Exploding Packages, Cyberattacks and Sabotage Plots Expose Scale of Russia's War on Europe, ISW Warns

German authorities have formally linked Russia to an incident involving an explosives-laden drone found near a cargo plane at Leipzig/Halle Airport overnight on 4-5 August, an incident the Institute for the Study of War (ISW) describes as a 'turning point' in the willingness of European officials to publicly discuss ongoing Russian kinetic actions.

A second drone collided with another cargo aircraft as it aborted its landing.

In a report published on 16 September, titled 'The Russian Military Campaign Against Europe: Defining the Threat', ISW argues the Kremlin's ambitions extend far beyond Ukraine.

The think tank says Russia is conducting a coordinated campaign involving drone strikes, rail sabotage, arson, cyberattacks and assassination attempts against Europe, and warns that European leaders are still using language that can limit their ability to respond.

Leipzig Attack Marks a Turning Point

German Interior Minister Alexander Dobrindt and Foreign Minister Johann Wadephul said on 1 September that Germany and its partners had clearly identified Russian involvement in the Leipzig incident. They pointed to tactics consistent with known Russian methods and technical capabilities.

Dobrindt also said Germany is 'not at war' but is the 'daily target of hybrid warfare'. ISW describes this as a 'tortuous attempt to deny reality', arguing that if a state is subjected to daily warfare activities, it is effectively already at war.

Russia has denied involvement in the Leipzig incident and rejected Germany's accusations.

No Longer Hybrid, They Are Very Kinetic

Polish Foreign Minister Radosław Sikorski said on 17 August that Russian actions against Europe have 'turned kinetic', citing assassination attempts and efforts to sabotage Polish railways. Lithuanian Foreign Minister Kęstutis Budrys went further on 2 September, saying Russian attacks are 'no longer hybrid; they are very kinetic'.

European Commission President Ursula von der Leyen described the Leipzig incident as 'an attack using military-grade material carried out by Russian operatives on European Union soil'.

Estonia's Director General of Foreign Intelligence, Kaupo Rosin, said Europe must abandon euphemisms like 'hybrid warfare' and call the campaign 'state-sponsored terrorism'. EU High Representative Kaja Kallas said the Leipzig incident had 'all the characteristics of state-sponsored terrorism'.

ISW says this shift in language matters because terms such as 'provocation' or 'sub-threshold' can discourage NATO states from considering Article 4 or Article 5, even when an attack may merit such consideration.

A Threat That Could Arrive Sooner Than Planned

Elsewhere in Europe, Russian drones have already entered NATO airspace. Romanian authorities said a Russian drone struck an apartment building on 29 May, injuring two people, while Ukrainian railway authorities said a drone strike on 13 September appeared to target a train carrying European officials out of Kyiv.

Germany's Ministry of Defence has said its rearmament plans are focused on 2029, amid assessments that Russia could be capable of attacking NATO territory by then.

But the Dutch Ministry of Defence's 2026 strategy report warned that, in a worst-case scenario, 'a limited war against NATO members could be possible within one year' of the Ukraine war ending.

Estonia's Commander of the Defence Forces, General Andrus Merilo, said in May that Russia could rebuild its combat readiness as early as 2027.

Latvia's Chief of Defence, General Kaspars Pudāns, said on 4 June that if he were the Kremlin, 'we should do it by the end of 2028', before most European modernisation plans are complete.

ISW's warning challenges assessments that Russia may not be capable of mounting a major conventional threat to NATO until the end of the decade.

If frontline states such as Estonia and Latvia face a shorter timeline, the report suggests NATO's current rearmament pace could leave a gap before planned capabilities are fully in place.

For the UK and other NATO members further from the front line, the report says sabotage, drone incursions and cyberattacks should not be treated as isolated 'provocations' but as part of a broader Russian campaign that could influence the alliance's response to any attack on allied territory.