After a pause, sabotage in Europe returned and began to move to bigger targets. Europe's Hybrid Threat Outlook 2026 shows what the record says about that shift and where the pressure is likely to fall in the months ahead. Request the document to read the full assessment.
What is inside?
Europe's Hybrid Threat Outlook 2026 shows how hybrid operations against Europe have changed since February 2022 and what comes next. It covers physical sabotage, cyber operations with physical or service effects, airspace and navigation interference, and information manipulation.
The evidence combines official and court sources, research and media, and the Janus knowledge base, our structured record of hybrid-threat incidents in Europe since 2022, built from public sources. Every source was checked against the publisher's own text. The knowledge base reads patterns, not totals: it shows which targets, methods, and regions keep coming up, as shares of the incidents it records in EU member states. An incident counts as Russian-linked when an official body attributes it to Russia or Belarus, or when research or media report such a link.
A Pause, Then More Dangerous Targets
Sabotage counts in Europe fell in 2025, and Western officials said the campaign had “noticeably calmed” before it resumed. Then came the attributions: a rail bomb meant to derail a train in Poland, an explosive drone at Leipzig/Halle airport. Six datasets, from CSIS and Leiden University to the Associated Press and ICCT, agree on the dip. The attributions since November 2025 show what changed: fewer incidents, but more dangerous ones.
What Is Targeted and Where
Russian-linked covert attacks follow Europe's support for Ukraine: the supply line, the logistics hubs, and civilian sites chosen for their symbolism. Aviation, absent from the early record, has become the place where the tools converge. Energy tells a different story. Exposure is not even either, as the map shows.
Organised Operations and Named Actors
Behind the fires and parcels sits a cheap, repeatable chain: a handler recruits a stranger online, pays per task, asks for video proof, and then reuses the footage as propaganda. The case follows each step, shows why so many operations leak, and sets out who governments have named, and on what basis.
Outlook: October 2026 – April 2027
The next six months bring a heating season and four national elections, and on 28 September Kaja Kallas said intelligence shows more sabotage is planned. The case sets out eight judgements, each rated from unlikely to almost certain, with the signs that would change our view.
Why Should You Read It?
- Essential reading for security, risk and resilience teams in rail, aviation, energy and defence manufacturing.
- Relevant to government audiences, including national defence teams and strategic communications (stratcomms) units, who have to plan for what the coming months could bring.
- Gives leaders a sourced view they can brief from: every source checked against the publisher's own text, every government attribution kept apart from a conviction.
- Reads hybrid sabotage as a pattern with a direction, not a string of isolated incidents.
