Special Report: Russian Hybrid Attacks, the Ukraine War and NATO

NATO’S EASTERN FLANK — September 28, 2026. More than four and a half years into Russia’s full-scale invasion, the war in Ukraine is being fought on two widening fronts. Inside Ukraine, the ground war has settled into near-stalemate while Moscow escalates a long-range drone and missile campaign aimed at breaking the country before spring. Outside Ukraine, Russian hybrid attacks on NATO and European Union states have grown more frequent, more varied and, by several official accounts, more dangerous.

This report draws on assessments from the Institute for the Study of War (ISW), European security services, NATO and datasets from CSIS and the International Centre for Counter-Terrorism (ICCT).

Key takeaways

ISW describes Russia’s net battlefield gains in recent months as near zero, and Moscow is now betting on a winter strike campaign built on jet-powered drones and ballistic missiles.
Peace diplomacy is stalled. Washington has proposed technical-level trilateral talks in the United Arab Emirates, but Russia says it will not pause fighting during negotiations.
Datasets show a steep rise in Russian hybrid attacks since 2022: CSIS counted 3 attacks in 2022, 12 in 2023 and 34 in 2024, and the ICCT and GLOBSEC have logged 151 cases through February 2026.
Drone incursions into Romania have tripled this year, Russia’s GPS-spoofing antennae in Kaliningrad have grown from 3 to 36, and Danish intelligence expects more frequent and more consequential hybrid attacks.
NATO is turning Eastern Sentry into a standing air-defence plan, while the EU weighs an “emergency security protocol” for incidents below the threshold of armed attack.

The front line: static ground war, escalating air war

In its September 27 assessment, ISW noted that a prominent Kremlin-affiliated military blogger now concedes the front is “static,” which ISW called a tacit acknowledgement of Russia’s near-zero net advances in recent months. Ukrainian forces have recently advanced in the Chasiv Yar area and east of Oleksandrivka, and ISW reports Russian units near Lyman struggling to conduct a fighting withdrawal across the Zherebets River. Denmark’s Defence Intelligence Service (DDIS) assessed on September 24 that “there is no prospect” of a significant Russian breakthrough in the next six months, Breaking Defense reported.

The air war is a different story. ISW assesses that President Vladimir Putin has adopted a new “theory of victory” that relies on combined ballistic missile and jet-powered drone strikes to force Ukraine to capitulate over the winter of 2026-2027. Putin said on September 25 that Ukraine “must feel” Russia’s “retaliatory” strikes.

The numbers show the scale. BBC Verify, citing Ukraine’s military, reported that jet-powered Geran drone attacks grew from 350 in June to 1,600 in July and 2,800 in August. President Volodymyr Zelensky said on September 26 that Ukraine had intercepted more than 1,500 of the 2,730 jet-powered drones launched in September so far, a rate of about 55 percent. On September 27 he said Russia had fired more than 2,200 long-range strike drones, 1,650 glide bombs and 38 missiles, most of them ballistic, in a single week.

Ukraine is hitting back at Russia’s energy sector. A Ukrainian official said strikes around September 25-26 halted operations at the Perm and Novoshakhtinsk refineries, according to ISW. Kyiv is also racing to field interceptor drones that can catch jet-powered Gerans; Kyrylo Budanov, head of the Presidential Office, said mass use could begin within a few months.

Diplomacy: a proposed UAE channel, but no pause in fighting

Ceasefire efforts remain stuck. US-brokered talks in Abu Dhabi in January and February ended in stalemate over territory, bne IntelliNews reported. After meeting President Donald Trump at the UN General Assembly on September 22, Zelensky said the United States had proposed a technical-level, three-way meeting with Russia, possibly in the UAE, and that the sides would return “in 10 days with either a new perspective or a result.”

According to the Kyiv Post, Zelensky said Washington is pushing three steps: an energy ceasefire, a reopened Black Sea grain corridor and a trilateral meeting. Moscow has given little ground. Foreign Minister Sergey Lavrov told the UN Security Council that Russia would not suspend hostilities during negotiations in any format, arguing a pause would give Ukraine a “respite.” Putin said on September 25 that Russia would decide on talks based on its own interests, citing a large Ukrainian drone raid on the Moscow region during the September 18-20 State Duma election.

German Foreign Minister Johann Wadephul met Lavrov in New York on September 26, their first meeting since January 2022, and said afterwards that Russia “is currently showing no willingness to take a constructive negotiating position.” ISW judges that Putin is unlikely to negotiate seriously until his strike strategy has “run its course.” Trump has signed a bill authorising new Russia sanctions but has also invited Putin to the G20 summit in Miami, USA Today reported.

NATO’s posture: from air policing to air defence

Eastern Sentry was launched on September 12, 2025, after 19 drones entered Polish airspace on the night of September 9-10, an incident that prompted consultations under Article 4 of the North Atlantic Treaty. A year on, Lt. Gen. Jason Hinds, commander of NATO’s Allied Air Command, says the alliance has “transitioned away from air policing” to air defence, with Eastern Sentry becoming the basis of a new Standing Defense Plan 12000, according to MrEast.eu, citing The War Zone. Hinds warns that relying on fighter jets to down cheap drones is “not putting us on the right side of the cost curve.”

On spending, allies pledged at The Hague in 2025 to invest 3.5 percent of GDP in core defence by 2035, plus 1.5 percent in broader security spending. NATO estimates reported by Reuters in July show five allies already above 3.5 percent in 2026: Lithuania (5.33), Estonia (5.1), Latvia (4.92), Poland (4.68) and Greece (3.65). European allies and Canada together are projected at 2.53 percent and the United States at 3.17 percent, even as the Pentagon weighs whether to significantly reduce its presence in Europe.

Air defence is Ukraine’s most acute gap. The Prioritised Ukraine Requirements List (PURL), launched in July 2025, lets allies buy US weapons for Kyiv. NATO Deputy Secretary General Radmila Shekerinska said about 90 percent of the Patriot interceptors reaching Ukraine now come through the scheme, Forces News reported. NATO Secretary General Mark Rutte said on September 8 that allies had allocated more than $10 billion over the past year to PURL and US foreign military sales for Ukraine, including $3.5 billion from the Ukraine Support Loan. ISW notes that Russia’s winter plan counts on Ukraine’s shortage of Patriot interceptors against ballistic missiles.

The increase in Russian hybrid attacks

The defining trend of 2026 is the rise in hybrid pressure on NATO and EU states: sabotage, arson, drone incursions, electronic interference, cyberattacks and influence operations that stay below the threshold of armed attack. Moscow denies involvement.

What the data show

Attribution is slow and datasets measure different things, but several point the same way:

CSIS: Its database of Russian attacks and plots with physical effects in Europe recorded 3 incidents in 2022, 12 in 2023 and 34 in 2024, a fourfold and then nearly threefold rise.
ICCT and GLOBSEC: A February 2026 update added 41 incidents, for 151 known cases between February 2022 and February 2026. Poland is the most targeted country (31), followed by France (20), Lithuania and Germany (15 each), the UK (12) and Estonia (11). The authors say the real number is likely higher, noting that German authorities recorded 320 suspected sabotage attempts in 2025 alone.
Romania: Defence ministry figures reported by the Associated Press show 27 drone incursions from January to mid-September 2026, against 9 in all of 2025. Drones or debris were found on Romanian soil 37 times (16 last year), and about 56 military aircraft were scrambled (21 last year).
GPS interference: A Lithuanian regulator told Reuters in May that Russia had expanded its GPS-spoofing antennae in Kaliningrad from three in early 2025 to 36, with a reach of up to 450 km.

The trend has not been a straight line. Leiden University researcher Bart Schuurman told France 24 in December 2025 that “classic” hybrid activity such as sabotage, arson and vandalism in 2025 was about half its 2024 level, excluding drone incursions. The ICCT now describes a campaign that “has not abated,” and in May 2026 GCHQ Director Anne Keast-Butler said Russia is “scaling up its daily hybrid activity against the UK and Europe,” as quoted by the US Congressional Research Service (CRS).

Drones, missiles and airports

On July 30, a Russian Kh-101 cruise missile came down in a field in Poland’s Lublin region, about 90 km from the Ukrainian border, during a mass strike on Ukraine. Polish Deputy Defence Minister Cezary Tomczyk called it “a provocation, an intention, an alliance test.” On September 15, Italian Eurofighters flying for NATO shot down a drone over central Lithuania, the first such shoot-down over Lithuanian territory; President Gitanas Nausėda said it was a Russian Gerbera probably pushed off course by Ukrainian electronic warfare. Romania tracked another likely Russian drone over the Danube Delta on the night of September 26-27, ISW reported.

On August 5, an explosives-laden drone was found near a Ukrainian cargo plane at Leipzig/Halle Airport, an incident Germany has publicly attributed to Russia. Not every scare has been confirmed, however: in June, Danish police closed their investigation into the September 2025 shutdown of Copenhagen Airport, saying they could neither confirm nor rule out drone activity, though Denmark’s armed forces separately concluded that drones had flown over military sites that month.

Sabotage and arson

Physical sabotage increasingly targets the supply chain for Ukraine. On September 24, Polish Deputy Prime Minister Krzysztof Gawkowski called a fire at a Starlink ground station in central Poland an “act of sabotage” that was “deliberately designed to disable the station.” The blaze disrupted internet access for several institutions, including the Ukrainian military, The Guardian reported. German investigators suspect Russia’s GRU military intelligence of incendiary attacks on the Munich headquarters of Rohde & Schwarz and Helsing, which supplies Ukraine’s military, on September 3, FAZ reported, as cited by ISW. The ICCT found that about 95 percent of perpetrators in its dataset were ordinary citizens without formal ties to Russian intelligence, most of them paid recruits.

Undersea cables, jamming and the shadow fleet

The CRS counts at least six suspected sabotage or disruption incidents involving Baltic undersea cables in December 2025 and January 2026, and in April 2026 the UK exposed what it called a covert Russian submarine operation around critical undersea infrastructure. On September 14, a Russian frigate fired flares at a Danish military helicopter, which DDIS called the “most serious” example of Moscow’s aggressive conduct toward NATO forces in the Baltic. GPS jamming and spoofing spike during Ukrainian drone attacks on Russia, a Lithuanian official told Reuters.

The EU’s 21st sanctions package, adopted on July 23, added 41 vessels, taking the number of sanctioned shadow-fleet ships above 670, and for the first time listed tankers that refuel the fleet, according to a circular from the insurer Gard.

Cyber and influence operations

The CRS cites a December 2025 cyberattack on 30 energy facilities in Poland and an April 2025 cyberattack that opened floodgates at a Norwegian dam. Gawkowski said in May 2025 that Russian military intelligence had doubled its information and cyber activity against Poland compared with the previous year. Ahead of Latvia’s October 3 election, the State Security Service (VDD) said it had found no “significant and systematic” Russian effort to sway the result, but is assessing individual disinformation cases and said provocations by Russia or Belarus “cannot be ruled out.”

Warnings of worse to come

DDIS said on September 24 that Russia “will intensify its hybrid war by carrying out more frequent attacks against the West and NATO,” including cyberattacks that “cripple societal functions” and sabotage “with a high risk of casualties.” It described a “low but growing risk” of a limited Russian military attack on a NATO country while judging an outright invasion “highly unlikely.” French President Emmanuel Macron said on September 18 that the Russian hybrid threat “has intensified.” Polish Prime Minister Donald Tusk warned of a “real risk” of Russian strikes on NATO territory that Moscow would call “accidental.” EU foreign policy chief Kaja Kallas told USA Today: “They are testing how far they can go.”

How NATO and the EU are responding

After airspace violations in Poland and Romania, the North Atlantic Council said on August 12 that “Russia bears full responsibility” and that the incidents “demonstrate Russia’s increasing tolerance for risk.” Baltic Sentry, launched in January 2025, patrols undersea infrastructure alongside Eastern Sentry, and Slovakia’s parliament approved up to 101 troops for Eastern Sentry on September 17, MrEast.eu reported.

The EU is building its own tools. In her September 16 State of the Union address, Commission President Ursula von der Leyen said “Europe needs its own counter-hybrid playbook,” proposing an emergency security protocol any member state could trigger and backing a European Security Council that would include Britain, Norway, Ukraine and Canada, Reuters reported. As of July 2026 the EU had sanctioned 26 entities and more than 100 individuals over Russia’s destabilising activities, the CRS says. Romania and Poland have acquired the MEROPS counter-drone system, and Romania has joined NATO’s Drone Edge counter-drone project. Estonian Foreign Minister Margus Tsahkna’s prescription: “attribute, put more sanctions, respond.”

What to watch next

Early October: Zelensky’s roughly 10-day window from September 25 for a US-brokered technical meeting.
October 3: Latvia’s parliamentary election, a test of the VDD’s warnings on disinformation and provocations.
October 15-16: European Council summit in Brussels, as the Commission develops its security council and emergency protocol ideas.
This autumn: The first Coalition of the Willing exercise in Poland, with France and the UK as core participants, rehearsing a post-war deployment to Ukraine, Defense News reported.
By October 25: The European Commission’s review of a full ban on selling LNG tankers to Russia.
Winter: ISW expects Putin to escalate strikes into winter and says he may still order a large-scale mobilisation this autumn.
December 14-15: G20 leaders’ summit in Miami, to which Putin has been invited.
January 1, 2027: The EU ban on Russian LNG imports takes full effect.

NATO has not yet published dates for its next defence or foreign ministers’ meetings, and the timing of its annual Steadfast Noon nuclear exercise, usually held in October, has not been announced.

Special Report: Russian Hybrid Attacks, the Ukraine War and NATO

Key takeaways

The front line: static ground war, escalating air war

Diplomacy: a proposed UAE channel, but no pause in fighting

NATO’s posture: from air policing to air defence