The Spread of Russian Hybrid Threats and Risks to European Aviation and Energy Infrastructure: Assessment and Response Strategy

Executive Summary

The successive drone and sabotage incidents at Germany's Leipzig Airport as well as in Bulgaria, Romania, Poland, and Estonia are assessed as part of a gray-zone operation through which Russia seeks to offset its disadvantage on the Ukrainian battlefield by disrupting the rear. While U.S. intelligence authorities have pointed to a Russian government connection, the German government has withheld public attribution out of consideration for the diplomatic repercussions, and this lag in the pace of political response is failing to keep up with the trend toward the normalization of physical threats. Over the coming six months to one year, the most likely course (55% probability) is the base-case scenario in which the stalemate in ceasefire negotiations persists while sporadic gray-zone pressure continues at its current level; European countries should simultaneously pursue the transplantation of the Baltic states' rapid-response systems, the formalization of a collective NATO response, and expanded procurement of air defense capabilities. Korean firms and the government need to manage the risks of flight disruptions and rising insurance premiums stemming from exposure in European air cargo and energy logistics, while also pursuing a dual-track strategy to seize opportunities for entry into the European procurement market in drone detection and interception technologies.

I. Issue Situation Analysis

Escalating Risks to European Aviation and Energy Infrastructure from the Spread of Russian Hybrid Threats

1. Background and Development of the Issue

At Germany's Leipzig/Halle Airport, a drone carrying explosives was discovered late Tuesday night[1]. A worker in the cargo area near the runway spotted it[1]. Around the same time, a cargo aircraft collided with an unidentified flying object and sustained minor damage[1]. The site where the drone was found was a security zone near a cargo plane bound for Ukraine[8]. As a result, the airport suspended all nighttime operations[8].

Leipzig Airport is no ordinary regional airport. Slovenian outlet Delo pointed out that the airport is a key hub for European logistics directly linked to Ukraine-NATO supply routes[5]. Hundreds of thousands of tons of cargo pass through it annually[5]. Delo assessed that, amid the hybrid warfare phase, the very security of Europe's logistical arteries is being put to the test[5].

This incident is not an isolated occurrence. In Estonia, a drone crashed into the chimney of the Auvere thermal power plant, located 2km west of the Russian border, in late March[15]. Switzerland's Neue Zürcher Zeitung (NZZ) noted that Western Europe should draw on the experience of the Baltic states, which have responded swiftly to such incidents[15]. It has been assessed that this incident revealed major gaps in the defense systems of Germany and other Western European countries against such covert infiltration attacks[15].

Qatar's Al Jazeera reported that the successive sightings of drones in Bulgaria and Germany are fueling concerns about the possibility of Russian escalation[17]. Similar drone incidents occurred in Romania and Poland as well, and NATO attributed responsibility to Russia for both cases.

2. Current Situation

U.S. intelligence authorities have assessed that the explosive-laden drone found at Leipzig Airport is likely connected to the Russian government[8]. The Wall Street Journal reported this, citing U.S. officials[8]. The German government has not yet publicly named Moscow[12]. Spain's El Mundo analyzed that this cautious stance can be seen as Berlin's calculation to manage diplomatic fallout before the evidence is confirmed[12].

Germany's top-ranking general, Chief of the Bundeswehr Joint Chiefs of Staff Carsten Breuer, stated that Russia has been systematically using drones to probe for weaknesses in European air defenses[10]. He said, "Hybrid attacks are happening every day in NATO member states"[10]. He pointed out that such attacks are particularly concentrated in countries on the eastern flank[10]. Chairman Breuer characterized this as an intensifying gray-zone operation aimed at destabilizing governments and institutions across the European continent[10].

NZZ analyzed that as Ukrainian drones inflict serious damage on Russia's energy supply networks and military logistics, the Moscow regime is intensifying hybrid pressure on Western supporting nations[14]. It suggested that incidents like the one in Leipzig could be part of a new offensive[14].

3. Key Actors and Positions

The German Federal Government and Military Authorities are the most directly involved parties in this incident. Given that Leipzig Airport is a key gateway for logistics supporting Ukraine, Germany must both acknowledge the security gaps in its domestic infrastructure and bear the burden of potential diplomatic escalation should it publicly name Russia[12]. Chairman Breuer's remarks are interpreted as a move by the military leadership to publicize the substance of the threat ahead of the political establishment[10].

U.S. Intelligence Authorities have been relatively proactive in identifying Russia as the party behind this incident[8][16]. Ukrainian outlet the Kyiv Independent also swiftly cited and reported this coverage, lending weight to the theory of Russian involvement[16].

NATO Headquarters and Eastern European Member States (Romania, Poland, and the three Baltic states) have already formally attributed responsibility to Russia for incidents involving infiltration of their own airspace and infrastructure. Estonia's rapid-response case is cited as a model for Western Europe to benchmark[15].

The Russian Government has officially denied involvement in these incidents. However, Western analysts interpret this hybrid offensive as an asymmetric form of retaliation against Ukraine's strikes on Russian energy and logistics targets[14].

The European Defense Industry is a beneficiary of this situation. A Roland Berger report points out that Europe's aerospace and defense sector faces a structural challenge in the vulnerability of raw material procurement[3]. Janes analyzed that the counter-UAS market is growing rapidly amid the rising drone threat[4].

4. Key Issues

The first issue is the certainty of attribution of responsibility. While U.S. intelligence authorities and NATO give weight to the theory of Russian involvement, the German government has withheld official confirmation[8][12]. This gap has the potential to become a key variable in the internal European debate over the appropriate level of response going forward.

The second issue is the response gap between Western and Eastern Europe. While the Baltic states, such as Estonia, have already established rapid-response systems, core Western European countries including Germany have exposed defense gaps[15]. The speed at which this gap is closed is expected to determine the direction of future infrastructure security investment.

The third issue is the security of Ukraine's rear logistics lines. Given that the Leipzig incident occurred near a cargo plane bound for Ukraine, this lends weight to the interpretation that Russia is targeting the support infrastructure within Europe itself, rather than the front lines[5][14].

The fourth issue is the sustainability of the expansion of defense spending. Amid the structural constraint of raw material supply chain vulnerability[3], the key question is how quickly Europe can build an effective air defense system in step with the growth of the counter-UAS market[4].

II. In-Depth Issue Analysis

Risks to European Aviation and Energy Infrastructure from the Spread of Russian Hybrid Threats: In-Depth Analysis

1. Root Cause Analysis

The root cause of this drone crisis can be found in the very structure of the battlefield in the Ukraine war. Ukraine is using drones to inflict substantial damage on Russia's energy supply networks and military logistics[14]. NZZ analyzed that, in response to these Ukrainian strikes, the Moscow regime is escalating hybrid pressure against Western supporting nations[14]. This reflects a calculation aimed at offsetting battlefield disadvantages through rear-area disruption.

The reason Leipzig Airport was targeted is no coincidence. This airport is a key hub for flights carrying cargo to Ukraine[8][5]. The location where the drone was found was also a security zone near a Ukraine-bound cargo plane[8]. Delo pointed out that Germany is directly connected to Ukraine-NATO supply routes via Leipzig[5]. From Russia's perspective, disrupting this airport has the effect of destabilizing the support logistics itself in the rear, far from the front lines.

Chairman Breuer's assessment captures this causal structure in concise form. He stated that Russia has been systematically using drones to probe for weaknesses in European air defenses[10]. His remark that "hybrid attacks are happening every day in NATO member states"[10] reflects the judgment that these should be understood not as isolated incidents but as ongoing probing activity. He characterized this as a gray-zone operation aimed at destabilizing governments and institutions across the European continent[10]. This is interpreted to mean that the objective is not military damage per se, but rather the generation of social unrest and political confusion.

2. Structural Context

In terms of security structure, Europe's air defense systems were originally designed on the assumption of conventional interstate invasion. The infiltration of low-cost small drones exploits a precise blind spot in this system. NZZ assessed that in the wake of the Leipzig incident, gaps in the defense systems against covert infiltration attacks were clearly exposed in Germany and other Western European countries[15]. By contrast, the Baltic states, including Estonia, have already established rapid-response systems owing to their geopolitical circumstance of sharing a border with Russia[15]. When a drone crashed into the chimney of Estonia's Auvere thermal power plant in late March, the speed of the Baltic states' response stood in contrast to that of Western Europe[15]. This demonstrates that the time lag in threat perception has translated into a gap in defense readiness.

In terms of political structure, the German government's cautious stance is noteworthy. Even though U.S. intelligence authorities linked the drone to the Russian government[8], the German government has not yet publicly named Moscow[12]. El Mundo interpreted this as Berlin's calculation to manage diplomatic fallout before the evidence is confirmed[12]. This reflects the dual pressure Germany faces. Domestically, it must guard against political demagoguery that exploits fears of a Russian threat, while externally it cannot afford to deviate from the framework of joint response with its NATO allies. This caution also connects to the structural vulnerability of Europe identified by EAI. Europe is in a transitional period toward implementing NATO's dual U.S.-Europe axis, as "the fifth year of the war in Ukraine coincides with the Trump administration's 'America First 2.0'"[6]. During this transition, clearly attributing responsibility to Russia and determining the level of response poses a political burden for European governments.

In terms of economic structure, the European defense industry faces the structural constraint of raw material supply chain vulnerability. Roland Berger analyzed that Europe's aerospace and defense industry faces a fundamental challenge in securing the key raw materials that underpin military and civilian platforms[3]. When supply chain bottlenecks coincide with a surge in demand for air defense buildup, a structure emerges in which it becomes difficult for European countries to expand their response capabilities at the pace they desire. EAI has likewise assessed that structural constraints—including raw material supply chain vulnerability and tightening export controls on dual-use technologies—make it difficult for Europe to break free of dependence on the United States in the short term[6].

3. Historical Precedents and Comparable Cases

This drone crisis is an extension of a pattern of hybrid threats that has been accumulating since the outbreak of the Ukraine war. Gray-zone operations oscillating between physical strikes and cyber disruption—such as the Nord Stream pipeline explosions, the severing of communication cables in Europe, and railway signal disruptions—have been repeatedly observed since 2022. What distinguishes this set of incidents is that armed drones have been confirmed as the tool of choice, simultaneously across multiple countries. The successive discoveries in Leipzig and Hanover, Germany; near a Bulgarian gas pipeline; in Romania; and in Poland bear the character of a broad-area probing operation rather than sporadic provocations targeting individual countries.

The Estonian Auvere case can be seen as an early, experimental stage of this pattern[15]. The incident, in which a drone crashed into the chimney of a power plant 2km from the Russian border, carried a strong character of direct pressure on a country bordering Russia. By contrast, the Leipzig incident marks a qualitative shift, as the theater of the threat expanded to a core Western European country that does not share a border with Russia. NZZ's characterization of this as "Russia's war against Ukraine's rear area (Rückraum)"[14] reflects a recognition that the targets of Russia's hybrid operations are expanding from front-line-adjacent countries to the entire body of nations supporting Ukraine from the rear.

The evolution of drone warfare within the Ukraine war itself is also relevant to understanding this crisis. EAI analyzed that while Russia initially lagged behind Ukraine in drone capabilities at the start of the war, it made significant progress in integrating drones into military operations as the war dragged on[9]. Tactical learning combining low-cost drones with reconnaissance and precision strikes has accumulated on the battlefield, and it is plausible that the results of this learning are now being applied to rear-area disruption operations in Europe. Janes pointed out that the pace of development of counter-UAS technology varies significantly by domain, based on cases of unmanned system operations in Ukraine, Europe, and the Middle East[4], which is consistent with the circumstantial evidence that Europe's air defense buildup is failing to keep pace with the evolving threat.

4. Key Variables in the Development of the Issue

The first variable is whether the attribution of responsibility to Russia will be formalized. Despite the assessment of U.S. intelligence authorities[8] and NATO's attribution of responsibility to Russia for the Romania and Poland incidents, the future level of response will hinge on whether core Western European countries, including Germany, officially acknowledge this. As El Mundo pointed out, Germany's cautious stance[12] represents a process of finding a balance between confirming evidence and managing diplomatic fallout, and the direction in which this balance tilts will alter the pace of discussions on a collective NATO-level response.

The second variable is the pace of implementation and financing of air defense buildup. While there is a clear directional trend among European countries toward strengthening air defenses and increasing border security personnel, the structural constraint of raw material supply chain vulnerability[3] could limit the actual pace of force buildup. If this gap is left unaddressed, it could result in Russia's probing operations continuing to identify gaps in Europe's air defenses.

The third variable is the direction in which the recalibration of U.S.-Europe defense burden-sharing proceeds. In the process of NATO's transition to a dual U.S.-Europe axis, as identified by EAI[6], how quickly Europe concretizes its path toward self-reliance will determine its own capacity to respond to hybrid threats. In a phase where the Trump administration's pressure for burden-sharing and Europe's need for self-reliance are operating simultaneously, this drone crisis could be used as political justification within Europe to legitimize increased defense spending and rearmament.

The fourth variable is whether the Baltic model is transplanted to Western Europe. As NZZ emphasized, the Baltic states, including Estonia, have already established rapid-response systems given their proximity to Russia[15]. How quickly this experience and institutional framework spreads to Western European countries such as Germany will be key to narrowing the response gap when the next incident occurs.