Not just acts of sabotage, jets and ‘expendable’ agents. Russian attacks on NATO

Following the attack on 4 August at Leipzig-Halle Airport, European governments have begun to publicly accuse Russia of its attacks against Europe. In early September, the German government attributed responsibility to the Kremlin and identified as the main suspects a Russian citizen affiliated with the GRU and a Belarusian ‘disposable agent’, recruited to carry out acts of sabotage. Attacks in Europe by ‘disposable agents’ are becoming increasingly frequent, but they are not the greatest threat: according to a study published on Wednesday by the Institute for the Study of War, Europe must accelerate its rearmament and prepare for the possibility of a limited Russian conventional attack before the 2028–2030 timeframe currently envisaged by many NATO countries. Yesterday, two Russian jets entered Lithuanian airspace, prompting the scramble of two Italian Eurofighter jets from the NATO mission. 

Also yesterday, Polish Prime Minister Donald Tusk said that Warsaw is preparing for various scenarios involving Russia: “We know it is plotting something”. A recent investigation by four European media outlets – DW, LRT, RTVE and CT – has uncovered a network of ‘expendable’ recruits tasked with carrying out surveillance and sabotage operations against targets such as a bus depot in Prague and Lithuanian companies supplying equipment to the Ukrainian army. Lithuanian, Romanian and Polish authorities have linked the network to the GRU; according to the profile, most of those recruited are young people in precarious financial circumstances, contacted via social media, job-search platforms and volunteering forums, often whilst seeking work in Europe or seeking to join the war in Ukraine.  On Tuesday, the US Department of Justice also indicted five alleged Russian intelligence agents on a charge sheet for allegedly carrying out “attacks and assassinations around the world, including in the United States”. “The network is alleged to have paid and attempted to pay individuals in the United States and elsewhere to carry out surveillance activities and carry out targeted killings, and to have instructed accomplices to commit acts of terrorism against civilian and military infrastructure in European countries aligned with, or perceived as aligned with, Ukraine,” the document states. The following day, the Institute for the Study of War (ISW) published a report on the importance of defining the threat posed by Russia’s military campaign against Europe. According to the American think tank, Russian actions, taken individually, are far from new: “The Kremlin considers itself to be in an open conflict with Europe and the United States and has for years been conducting a campaign of irregular actions, military manoeuvres and nuclear threats against Europe,” Mason Clark, director of ISW’s Defence of Europe project and author of the report, told Il Foglio. Since the summer of 2025, the Kremlin has stepped up the intensity of its actions – Clark cites the incursion of Russian drones into Polish airspace on 9–10 September 2025, which “marked the starting point of the escalation of the Russian campaign against Europe”  – then, during the summer of 2026, it became “even more brazen”, accelerating the pace and intensity of the attacks. The visit to Moscow by CIA Director John Ratcliffe at the end of August and the German government’s official announcement on 1 September that Russia was directly responsible for the drone attack on Leipzig Airport “marked a significant and necessary turning point in the European public debate on the Russian threat”, says the analyst.

Yet “European states and leaders have not taken sufficient action to deter escalation and still too often refer to Russian actions using language that hinders effective responses”, such as “provocations”, “grey zone” or “hybrid attacks”: According to the ISW expert, these definitions are no longer accurate, he says, because “they imply that Russian actions are not directly part of a Russian military campaign, but of something else that remains undefined. Many officials and analysts use the term ‘hybrid’, but no one has a shared understanding of its meaning, and they often use it implicitly to justify not invoking NATO’s collective defence provisions”. From a strategic point of view, according to Mason Clark, the main Russian threat to Europe is the Kremlin’s ability to divide NATO member states and paralyse them into inaction, and the most concrete step is to define Russian attacks for what they are, “in order to plan coordinated responses” – in recent weeks, European officials have been increasingly willing to describe Russian actions as “kinetic”, “military” or “terrorism”. From a practical point of view, “European states should improve their air defence capabilities and, above all, remove bureaucratic obstacles to shooting down incoming drones: allowing those on the front line to track and target drones whilst they are still in Ukrainian airspace would, for example, be an excellent solution. Europeans should also speed up their processes for investigating and attributing potential Russian actions – some, including Germany, are already doing so’.