Border crossings, drones and weapons depots in the crosshairs: the EU’s first summer of hybrid warfare

At what point does a hostile act become, in every respect, a military attack? At the end of a summer fraught with tension – punctuated by suspicious incidents and provocations that most European intelligence agencies attribute without hesitation to Russia – these seem to be the questions echoing from EU governments all the way to Brussels, through the corridors of the Commission and NATO headquarters: has Moscow decided to escalate its confrontation with Europe even further? And how far is it prepared to go? In recent weeks, Europe has been rocked by a spate of sabotage incidents and explosive drones launched at civilian airports, alarms over increasingly reckless border crossings and investigations into clandestine arms caches: a relentless sequence of events, capable of triggering large-scale responses such as last-minute NATO exercises in the Baltic, the sudden visit by the CIA director, John Ratcliffe, to Moscow, and a major military agreement between Sweden and Finland to jointly patrol thousands of kilometres of the longest border between the European Union and Russia. Each of these elements adds up to more than the sum of its parts, but the significance of the full picture risks being underestimated. For this reason, it is necessary to retrace, step by step, the events of a very dangerous summer for Europe – and not just because of the heatwaves.

Visita a Mosca

Il direttore della Central Intelligence Agency, John Ratcliffe, in audizione a Capitol Hill REUTERS/Kylie Cooper

Italia appears to be keeping a low profile, but in reality it has played an important role in this chain of events right from the start: between 24 and 26 July, Romania shot down three drones in three days, at least one of which with the assistance of Italian Eurofighters. As early as the end of May, a Russian drone deployed in an attack against Ukraine had struck Romanian territory, crashing into a flat in the city of Galati, with no casualties resulting purely by chance. Bucharest expelled a Russian diplomat and subsequently revealed that, in the first eight months of 2026, Russian drones had violated its airspace no fewer than 23 times. A few days later, an ‘unidentified object’ originating from Russia crashed in Poland, not far from Lublin, causing a powerful explosion. During the same period, thousands of kilometres away, Finland adopted a series of temporary restrictive measures to protect its airspace and maritime areas near the Russian border from further violations. The previous summer, from September 2025 onwards, the skies over various northern European countries had been traversed by mysterious drones whose origin seemed impossible to determine, but between July and August 2026 the threat began to take on an even more tangible and dangerous form. Not all of the most recent incursions have been carried out by Russian drones, but – as we reported in an episode of our podcast ‘Nome in Codice’ – in some cases, these are Ukrainian drones that have been diverted by mistake or, it is suspected, are being controlled by Russia as part of an operation that is a cross between electronic warfare and psychological warfare, designed to influence European public opinion. Meanwhile, however, even more disturbing incidents are taking place.

Leipzig-Halle Airport is not only a key logistics hub for the whole of Europe: it is also a vital transit point for the delivery of military aid to Ukraine. On the night of 4 August, a drone laden with explosives was found near the wing of an Antonov aircraft bound for Kyiv; according to German media reports, an explosion was averted only thanks to the vigilance of an airport employee, who immediately raised the alarm; however, a few hours later, a second aircraft landing at Leipzig collided with another drone and was forced to divert to Hanover. A drone laden with explosives targeting a European civilian airport undoubtedly represents a significant escalation compared with previous threats, but Leipzig Airport had already been targeted in 2023 by a group of petty criminals recruited by the Russian secret services to send parcel bombs against targets near Ukraine, as we reported in the episode of Nome in Codice on the so-called ‘Bad Actors’. A few weeks later, German investigators announced the discovery of a third drone – also laden with explosives – and an abandoned antenna near a tree in the vicinity, which was probably used to guide the drones. Chancellor Friedrich Merz stated that Germany would soon directly name the foreign power responsible for the operation, but in the meantime another investigation pointed directly to Russia: two weeks after the incident in Leipzig, the German authorities confirm that they have found a hidden arsenal in a forest near Berlin, which – according to reports by Der Spiegel and Suddeutsche Zeitung – was intended to be used to carry out political assassinations in Germany. Among the intended victims was Stefan Thumann, head of the drone manufacturer Donaustahl. The idea of targeting the European arms industry appears to be gaining ground, as a spate of fires and acts of sabotage began in August.

In early August, in Bulgaria, a lorry fire triggered a series of explosions at the factory of EMCO, a private company which manufactures – amongst other things – artillery shells destined for Ukraine. On 15 August, an arson attack struck Milrem Robotics in Tallinn, an Estonian company specialising in combat systems for Ukraine. A few days later, the Latvian authorities arrested three men on the run, believed to be agents recruited by Russia via Telegram to carry out the sabotage. Italia is once again at the centre of these two incidents, because on 13 August – three days after the incident in Bulgaria and two days before the one in Estonia – a massive explosion rocked the KNDS ammunition factory in Colleferro, in the Lazio region. The company supplies medium- and large-calibre ammunition to Ukraine. Although Defence Minister Guido Crosetto stated that there is currently no evidence to support the theory of sabotage, the story of the explosion was picked up by media outlets around the world, raising many questions. Amidst drones, acts of sabotage and alleged ‘bad actors’, fears are mounting of a possible Russian escalation against a NATO country: according to a report in the Wall Street Journal back in May, the heads of various intelligence agencies are not so much concerned about a large-scale attack, but rather a series of covert operations – provocations capable of remaining just below the threshold of an overt attack – designed to test NATO’s Article 5 and ascertain whether the Atlantic Alliance would truly risk a war against Russia merely to protect a small portion of its territory. It is against this backdrop that, on 18 August, NATO launched a military exercise around Kaliningrad, the Russian exclave on Polish territory overlooking the Baltic Sea.

NATO suddenly deploys between 25 and 50 allied jets, several AWACS aerial surveillance systems and a sophisticated US EA-37B Compass Call electronic warfare platform around the Russian exclave. The exercises are centred on the so-called Suwalki Gap, a strategically critical bottleneck between Poland and Lithuania, situated between Belarus and Kaliningrad and – in the event of a Russian attack – which could potentially cut off the Baltic republics from supplies. Although the Polish operational command and NATO spokespeople maintain that this is a routine exercise, the unusual movements have not gone unnoticed, and many analysts believe it is a show of force intended to demonstrate to Russia the Atlantic alliance’s deterrent capability in the event of an attack. Russia, for its part, is launching a counter-exercise at the same time, deploying Su-30 aircraft and Mi-24 helicopters to simulate a response to an enemy air raid, whilst at the same time the Kremlin is quietly carrying out a mobilisation of military personnel in the exclave.