Russia testing NATO hybrid attacks
Russia testing NATO hybrid attacks — three words now carrying the weight of an official Western verdict. Over the past two days, the highest-ranking defense and foreign-policy voices in the West have converged on the same message: Russia is systematically probing NATO’s resolve with sabotage, arson and drone strikes that stop just short of open war, and it may be preparing to escalate.
EU foreign-policy chief Kaja Kallas said Russia “is testing the limits” and that Europe is “in a confrontation” with Moscow. NATO Secretary-General Mark Rutte said hybrid warfare is “a reality in every single country in this alliance.” And Denmark’s security services warned that Russian efforts to undermine the West are now on a scale not seen since the Cold War — and that Moscow is preparing to escalate hybrid attacks across Europe.
What Kallas, Rutte and Denmark said this weekend
The statements landed within hours of each other, reported in a September 26 USA Today roundup and a September 24 UNILAD report on the Danish assessment. Taken together, they amount to the sharpest coordinated rhetorical escalation on the hybrid threat this year.
Kallas, the EU’s top diplomat, chose the language of open confrontation. To say Europe is “in a confrontation” with Russia is to drop the diplomatic euphemism that usually cushions EU statements; it places the relationship in a category that EU officials have historically reserved for moments of peak crisis. Her phrase “testing the limits” is equally deliberate: it asserts intent — that the sabotage is not freelance criminality or coincidence, but a calibrated campaign to find the point at which NATO answers back.
Rutte’s formulation went further in a different way. Declaring hybrid warfare “a reality in every single country in this alliance” makes the claim that no NATO member is exempt — that the threat is not a Polish problem, a German problem or a Baltic problem, but the operating environment of the entire alliance. For a secretary-general whose job is to keep 32 allies aligned, that is the language of threat normalization: telling citizens and governments to treat hybrid attacks as weather, not anomalies.
Denmark’s warning adds the dimension of trajectory. Its security services — long among Europe’s most candid on Russian intelligence activity — said the scale of Russian efforts to undermine the West has not been seen since the Cold War, and explicitly warned that Moscow is preparing to escalate hybrid attacks on Europe. That is not a retrospective assessment; it is a forecast.
The incidents behind the warnings: Leipzig, DHL warehouses, Poland
The warnings did not arrive in a vacuum. Western officials pointed to a string of incidents that investigators across Europe have linked, with varying degrees of confidence, to Russian intelligence services.
The most recent: an explosive-laden drone struck a DHL cargo facility at Leipzig/Halle Airport in Germany this month. EU states summoned Russian embassy officials over the attack, per a September 2 Reuters report — the diplomatic equivalent of naming a suspect without yet filing charges. A drone carrying explosives aimed at a major cargo hub is a different category of incident from vandalism or cyber-intrusion; it introduces the possibility of mass casualties into the hybrid toolkit.
The Leipzig strike fits a pattern. In 2024, a wave of explosions hit DHL warehouses in Britain, Poland and Germany — three countries, one logistics company, one summer. Investigators in several countries treated the blasts as part of a coordinated sabotage campaign, and Western intelligence agencies assessed that the operation bore the hallmarks of Russian military intelligence.
Poland has become the epicenter of the arson campaign. A Polish court charged two Ukrainian men with plotting arson on behalf of Russia, and Polish officials say a factory fire was the work of Russian sabotage. Warsaw has been the most public of any European capital in attributing fires, parcel explosions and infrastructure attacks to Moscow — a stance that reflects both the intensity of activity on Polish soil and the Polish government’s political willingness to name Russia openly.
Why this matters: the Article 5 threshold is being probed
Here is the strategic core of the story. NATO’s Article 5 — the commitment that an attack on one member is an attack on all — was written for tanks crossing borders. It was not written for an explosive drone at a cargo hub, a torched factory, or a warehouse fire. The hybrid campaign lives precisely in that gap: destructive enough to terrify, deniable enough to keep the alliance from answering as one.
Kallas’s “testing the limits” names the mechanism. Each unattributed or under-attributed attack is a data point for Moscow: what did the alliance do? Did it expel diplomats? Sanction? Nothing? The answer shapes the next operation. If the cost of a warehouse explosion is a summoned ambassador, the rational move for an adversary is to keep exploding warehouses. The Western warnings this weekend are, in effect, an attempt to change that calculus — to announce publicly that the pattern has been seen, named, and may soon be answered differently.
That is why the rhetorical escalation matters beyond rhetoric. Public naming is the first step toward policy change: new sanctions packages, intelligence-sharing arrangements, counter-sabotage task forces, and — most significantly — debates inside NATO about whether the Article 5 threshold needs reinterpretation for the hybrid era. Denmark’s Cold War comparison is aimed at the same audience: citizens who remember what a sustained confrontation looked like, and budgets that need to be justified to parliaments.
Russia denies involvement — what we know and what is disputed
Moscow denies any involvement in the sabotage campaign, and that denial must be given its due. Attribution in hybrid warfare is genuinely difficult. Arson can be committed by criminals paid in cryptocurrency; drones can be launched by sympathizers rather than spies; warehouse explosions can be accidents. Intelligence agencies deal in assessments and confidence levels, not courtroom proof, and much of the evidence cited by Western governments is classified and therefore unverifiable by the public.
What is on the public record: the incidents themselves (the Leipzig drone strike, the 2024 DHL blasts, the Polish arson charges and factory fire), the diplomatic response (summoned Russian officials, public attributions by multiple governments), and the assessment language of this weekend. What remains genuinely uncertain: the precise chain of command behind each incident, whether every attack attributed to Moscow truly originates there, and — crucially — whether the “escalation” Denmark warns of is already decided policy in Moscow or a capability being readied for use if relations worsen.
There is also a dissenting interpretation worth airing. Some analysts argue that Western governments have incentives to amplify the hybrid narrative: it justifies defense spending, sustains public support for Ukraine, and deflects attention from domestic failures. That does not make the incidents imaginary — the DHL explosions happened — but it is a reminder that threat assessment and threat communication are not the same thing, and both are happening at once this weekend.
Who wins and who loses from the escalation warnings
Winners first. European defense budgets and the contractors behind them benefit every time the threat level rises — and Denmark’s Cold War framing is tailor-made for procurement debates. NATO cohesion narratives get a boost: a named external enemy is the alliance’s most reliable unifying force. Ukraine, arguably, gains most of all; a West focused on Russian hybrid aggression is a West more likely to keep funding Kyiv and less likely to drift toward détente.
The losers: Russia’s diplomatic standing in Europe, which was already near zero and now sinks further — the summoned-ambassador ritual at Leipzig is what remains of normal relations. Civilian aviation and logistics operators, whose facilities have become the battlefield, face higher insurance costs and security overhead. And any residual European appetite for re-engagement with Moscow — the business lobbies, the energy traders, the politicians who argued for a post-war settlement — loses another round of the argument.
The data frame the stakes: a single explosive drone against a cargo hub, versus a multi-country arson and explosives campaign stretching back to 2024. The step from parcels to explosive drones is the step Western officials are warning about now.
What happens next: three scenarios for the hybrid campaign
Scenario one — the warnings work. The public naming, the summoned ambassadors and the looming threat of new sanctions raise the cost of the campaign enough that Moscow pauses or redirects it. Behind the scenes, intelligence channels carry a message the press never sees: the next drone gets a different answer. The incidents taper off through the autumn, and the warnings are remembered as successful deterrence. This requires Moscow to be rational about costs — plausible, but not guaranteed.
Scenario two — escalation, as Denmark forecasts. Russia interprets the warnings as proof the campaign is working — it has Europe’s attention — and steps up: more drones, harder targets, perhaps a first fatality. A death would transform the politics overnight, forcing NATO into the Article 5 reinterpretation debate it has been avoiding. This is the scenario Danish intelligence is explicitly warning about, and it is the one that makes this weekend’s statements look like prologue.
Scenario three — the gray grind. Neither deterrence nor dramatic escalation: the campaign continues at roughly its current tempo — a fire here, a parcel there, the occasional drone — while Western governments issue periodic warnings and modest sanctions. The threshold never quite gets crossed; the limits never quite get found. This is the most likely outcome by the simple logic of hybrid warfare: it is designed to be sustainable, and sustainability is what has made it so hard to stop.
Whichever scenario unfolds, this weekend changed the public terms of the conflict. “Testing the limits” is now on the record from the EU’s top diplomat. The limits, from here on, are being watched.
Sources
- USA Today, “US, Europe worry Russia is testing NATO with ‘hybrid attacks’ of sabotage” (Sept. 26, 2026) — Kallas “testing the limits” and “in a confrontation” remarks; Rutte hybrid warfare statement
- UNILAD, “Denmark warns Russia is ‘preparing to escalate hybrid attacks on Europe’” (Sept. 24, 2026) — Danish security services’ Cold War-scale assessment
- Reuters, “EU, some EU states summon Russian embassy officials over Leipzig drone attack” (Sept. 2, 2026) — diplomatic response to the DHL cargo facility drone strike