Germany just broke the taboo on Russian hybrid attacks

The line that just moved

Germany has formally concluded that the Kremlin was behind the attempted drone strike on Leipzig airport. The announcement, made by Interior Minister Alexander Dobrindt on Tuesday, carries more weight than the sanctions that followed it. For the first time, a major Western European power has pointed directly at Moscow for an attack on its soil that falls squarely in the gray zone between peace and war.

The phrasing Dobrindt chose reveals how much the ground has shifted: “We are not at war. But we are the target of hybrid attacks on a daily basis.” Germany simultaneously raised its threat level from general to high. Two statements that seem to pull in opposite directions are actually describing the same new reality—one Europe has been circling for years and is only now willing to name openly.

What Leipzig changes

Previous suspected Russian attacks in Europe have always carried qualifiers. Exploding parcels at a German depot. An arson attempt at an Ikea in Vilnius. In each case, authorities described them as suspected or investigated, never as definitively attributed. The Leipzig incident breaks that pattern. Berlin is no longer leaving room for plausible deniability on either side.

That precision matters because hybrid attacks derive their power from ambiguity. Moscow benefits when European publics cannot agree on whether a disrupted flight, a cyber intrusion, or a suspicious package constitutes an act of war or merely nuisance. Formal attribution removes that cover.

The sanctions package Germany announced—tighter entry controls on Russian nationals, among other measures—is the predictable follow-up. But the symbolism of the attribution itself is the real escalation, and it is one the Kremlin will find harder to absorb than any financial penalty.

The institutional response taking shape

NATO secretary-general Mark Rutte called the evidence “clear” and promised to strengthen the Alliance’s ability to deter malign actions. Ursula von der Leyen echoed the call for a “clear response” and is set to meet Rutte in Brussels to discuss closer EU-NATO coordination on hybrid threats. Polish Prime Minister Donald Tusk declared Europe would “not be intimidated.” Italian Prime Minister Giorgia Meloni vowed a “united response.”

The coordination language is notable. Hybrid attacks exploit the friction between institutions—the gap between NATO’s military framework and the EU’s tools for economic and regulatory response. von der Leyen’s planned meeting with Rutte signals that both organizations are now treating that gap as a problem to close rather than a permanent feature of European security architecture.

At the informal EU foreign ministers’ meeting gathering in Wicklow, Ireland, High Representative Kaja Kallas said the bloc is preparing what she called “the most far-reaching sanctions” against Moscow yet. A draft list already names over 1,600 companies and individuals; Berlin’s announcement is expected to push that number higher.

The Ukraine dimension that won’t go away

Any discussion of hybrid escalation against Europe is incomplete without the war in Ukraine, which remains the catalyst for much of Moscow’s broader strategy. President Zelenskyy issued a direct warning last night that Russian airspace is effectively closed due to Ukrainian drone operations. He stressed that Kyiv was not threatening civilian aviation, but added that airlines, insurers, and anyone still using key Russian airports should reckon with the growing danger.

The practical implication is significant: commercial air traffic over Russia is about to contract further, and the economic ripple effects will compound the hybrid pressure Moscow is already applying through energy disruption and cyber operations.

Ukraine’s own strain is becoming harder to ignore. The Ministry of Defence faces a €23 billion deficit. Russia’s relentless drone campaign is increasing the material costs of defense at a pace that casts doubt on whether the EU’s €90 billion loan package will hold until the end of 2027 as originally intended. The European Commission is reluctant to reopen the debate so soon after approving the loan, but the math is worsening. Kallas admitted there has been “no concrete success” yet in convincing Greece and Spain to donate their Patriot interceptors—an air defense gap that grows more acute with each passing week.

The deeper institutional fracture

While everyone focuses on sanctions and attribution, a quieter but potentially more consequential debate is unfolding inside the EU. Eleven member states have joined forces to demand an end to obstructive vetoes in foreign policy, pushing to move from unanimity to qualified majority voting. The letter, obtained by Euronews, argues that the current culture of consensus fosters inaction rather than common action.

The target is clear without being named: Viktor Orbán’s Hungary has repeatedly blocked or delayed EU measures against Russia. The reform effort is a direct response to the kind of hesitation that hybrid warfare exploits. When Moscow can count on a single member state to delay sanctions or block declarations, the attack succeeds even before it begins.

The irony is that hybrid escalation and institutional paralysis reinforce each other. The more Moscow probes Europe’s thresholds, the more valuable unified responses become—and the more damaging any single veto.

What happens next

The immediate test is whether the EU can translate formal attribution into coordinated action faster than the next hybrid incident occurs. The October deadline for China trade negotiations and the looming ECB rate decision add economic pressure on top of the security one. Europe is being squeezed on multiple fronts simultaneously, and that is precisely the logic of hybrid strategy.

What is clear is that the era of ambiguous responses is ending. Germany’s decision to name Russia directly for an attack on its infrastructure marks the point where Europe stops treating hybrid attacks as background noise and starts treating them as the primary theater of confrontation. The question now is whether the institutions and alliances can move fast enough to match the speed of the threat.

The alternative is a slow creep of incidents—parcel explosions, cyber intrusions, migration flows, airport disruptions—that individually seem manageable but collectively erode confidence, economic activity, and political cohesion. Leipzig is not that erosion. It is the moment Europe decided to stop describing it and start fighting it.