A level of Russian interference and operational activity on European soil this intense has never been recorded before. That, in a nutshell, is the assessment emerging from officials and analysts tracking Moscow’s active measures across the continent — a dossier that Formiche and Decode39 have followed for more than a decade.
It is also a dossier sitting on the desks of Italy’s prime minister’s office and relevant ministries, informed by intelligence work aimed at monitoring what is now openly described as “hybrid warfare”.
- These activities have become more intense and overt since Vladimir Putin ordered the full-scale invasion of Ukraine, particularly as Russia’s current difficultiesintersect with uncertainty in the West over continued support for Kyiv — uncertainty amplified by propaganda campaigns designed to inject Kremlin narratives into European political debate and, through it, public opinion.
- The issue is as much the nature of these incidents as their number. Drone incursions and airspace violations, intelligence operations and sabotage, pressure against critical infrastructure and economic interests, cyber attacks and disinformation all vary in attribution and severity.
But they share a basic logic: applying pressure on Europe while remaining, whenever possible, below the threshold that would trigger a conventional military response.
- All this is happening as several EU countries, including Italy, approach a complicated electoral year.
A ‘crazy’ week in Europe. Consider just the past week — “crazy”, as one European source described it.
- In Romania, the SRI intelligence service said it had thwarted a Russian-coordinated sabotage operation. A Russian citizen living in the country allegedly collected images of military installations, communications centres, critical infrastructure and Ukrainian Antonov cargo aircraft. The SRI linked the operation to a pattern already detected elsewhere in Europe, including the recruitment of vulnerable individuals for surveillance and sabotage activities.
- Days later, a drone arriving from Moldova penetrated dozens of kilometres into Romanian airspace, prompting the scramble of two Spanish F-18s deployed under NATO’s Enhanced Air Policing mission. Along the same eastern flank, Russian drones struck the Starokozache crossing on the Ukrainian-Moldovan border, killing two people. Ukrainian border guards said Moscow had targeted five crossings in the preceding weeks — four towards Moldova and one towards Romania.
- Further north, the pressure reached Alliance territory directly. In Lithuania, a NATO fighter — with an Italian *fin-flash*— shot down a drone that had entered the country from the direction of Belarus. Around the same time, a Russian warship fired two flares close to a Danish military helicopter operating over the Baltic.
- Near the Polish border, meanwhile, a Russian drone struck a passenger train in Ukrainian territory, roughly two kilometres from the frontier. Shortly beforehand, a delegation including Boris Johnson, Carl Bildt, Sanna Marin and Aleksander Kwaśniewski had travelled along the same railway line. Also on board was Fabrizio Saggio, diplomatic adviser to Italy’s prime minister, who later told his staff: “They knew who was travelling and where. The message is: we can hit you.”
- There is insufficient public evidence to establish that the delegation itself was the intended target, although the Ukrainian railway operator considered it possible that the drone had been aimed at the diplomatic train. Warsaw subsequently strengthened security at its border crossings with Ukraine.
Operational pressure has been accompanied by political intimidation. Nikolai Patrushev, a Putin adviser and former secretary of Russia’s Security Council, said that if Poland intervened militarily against Russia, the Polish state would cease to exist within “two or three days”. The threat was conditional, but came amid a sequence of incidents that has further sharpened tensions between Moscow and Warsaw.
The geography is widening, too. In the Netherlands, rail operator ProRail reported suspected sabotage after materials were deliberately placed on tracks at about 30 locations, severely disrupting services. Dutch authorities have not identified either the perpetrators or their motive — an important qualification, since not every suspicious incident in Europe can automatically be attributed to Russia.
- That uncertainty is itself one of hybrid warfare’s defining features. Attribution takes time; the political and psychological effects are immediate. Moscow routinely denies involvement in sabotage operations attributed to it by European governments. But the attitude of European capitals is changing.
- Berlin has formally blamed Russia for an attempted drone attack at Leipzig airport, while Danish intelligence has warned that Russian operations are recruiting ordinary citizens to collect information that could facilitate sabotage.
Brussels, meanwhile, is seeking to turn disparate national responses into a more structured European posture.
- In her State of the Union address, European Commission president Ursula von der Leyen proposed a “counter-hybrid playbook” for responding to sabotage, drone incursions and other below-threshold operations, alongside the idea of a European Security Council that could include partners such as the UK and Norway.
What remains unseen. The Italian picture adds a particularly sensitive dimension.
- Marco Galluzzo reported in an informed article for the Corriere della Sera that officials at Palazzo Chigi maintain a daily tally of hostile acts, retaliation and espionage linked to Russian actors. One detail is particularly telling: “Not all those that are stopped are made public.”
The public face of the phenomenon, in other words, does not necessarily reflect its true scale.
- Attempts have also been made to spy on senior figures at some of Italy’s main state-controlled companies, with Italian security services intervening in time. The episode illustrates how increasingly difficult it has become to separate military security from economic security and the protection of strategic assets.
- The DKC case provides another example: At the end of August, Putin ordered the temporary transfer of control over the Russian operations of the Italian group’s subsidiary, which manufactures systems for electrical and industrial infrastructure, to a Russian company. This move is being perceived in Rome as another form of pressure that could directly impact Italian economic interests.
The Article 5 question. Against this background, the dossier becomes considerably more sensitive.
- For several months, NATO circles have also been examining a much more serious scenario: a limited Russian action against vital Alliance interests or targets, potentially in one of its more vulnerable member states. Romania features among the scenarios under consideration, including through the Black Sea and Transnistrian axis.
This does not mean an attack is considered imminent. There are no indications of an impending Russian operation against a NATO member. The purpose of contingency planning is instead to prepare for the possibility that Moscow may eventually seek to push the threshold further.
- Reports that have also reached Rome place such a possibility as early as the first months of 2027. The logic would be political before it was military: to determine whether a limited action, calibrated narrowly enough to complicate the western response, would actually produce the collective-defence mechanism envisaged by Article 5.
- In other words, such an operation would test the credibility of the Alliance itself — an alliance whose central proposition remains that an attack against one member will be treated as an attack against all.
What has changed is the context in which this possibility is being discussed. It is no longer an abstract war-gaming exercise, but a scenario considered while Europe is experiencing a growing frequency of incursions, sabotage and clandestine operations. In Romania alone, defence ministry data show that drone incursions in 2026 have tripled compared with the previous year.
Italy’s response runs through Oslo, too. This is also why Italian prime minister Giorgia Meloni’s visit to Norway carries a security dimension extending beyond the traditional bilateral relationship.
- Meloni is meeting Norway’s Labour prime minister Jonas Gahr Støre in Oslo, with energy, industrial co-operation and defence on the agenda. But Russian hybrid activities and the drone incursions affecting NATO territory are also part of the discussion.
- Rome is therefore operating within a response that is taking shape simultaneously on several fronts: intelligence and counter-espionage, protection of infrastructure and strategic companies, counter-drone capabilities, industrial co-operation and closer co-ordination with allies.
This may be the most consequential shift. Hybrid operations have traditionally been designed to remain ambiguous enough to avoid triggering a conventional response. But when drones, sabotage, espionage, economic coercion and political intimidation become persistent and simultaneous, the question for Europe is no longer simply how to attribute each individual incident.
The bottom line: It is when the cumulative weight of actions below the threshold begins to alter the threshold itself — and how Europe should respond by tightening the links within the EU and with partners beyond it, from Canada to Norway.
