December 29, 2025, during a cold snap, the 16th Center of the Russian FSB carried out a destructive cyberattack (“wiper”) against Polish wind, solar, and cogeneration plants.

• The attackers remained undetected within the networks for months, intending to cause physical damage to the infrastructure; however, internal security software was able to thwart their efforts at the last minute.

 

3. Modus Operandi: The "Gig Saboteur" Chain

 

Russia has shifted its tactics from direct intelligence operations to a cost-effective "outsourcing model." This process takes place in six steps:

1. Recruitment: Approximately 95% of the perpetrators are ordinary civilians who are recruited online (in 88% of cases via Telegram).

2. Payment: Made in cryptocurrency, cash, or goods. For arson attacks in Lithuania and Latvia, for example, intermediaries offered 10,000 euros and a BMW.

3. Reconnaissance: The perpetrators take photos of their targets in advance and transmit the data.

4. Execution: The actions range from arson to explosive drones.

5. Evidence: The perpetrators must film their acts of sabotage and send the footage to their "handlers" in order to get paid.

6. Exploitation: These videos are disseminated by Russian state media as fake news (e.g., "Public outrage against NATO infrastructure") to undermine citizens' trust.

The weak point: Since every step in this chain leaves a digital trail, one-third of all covert operations are stopped before any damage is done.

 

4. Geography and Accelerated Attribution

 

• The eastern flank bears the brunt of the burden: The eight EU member states bordering Russia, Belarus, or Ukraine account for only 18% of the EU’s population, yet they account for 60% of verified incidents.

• Focus on Germany: Germany reported a total of 320 suspected acts of sabotage in 2025. Although Germany is a prime target due to its logistical importance, attacks there can often be attributed to domestic extremists (such as power outages) or remain unsolved.

• Governments are responding more quickly: While in 2024 it took governments up to a year to officially assign blame, Germany identified the perpetrator of the Leipzig drone incident after just 28 days, and Estonia identified the perpetrator of the Milrem arson after about six weeks.

 

5. Forecast: What Can We Expect in the Winter of 2026 / Spring of 2027?

 

 

Based on Osavul's analytical methods, the following probabilities emerge for the coming half-year:

• Virtually certain (>, 90% probability):
o Further coordinated sabotage attempts in EU member states, particularly targeting supply chains and the defense industry.
o Continued pressure on airspace and GPS disruptions along the eastern flank.
o Massive information manipulation in the run-up to national elections in Bulgaria, Estonia, Finland, and France.

• Likely (60–80% probability):
o At least one additional act of sabotage on the railways or in aviation that could endanger human lives.
o Further disruptions at EU airports.
o Ongoing attacks by domestic extremists on the German power grid.

• Realistic possibility (25–40% probability):
o A destructive cyberattack on European energy or heating network operators during the current heating season.

 

Take action now, before risks turn into actual damage.

This report is just an excerpt from the extensive data in the Janus knowledge base. If you’d like to delve deeper into the detailed case studies, forensic analyses, and specific mitigation measures, we recommend reading the full report.

👉 [Click here to download the original“Europe’s Hybrid Threat Outlook”from Osavul]

Do you have questions about the specific threat landscape facing your company? As Osavul’s partner in Germany, the Radiosphere team is always available to provide you with a customized risk assessment.