Journalists from 17 European public service broadcasters, coordinated by the European Broadcasting Union’s (EBU) Eurovision News Spotlight network, published an interactive map on 23 October 2026. It documents hybrid incidents linked to Russia across 17 European countries between 1 April and 15 October. Journalists compiled a database of hundreds of reported incidents, categorizing each by type and the source and strength of its alleged links to Russia, then verifying them through open-source research.
The map comes as officials warn the campaign is growing. On 28 September, EU foreign policy chief Kaja Kallas said in Brussels that Russia was planning more acts of sabotage to divide societies and intimidate them into abandoning their support for Ukraine. The points on the map represent an incomplete list of publicly known cases attributed to Russia or suspected of being linked to it, the report states.
The map covers airspace violations, sabotage attempts, “disposable” agents with no formal intelligence training, migration used as a weapon, and Russian military activity near or across European borders. It excludes cyberattacks, influence operations, and espionage by trained intelligence officers.
The EBU calls the result a very conservative estimate, not an official tally. Russia has consistently denied responsibility for the incidents. Many single points represent several incidents of the same type in one area or in quick succession. In Moldova, for example, Defense Minister Anatolie Nosatîi said on 30 September that the government had recorded 84 drone incursions.
Four German incidents are on the map, out of many more
The map shows four incidents in Germany, according to BR.
The four incidents in Germany on the EBU hybrid war map, 2 August to 14 September 2026. Other dots mark Russia-linked incidents in neighboring countries. Map: Luc Martinon/EBU, Eurovision News Spotlight; edited by Euromaidan Press
On 2 August, German authorities arrested a 33-year-old Ukrainian man in Thuringia on suspicion of photographing a Bavarian weapons manufacturer for a foreign intelligence service as part of an alleged sabotage plot.
On 4 August, a drone carrying explosives and a detonator struck the wing of a Ukrainian An-124 cargo plane at Leipzig/Halle Airport but failed to explode.
On 3 September, attackers threw firebombs from a car onto a construction site next to defense firms in Munich, and German security authorities suspect Russian intelligence.
On 14 September, investigators learned of a crashed drone found near the Bundeswehr’s Wunstorf air base.
Internal papers from the new Joint Hybrid Defense Center, seen by Correctiv, record 163 suspected sabotage cases in 2026 up to 19 August. The targets included rail lines, military facilities, substations, and radio masts. The same papers record 1,034 drone overflights of critical infrastructure, military sites, and defense companies, and 25 espionage investigations. The papers cover possible attacks by Russia, China, and Iran, and media did not report a breakdown of the sabotage cases by country.
European leaders sound the alarm over Russian hybrid attacks
On 15 April, Swedish civil defense minister Carl-Oskar Bohlin said pro-Russian groups had moved from denial-of-service attacks to attempts at destructive cyberattacks, including one on a Swedish power plant in 2025. On 1 September, German Foreign Minister Johann Wadephul named Russia as the perpetrator of the Leipzig attack and accused Moscow of “blatant hostility” toward Germany.
On 18 September, French President Emmanuel Macron said Russia’s hybrid attacks would not go unanswered and ordered a plan to protect France’s critical infrastructure. On 1 October, German Chancellor Friedrich Merz said Germany was preparing for new hybrid attacks, “including serious ones.” NATO Secretary General Mark Rutte on 14 October called the attacks a sign of Russian weakness at a press conference in Tallinn and said NATO would react where needed without being “rattled.”
An investigation involving 17 European public-service news organisations has documented hundreds of suspected hybrid attacks across Europe in just over six months, revealing the scale of a security challenge that increasingly extends beyond conventional espionage and cyberwarfare.
The investigation, coordinated by the European Broadcasting Union, examined incidents reported between 1st April and 15th October 2026, including sabotage attempts, arson, airspace violations, suspicious drone activity and the exploitation of migration routes along the European Union’s eastern borders.
Published on 23rd October, the resulting interactive map provides a geographical picture of incidents publicly linked to Russia by intelligence agencies, law-enforcement authorities, government officials or reporting. The degree of attribution varies considerably, however, and many incidents remain under investigation.
The findings point to a fundamental problem for European security: hostile activities can be conducted across national boundaries without necessarily triggering the legal, military or political mechanisms designed to respond to conventional aggression.
Sabotage Without Conventional Warfare
Among the cases examined is an incident in Munich in September, when two Bulgarian nationals allegedly threw incendiary devices from a moving vehicle onto a construction site near several defence companies.
Police arrested the suspects after a witness reported the incident. Bavarian Interior Minister Joachim Herrmann and regional criminal investigators subsequently indicated that political motives were being considered. Investigators reportedly suspected possible involvement by Russia’s military intelligence service, the GRU, although the allegations have not been established in court.
The case illustrates growing concern about so-called disposable agents: individuals recruited to undertake relatively limited operations without formal intelligence training or a longstanding relationship with an intelligence service.
Such arrangements can complicate investigations. Even where perpetrators are identified, establishing a legally demonstrable connection between their actions and a foreign intelligence organisation may prove considerably more difficult.
Germany’s Federal Criminal Police Office has registered a mid-three-digit number of suspected sabotage and reconnaissance cases since the beginning of 2026, according to information provided to investigators involved in the European mapping project.
Only a small proportion have been publicly attributed to Russia. Four German incidents were included in the map, demonstrating the distinction between a broad national caseload and cases meeting the investigation’s publication criteria.
Europe’s Eastern Borders Under Pressure
The geographical distribution reveals substantial activity along NATO’s eastern flank, particularly around the Baltic states, Belarus and the Black Sea.
Incidents include repeated airspace violations, suspected reconnaissance operations and attempts to facilitate unauthorised border crossings. Lithuanian authorities have accused Belarus of deliberately exploiting migration as an instrument of political pressure.
Commercial shipping has also become increasingly exposed. Drone attacks involving vessels near Romania and Bulgaria have raised concerns about the extension of the war’s consequences into maritime areas adjoining EU and NATO territory.
Teija Tiilikainen, director of the European Centre of Excellence for Countering Hybrid Threats, identified Russia’s invasion of Ukraine as an important factor behind the increasing pressure. According to her assessment, Moscow’s objectives include weakening Western unity and undermining continued support for Ukraine.
The Legal and Institutional Challenge
The central difficulty is not simply the absence of criminal legislation. Arson, espionage, sabotage and unlawful interference with critical infrastructure are already punishable under national laws.
Rather, the challenge involves establishing foreign direction, coordinating investigations across jurisdictions and identifying when a series of apparently separate offences constitutes a wider hostile campaign.
Germany’s domestic intelligence chief, Sinan Selen, has described the environment as a grey area between war and peace. German foreign intelligence chief Martin Jäger has similarly identified Russia as the country’s most dangerous adversary.
European governments are beginning to address these difficulties collectively. At their 15th–16th October summit, EU leaders condemned intensifying hybrid attacks and called for stronger resilience, greater use of existing countermeasures and accelerated work on drone security.
Meanwhile, a European Commission research initiative, published on 23rd October, proposes combining anticipation, active defence and retaliatory measures into a more coherent deterrence strategy.
From Individual Incidents to Collective Security
The investigation’s significance extends beyond the number of incidents recorded. By bringing together information previously dispersed among national authorities and separate investigations, it makes possible a wider assessment of the methods, geographical concentration and recurring characteristics of suspected hostile operations.
Nevertheless, the map does not establish Russian responsibility for every incident it records, nor does it constitute a complete European database. Russia has repeatedly denied conducting the hybrid attacks attributed to it.
For European governments, the unresolved question is how to move from recognising a pattern of hostile activity to demonstrating responsibility and responding effectively.
The emerging security challenge therefore concerns not only the detection of individual perpetrators, but also Europe’s ability to connect incidents across borders, establish responsibility and prevent successive operations from becoming an accepted feature of the continent’s security environment.
Login
