{"id":41305,"date":"2026-11-03T13:48:02","date_gmt":"2026-11-03T12:48:02","guid":{"rendered":"https:\/\/radiosphere.de\/hybrid-threats-in-europe-2026-2027\/"},"modified":"2026-11-03T16:13:41","modified_gmt":"2026-11-03T15:13:41","slug":"hybrid-threats-in-europe-2026-2027","status":"publish","type":"post","link":"https:\/\/radiosphere.de\/en\/hybrid-threats-in-europe-2026-2027\/","title":{"rendered":"Hybrid Threats in Europe 2026\u20132027"},"content":{"rendered":"
\n
\n
\n

Detailed Management Report
Outlook on Hybrid Threats in Europe
(October 2026 \u2013 April 2027)<\/h2>\n

Target audience for this post:<\/em><\/p>\n

Chief Security Officer (CSO), Chief Risk Officer (CRO), Head of Corporate Security \/ Information Security, <\/em>Head of Communications \/ PR; Compliance & Risk Management Officers<\/em><\/p>\n

\n

This comprehensive report is based on the latest analyses fromthe \u201cHybrid Threat Outlook Europe\u201d<\/a>(as of October 2026) by our technology partner, Osavul<\/a>. It combines insights from European security agencies, legal documents, and independent research data to help organizations and government agencies proactively secure their infrastructures.<\/strong><\/p>\n<\/blockquote>\n

<\/h2>\n

1. The Evolution of the Threat Landscape: A New Level of Escalation<\/h2>\n

The data shows a brief decline in the first half of 2025 following a massive surge in hybrid acts of sabotage through 2024. Western intelligence agencies suspect that Moscow temporarily paused these operations to signal political goodwill toward the new U.S. administration. Since late 2025, however, the campaign has regained its full momentum\u2014with one crucial change: the attacks no longer target sheer volume, but rather targets with potentially catastrophic consequences.<\/p>\n

While the focus in 2024 was still on shopping centers, home improvement stores (e.g., an IKEA in Vilnius), and warehouses, the operations in 2025 and 2026 will primarily target trains in operation, airports, and defense companies.<\/p>\n

<\/h2>\n

2. Industry-Specific Key Hazards<\/h2>\n

<\/h3>\n

Aviation: The New Hotspot for Hybrid Attacks<\/span><\/h3>\n

Civil and logistics aviation has come under intense scrutiny. While 0% of incidents linked to Russia involved aviation in 2022\u20132023, this share rose to 19% in 2024 and jumped to 50% in 2025\u20132026.<\/p>\n

\u2022 Air freight and airports:<\/h4>\n

In July 2024, an explosive device detonated at Leipzig Airport shortly before it was to be loaded onto an airplane. In August 2026, an incident involving an explosive-laden drone occurred at Leipzig\/Halle Airport, prompting Germany to close the Russian Consulate General in Bonn. In addition, in the fall of 2025, there were dozens of drone sightings across Europe, which at times led to the closure of five Danish airports as well as Munich Airport.<\/p>\n

\u2022 Airspace violations & GPS interference:<\/h4>\n

Since October 2025, Lithuania has seen a massive increase in Belarusian smuggling balloons, which have disrupted hundreds of flights. At the same time, the European Union Aviation Safety Agency is reporting increased GPS jamming and spoofing activity in the Eastern and Black Sea regions.<\/p>\n

Rail Transportation & Logistics<\/span><\/h3>\n

The rail network\u2014particularly supply lines to Ukraine\u2014is a primary target for sabotage:<\/p>\n

\u2022 In November 2025, perpetrators in Poland placed a steel clamp on the Warsaw-Lublin line and detonated an explosive device to derail a train, forcing a passenger train to initiate an emergency stop.<\/p>\n

\u2022 In Riga (Latvia), between October 2025 and January 2026, there were targeted acts of arson targeting train control cabinets, which the perpetrators filmed on video as evidence.<\/p>\n

Defense Industry<\/span><\/h3>\n

In 2026, Europe experienced an unprecedented wave of fires and foiled attacks on weapons and drone manufacturers:<\/p>\n

\u2022 Among the companies affected were LPP in the Czech Republic, Delair in France, EMCO in Bulgaria, Skyeton in Slovakia, and WB Electronics in Poland.<\/p>\n

\u2022 The arson attack on the Estonian defense contractor Milrem Robotics in August 2026 was officially classified as an act of sabotage ordered by Russia.<\/p>\n

Energy Sector: The Invisible Cyberwar<\/span><\/h3>\n

Interestingly, physical attacks on energy and water utilities (such as those carried out by the radical left-wing\u201cVulkan Group<\/a>\u201d in Germany) are predominantly the work of domestic actors. Russia operates almost exclusively in the digital realm within the energy sector:<\/p>\n

\u2022 On December 29, 2025, during a cold snap, the 16th Center of the Russian FSB carried out a destructive cyberattack (\u201cwiper\u201d<\/a>) against Polish wind, solar, and cogeneration plants.<\/p>\n

\u2022 The attackers remained undetected within the networks for months, intending to cause physical damage to the infrastructure; however, internal security software was able to thwart their efforts at the last minute.<\/p>\n

 <\/p>\n

3. Modus Operandi: The \"Gig Saboteur\" Chain<\/h2>\n

 <\/p>\n

Russia has shifted its tactics from direct intelligence operations to a cost-effective \"outsourcing model.\" This process takes place in six steps:<\/p>\n

1. Recruitment: Approximately 95% of the perpetrators are ordinary civilians who are recruited online (in 88% of cases via Telegram).<\/p>\n

2. Payment: Made in cryptocurrency, cash, or goods. For arson attacks in Lithuania and Latvia, for example, intermediaries offered 10,000 euros and a BMW.<\/p>\n

3. Reconnaissance: The perpetrators take photos of their targets in advance and transmit the data.<\/p>\n

4. Execution: The actions range from arson to explosive drones.<\/p>\n

5. Evidence: The perpetrators must film their acts of sabotage and send the footage to their \"handlers\" in order to get paid.<\/p>\n

6. Exploitation: These videos are disseminated by Russian state media as fake news (e.g., \"Public outrage against NATO infrastructure\") to undermine citizens' trust.<\/p>\n

The weak point: Since every step in this chain leaves a digital trail, one-third of all covert operations are stopped before any damage is done.<\/p>\n

 <\/p>\n

4. Geography and Accelerated Attribution<\/h2>\n

 <\/p>\n

\u2022 The eastern flank bears the brunt of the burden: The eight EU member states bordering Russia, Belarus, or Ukraine account for only 18% of the EU\u2019s population, yet they account for 60% of verified incidents.<\/p>\n

\u2022 Focus on Germany: Germany reported a total of 320 suspected acts of sabotage in 2025. Although Germany is a prime target due to its logistical importance, attacks there can often be attributed to domestic extremists (such as power outages) or remain unsolved.<\/p>\n

\u2022 Governments are responding more quickly: While in 2024 it took governments up to a year to officially assign blame, Germany identified the perpetrator of the Leipzig drone incident after just 28 days, and Estonia identified the perpetrator of the Milrem arson after about six weeks.<\/p>\n

 <\/p>\n

5. Forecast: What Can We Expect in the Winter of 2026 \/ Spring of 2027?<\/h2>\n

 <\/p>\n

\"Hybrid<\/h2>\n

 <\/p>\n

Based on Osavul's analytical methods, the following probabilities emerge for the coming half-year:<\/p>\n

\u2022 Virtually certain (>, 90% probability):<\/strong><\/span>
o Further coordinated sabotage attempts in EU member states, particularly targeting supply chains and the defense industry.
o Continued pressure on airspace and GPS disruptions along the eastern flank.
o Massive information manipulation in the run-up to national elections in Bulgaria, Estonia, Finland, and France.<\/p>\n

\u2022 Likely (60\u201380% probability):<\/strong><\/span>
o At least one additional act of sabotage on the railways or in aviation that could endanger human lives.
o Further disruptions at EU airports.
o Ongoing attacks by domestic extremists on the German power grid.<\/p>\n

\u2022 Realistic possibility (25\u201340% probability):<\/strong><\/span>
o A destructive cyberattack on European energy or heating network operators during the current heating season.<\/p>\n

 <\/p>\n

Take action now, before risks turn into actual damage.<\/h3>\n

This report is just an excerpt from the extensive data in the Janus knowledge base. If you\u2019d like to delve deeper into the detailed case studies, forensic analyses, and specific mitigation measures, we recommend reading the full report.<\/p>\n

\ud83d\udc49 [Click here to download the original\u201cEurope\u2019s Hybrid Threat Outlook\u201d<\/a>from Osavul]<\/p>\n

Do you have questions about the specific threat landscape facing your company? As Osavul\u2019s<\/a> partner in Germany, the Radiosphere team is always available to provide you with a customized risk assessment.<\/p>\n<\/div><\/div>\n<\/div>\n<\/div>\n\n

<\/div><\/div>\n\n
\n
\n
\"Heinz<\/div>

Heinz D. Schultz<\/h1>

Vice President of Business Development for Analytics<\/p>

\n

\u201cOsavul bridges the critical gap between information warfare and physical sabotage: Using AI-based narrative intelligence, the platform transforms weak signals from the digital realm into evidence-based forecasts and gives organizations the edge they need to proactively fend off threats<\/sup><\/source-footnote><\/response-element>.\u201d<\/em><\/h4>\n<\/blockquote>\n

Heinz D. Schultz has worked for several years as a consultant and business analyst for renowned companies. At Radiosphere, he is responsible for business development and consulting.<\/p>\n

Phone: +49 7021 9989018
Email: hdschultz[@]radiosphere.de<\/p>\n

Schedule a phone call<\/a><\/p>\n<\/div>