Incidents attributed to Russia in Europe are becoming bolder: from attacks on infrastructure and drones entering NATO airspace to confrontations at sea. European governments are speaking more openly about Moscow’s responsibility and strengthening their defense. However, the toughest question remains: what response could make the Kremlin stop?
An analysis published by Kiev Independent shows that Europe is better at limiting the effects of these incidents but has not yet found a method of deterrence. Additionally, allied states have not publicly established what attack would constitute a red line and what would follow its crossing.
From Cyber Attacks to Physical Sabotage
Election interference, cyber attacks, GPS jamming, and disinformation campaigns were already known in NATO countries before the large-scale invasion of Ukraine. Since then, operations attributed to Russia have intensified. A study cited by the Ukrainian publication recorded 151 incidents in Europe between the beginning of the invasion and March 2026.
Recent cases include the discovery of drones loaded with explosives at Leipzig airport, in an alleged sabotage plot supported by Moscow. The article also mentions Russian drone incursions into the airspace of NATO countries, as well as an incident where a Russian warship fired signaling rockets at a Danish military helicopter.
For the first time, German authorities have officially accused Russia of organizing a physical attack on infrastructure in Germany, in the Leipzig case. The head of Estonian intelligence services, Kaupo Rosin, believes that the term "hybrid war" sugarcoats reality and has urged European leaders to speak about "state-sponsored terrorism." EU's foreign policy chief, Kaja Kallas, has also stated that this campaign carries "all the signs of state-sponsored terrorism."
Where is the Red Line?
The attacks aim to instill fear, disrupt support for Ukraine, and test how far Moscow can go without a strong response, say officials and experts cited by the publication.
Julian Pawlak, an expert at the German Institute for International and Security Affairs, speaks of a "gap in deterrence capability": Europe has measures to respond to incidents and, at the other end of the spectrum, the possibility of a military reaction, but there is not a clear enough response between the two. The slow and weak reaction of European states allows Russia to continue testing "how far it can go," he says.
One difficulty is establishing responsibility. Moscow often uses intermediaries, including individuals recruited through Telegram, explains Anastasia Pociumban, a specialist in hybrid threats at the German Council on Foreign Relations. However, she says that states sometimes use the necessary time for investigations to delay costly measures or to avoid panic.
NATO stated as early as 2016 that a hybrid attack could trigger Article 5, the collective defense clause. However, there is no exact definition of the attack that would cross this threshold. Pawlak wonders if European leaders themselves know where the red line is.
Europe Defends Itself Better. How Can It Deter Russia?
Defense against drones is strengthening at NATO borders, European navies are more carefully protecting infrastructure at sea, and some states are stopping ships suspected of belonging to Russia's phantom fleet. The issue remains preventing the next attack.
After accusing Russia in the Leipzig case, Germany announced the closure of a Russian consulate, tightened visa access for Russian citizens, and provided additional support for Ukraine. Edward Lucas, a British journalist and security analyst, believes that such measures should have been taken much earlier, after the annexation of Crimea in 2014.
The experts interviewed by Kiev Independent agree that attacks need to become more costly for Moscow but propose different ways. Pawlak advocates establishing clear consequences: if Russia does a certain thing, European states announce in advance what measure they will take, such as a new arms shipment for Ukraine.
Lucas proposes a harder-to-predict response, through actions taken in multiple countries. Sabotage could be followed, for example, by an investigation into money laundering in one state and the detention of an unsafe vessel in another. In his view, such a response would show the Kremlin that Europe has "woken up."
However, there is a condition, Lucas warns: European states must be prepared to follow through with their response, even if Russia threatens escalation. If a country reacts and then retreats at the first threat, the effect could be opposite to the intended one.
Past examples show how difficult it is for frontline states to act alone. In 2022, Lithuania restricted the transit to Kaliningrad of goods sanctioned by the EU, but concerns over Russia's threats led to pressure for a relaxation of the measure. Later, Estonia tried to stop a tanker suspected of violating sanctions, but the appearance of a Russian fighter jet prevented the vessel's approach.
Hence Lucas's proposal for a common response: if Russia violates Estonia's airspace, the reaction could come from Sweden, Germany, or the UK. Thus, the directly targeted country would not bear the risk of confronting Moscow alone.