The Spread of Russia's Hybrid War Against Europe: Gray-Zone Provocations in the Baltics, Germany, and the UK, and Counterstrategies

Executive Summary

To offset its military disadvantages on the Ukrainian front, Russia is expanding gray-zone pressure across Europe, combining drone incursions with infiltration of infrastructure supply chains at a level below the threshold for invoking NATO's Article 5. While border states like the Baltics and Romania are responding by immediately blaming Russia and activating rapid response systems, a clear gap in threat perception and response speed exists between Western Europe and the eastern flank states; Germany, for instance, has refrained from publicly attributing blame out of concern for diplomatic repercussions. The incident involving remote-controlled traffic cameras in Slovakia has revealed a new layer of threat distinct from physical drone incursions: the supply chain vulnerabilities of already-installed civilian infrastructure. EU sanctions against Russia face a structural limitation, as the unanimity requirement and the dependence of Hungary and Slovakia on Rosatom mean that the pace of decision-making converges on that of the most reluctant member state. Rather than expecting a single, Europe-wide response standard, a more realistic approach would be to combine standardized investigation and reporting procedures at the NATO Secretariat level, transplant the Baltic model of rapid response to Western Europe, and conduct comprehensive supply chain audits. For South Korea, this situation necessitates strengthening export control compliance to address risks from circumvention through transit countries, alongside managing risks in air cargo and energy logistics.

I. Analysis of the Current Situation

The Spread of Russia's Hybrid War Against Europe: Gray-Zone Provocations in the Baltics, Germany, the UK, and Elsewhere

1. Background and Developments

Due to their geographic proximity and shared border with Russia, the Baltic states have long been on the front line of hybrid threats. In late March, a drone crashed into a chimney at the Auvere power plant in Estonia, just 2 km west of the Russian border [1]. This incident became an opportunity for the Baltic states to accumulate experience in responding swiftly to such incursions. The Swiss newspaper Neue Zürcher Zeitung (NZZ) noted that Western Europe should learn from this experience [1][4].

The response systems of the Baltic Sea states are a product of the regional security cooperation that has formed since the war in Ukraine. Defense startups in the three Baltic states have been experimenting with rapid innovation models to counter Russian hybrid threats [3]. As the war in Ukraine evolved into a drone war, the lesson that conventional forces alone are insufficient spread first in this region [3]. The Baltic states are seen as being at the forefront of this trend [3].

Against this backdrop, a series of incidents have affected Western European countries. At Germany's Leipzig/Halle Airport, a drone carrying explosives was discovered, causing a major stir in a secure area near a cargo plane bound for Ukraine [1]. The airport is a key European logistics hub directly linked to supply routes for Ukraine and NATO [1]. Hundreds of thousands of tons of cargo pass through it annually [1]. Similar drone incidents have occurred in Bulgaria, Romania, and Poland [1].

2. Current Situation

The Latvian president has warned that Russia's hybrid war has already begun. This warning shows that the security perception of the Baltic states is far more proactive than that of Western Europe. There has already been a case in Latvian airspace where a NATO fighter jet shot down a drone that entered in connection with Ukraine's Ust-Luga offensive [6].

Statements from Germany's top military leadership indicate that threat awareness is spreading throughout the political establishment. General Carsten Breuer, Chief of Defence of the German Bundeswehr, stated that Russia has been systematically using drones to find weaknesses in European air defenses [1]. "Hybrid attacks are happening every day in NATO member states," he said [1]. He noted that these attacks are concentrated particularly in the eastern flank countries [1]. However, the German federal government has not publicly named Russia as the perpetrator behind the Leipzig incident [1]. Spain's El Mundo analyzed this cautious stance as a calculation by Berlin to manage diplomatic repercussions before evidence is confirmed [1].

A contrasting response pattern emerged in Romania. President Nicușor Dan and the acting defense minister immediately and publicly pointed to the possibility of Russian involvement right after the drone incident near the Neptun Deep gas field [6]. This is a response in stark contrast to Germany's decision to withhold attribution out of concern for diplomatic repercussions [6].

In Slovakia, the discovery of traffic cameras embedded with Russian-made, SMS-activated remote control devices exposed the vulnerability of the infrastructure supply chain itself. This represents a different layer of threat from physical drone incursions, leaving European countries with the task of re-inspecting already-installed civilian infrastructure for hidden remote-control capabilities. In response to a series of Russian provocations, the United Kingdom took the diplomatic step of summoning the Russian ambassador. This is a Western European-style protest through diplomatic channels, different in nature from the military and technical responses of the Baltic and Eastern European states.

3. Key Actors and Positions

The three Baltic states (Estonia, Latvia, and Lithuania)are the frontline parties in this situation. Sharing a direct border with Russia, their time lag in threat perception is much shorter than that of Western Europe. The Latvian president's warning that "it has already begun" represents the shared sense of crisis among the region's governments. The Baltic states are leading discussions on strengthening border security and expanding sanctions against Russia, and they have an incentive to elevate their accumulated rapid-response know-how to a NATO-level standard [1][3].

The German Federal Governmentis a direct stakeholder, as its territory hosts a key gateway for logistics supporting Ukraine, yet it maintains a cautious stance on publicly condemning Russia [1]. This reflects Germany's unique political constraints, having to simultaneously manage its domestic industry's exposure to Russia and the diplomatic fallout.

The Romanian Governmenthas defined the issue as a direct threat to its territorial and maritime resource sovereignty, opting for a policy of rapidly and publicly attributing involvement to Russia [6]. This can be seen as the cumulative result of its experience with repeated drone and sea mine incidents as a Black Sea littoral state.

U.S. Intelligence Agenciespointed to the Russian government's connection to the Leipzig drone incident, assigning responsibility ahead of European countries [1]. This reveals a gap in the speed of threat assessment between the United States and some European countries within NATO.

Russiahas consistently maintained a strategy of ambiguity regarding these incidents, neither officially confirming nor denying involvement [6]. This has the effect of structurally constraining the threshold for a military response by NATO member states.

4. Key Issues

The first issue is the regional disparity in response speed. The gap between the rapid response systems of the Baltic states and the delayed political response of Western Europe is not narrowing [1]. The second issue is the difference in political calculations among countries regarding whether to publicly attribute blame. Between Romania's immediate attribution and Germany's reticence, the formalization of a common NATO-level response is being delayed [1][6]. The third issue is that the form of the threat is diversifying from drones to infiltration of communications infrastructure. The traffic camera incident in Slovakia raises the need for a re-verification of all already-installed civilian infrastructure. The fourth issue is that as long as Russia's strategy of ambiguity continues, the responses of European countries are likely to remain sporadic and focused on individual incidents [6].

II. In-Depth Analysis of the Issue

The Spread of Russia's Hybrid War Against Europe: An In-Depth Analysis

1. Analysis of Root Causes

Russia's gray-zone provocations are a phenomenon directly linked to the military stalemate on the Ukrainian front. Ukrainian drones are inflicting real damage on Russia's energy supply chains and military logistics [1]. In reaction, Moscow is reportedly escalating its hybrid pressure on the rear areas of Western supporting nations [1]. This is a calculation aimed at offsetting its disadvantages on the front lines by creating disturbances in the rear.

The core of this calculation is to apply pressure below the threshold that would trigger NATO's collective defense clause. Russia consistently maintains a strategy of ambiguity regarding drone and sabotage incidents, neither officially confirming nor denying them [6]. In the case of the Neptun Deep gas field incident in Romania, the Russian government also issued no separate statement [6]. This silence is not an accidental mistake. It is a deliberate design to evade the threshold of a clear armed attack, which is the requirement for invoking NATO's Article 5. While each individual incident remains at a level ambiguous enough to not be defined as an act of war, the accumulation of such incidents steadily increases the security costs and political fatigue of member states.

German Chief of Defence Breuer defined this as an "intense gray-zone operation aimed at destabilizing governments and institutions on the European continent" [1]. This means the goal is not to destroy specific facilities but to test the response speed and cohesion of the European political system itself.

2. Structural Context

Asymmetry in the Security Structure. Eastern flank countries like the three Baltic states and Romania perceive the threat as an immediate existential issue due to their direct border with Russia. The Latvian president's declaration that the hybrid war "has already begun" and Romanian President Nicușor Dan's immediate attribution of blame to Russia after the incident are both products of this perception [6]. In contrast, Germany refrained from public attribution even when faced with the same type of incident [1]. Spain's El Mundo interpreted this as a calculation by Berlin to manage diplomatic repercussions before evidence is confirmed [1]. This is a structure where the speed of response to the same threat differs according to a country's geopolitical distance.

Time Lag Between Political Response and Physical Threat. An EAI analysis notes that "the delay in the speed of political response is failing to keep pace with the trend of physical threats becoming constant" [1]. The Leipzig incident revealed that Western European countries, including Germany, have a gap in their defense systems against the type of infiltration attacks that the Baltic states have been dealing with for a long time [1]. This is not simply a lack of equipment but an institutional gap between peacetime security discourse and hybrid warfare response discourse.

Constraints of the Unanimity Requirement. EU sanctions against Russia require the unanimity of all 27 member states [5]. The possibility of a veto by some member states, such as Hungary, remains a constant factor [5]. In the 22nd sanctions package, the nuclear sector is also highly likely to be diluted in the later stages of negotiations due to the dependence of Hungary and Slovakia on Rosatom [5]. Even if the Baltic states demand a tough response to Russia, the decision-making speed at the EU level is structured to converge on the pace of the most reluctant member state.

A New Layer: Supply Chain Infiltration. The Russian-made, SMS-activated remote-control traffic cameras discovered in Slovakia reveal a vulnerability separate from physical drone incursions. This shows that remote-control capabilities can be embedded within already-installed civilian infrastructure equipment. In a sanctions evasion procurement network case uncovered by a Vienna court in Austria, a multinational transit structure passing through Turkey, Kyrgyzstan, South Korea, and Poland was identified [4]. Loopholes in the infrastructure supply chain verification system are becoming a new channel for hybrid threats.

3. Comparison with Historical Precedents and Similar Cases

The rapid-response experience of the Baltic states was not accumulated by chance. The drone crash at Estonia's Auvere power plant occurred just 2 km west of the Russian border [1]. In this context of proximity, the Baltic states have been testing their response manuals in real-world situations as soon as incidents occur. The NZZ explicitly points out that Western Europe should learn from this experience [1]. In other words, the Baltic states have a steeper learning curve than Western Europe in responding to hybrid threats, and this gap has manifested as a difference in response speed in the current situation.

The Romanian case can be seen as an instance of the Baltic model of rapid attribution and response spreading to the Black Sea region. In the drone incident near the Neptun Deep gas field, two Romanian F-16s were immediately scrambled to intercept it, and the president promptly blamed Russia [6]. This stands in direct contrast to the cautious approach shown by the German government in the Leipzig incident [6]. This repeatedly confirms a pattern where, even among NATO allies, countries located on the eastern flank have a lower threshold for response.

In that it involves pressure targeting energy infrastructure, the current situation overlaps with the pressure dynamics surrounding European energy supply chains during the Cold War. However, a key difference in the current phase is that the targets are not state-to-state confrontations but civilian infrastructure and logistics hubs. The Leipzig airport, the Neptun Deep gas field, and the Slovakian traffic cameras all share the common feature of being civilian and commercial infrastructure, not military facilities. The shift of targets from the interstate front line to the foundations of civilian life is a characteristic of this phase.

4. Key Variables Shaping Future Developments

Whether Germany Publicly Attributes Blame. Although U.S. intelligence agencies assessed that the Leipzig drone was likely linked to the Russian government [1], the German government has so far refrained from official attribution [1]. If Berlin changes its position and moves to publicly attribute blame, it could serve as a catalyst for lowering the response threshold for all of Western Europe. Conversely, if this reticence is prolonged, there is a risk that the fissure between the Baltic-Romanian model of rapid response and the Western European model of cautious response could solidify into an internal NATO disagreement.

The Actual Content of the 22nd Sanctions Package. EU High Representative for Foreign Affairs and Security Policy Kaja Kallas has announced "the most extensive sanctions list since the start of the war" for this fall [5]. A crackdown on the "shadow fleet" is expected to be the practical centerpiece of the package [5], but the nuclear sector is highly likely to be diluted due to the Hungary-Slovakia variable [5]. If the actual strength of the sanctions falls short of the level demanded by the Baltic states, the difference in temperature between the Baltics and Western Europe could resurface.

Potential for Maritime Clashes Over the Shadow Fleet Crackdown. President Putin has warned that if Europe seizes Russian ships, Russia will respond in kind [5]. The commander of Russia's Pacific Fleet also stated that they are prepared to "inspect and detain" vessels from hostile nations [5]. If actual seizures and counter-seizures occur on Baltic and Black Sea routes, the gray-zone provocations will immediately translate into logistics and maritime insurance risks.

The Pace of Overhauling Supply Chain Verification Systems. The Slovakian traffic camera incident and the uncovering of the sanctions evasion procurement network in Austria are different manifestations of the same problem [4]. The future frequency and impact of similar incidents will depend on how quickly countries conduct comprehensive inspections of already-installed infrastructure equipment and export transit routes.