The Ukrainian team visiting Oslo in late August came armed with a hefty research report—73 packed pages of open-source intelligence and policy proposals designed to help Norway prepare for a confrontation with Russia. The most likely scenario, the paper warned, would be more like the Battle of Britain than Operation Barbarossa, Nazi Germany’s 3.8 million-man World War II invasion of the Soviet Union. Moscow is unlikely to send tanks or troops to Norway, the report said. Russian strongman Vladimir Putin knows he can’t win a direct military clash with NATO. More likely would be a combined blitz of drone assaults, sabotage, and cyberattacks—what the paper compiled by the Kyiv-based Sahaidachnyi Security Center and paid for by the Ukrainian drone manufacturer Buntar Aerospace called the “Battle of Norway.”
But even the hawkish Ukrainian team was unprepared for what hit Norway just days later on August 24. The day after Prime Minister Jonas Gahr Støre visited Kyiv, promising continued support and a fourth annual payment of $9.1 billion, a pro-Russia hacker group calling itself Server Killers startled the Nordic nation with social media post. “We declare cyber war” on Norway, the message read—white letters against a fiery background featuring an image of the Kremlin and a Russian flag.
Server Killers is an experienced hacking collective with documented Moscow connections and a long rap sheet—attacks in Britain, Canada, Denmark, Spain, and Romania. Over the next three days, it targeted Digdir, the agency overseeing Norway’s cutting-edge digitization of public services, bombarding its servers with so much spam that government websites stopped working for citizens. The “distributed denial of service attack” was the largest in Norway’s history—if not the start of the battle of Norway, certainly an alarming warning.
Disruptive as it was for Norwegians, the Server Killer attack hardly made international news—Russia is now launching so many so-called “hybrid” or “gray-zone” assaults on Europe that it can be hard to keep track of them.
According to the Sahaidachnyi Center, which maintains one of the best online resources monitoring what it calls the “Everywhere War,” there were nearly two dozen attacks attributed to Russia or pro-Russian groups in the last six weeks alone—and the center’s team says attributed attacks are just the tip of the iceberg.
A cyberattack like the one in Norway shut down government websites in Sweden. Russian drones repeatedly violated Moldovan and Romanian airspace. The Polish Air Force intercepted a Russian spy plane. Arson attacks targeted factories making drone components in Poland and Slovakia. In two other suspected but not yet attributed acts of sabotage, improvised explosives damaged power cables in Germany—two similar and all-but simultaneous incidents more than 300 miles apart.
The attempted attack at the Leipzig/Halle airport, a major NATO logistics hub in eastern Germany, was too brazen for the world to ignore. A drone packed with explosives flew toward a parked Ukrainian cargo plane. It bounced off its wing before landing just a few yards away—fortunately without exploding or igniting the contents of the aircraft’s fuel tank. Twenty minutes later, a second drone nearly hit a DHL cargo aircraft, forcing it to abort landing and divert to another airport. Ten days after that, a third drone packed with the same kind of explosives was found in a field not far from the Leipzig runway. It too had failed to detonate, but if even one of the three devices had exploded, the result could have been a deadly catastrophe.
European leaders across the political spectrum reacted with outrage—clearly, a red line had been crossed. NATO Secretary General Mark Rutte denounced what he called the “malign activities targeting our territory.” European Union foreign policy chief Kaja Kallas warned that “attempts to intimidate Europe will fail.” A few weeks later, when the German government officially blamed Moscow for the incident, both NATO and the EU tweeted their support—a notable show of solidarity.
Still, despite the tough talk, action has been limited. Germany closed the Russian consulate in Bonn and a Russian cultural center in Berlin. Authorities promised tighter controls on Russians seeking to travel to Germany and additional pressure on the shadow fleet that illegally transports Russian oil. But it was hard to see how any of this would give Putin much pause. Certainly, none of these measures are commensurate with what Moscow is doing, and no one has suggested punching back or taking the fight to the enemy.
In fact, Europeans have been agonizing for years about how to fight back against Russian aggression. Already in the Cold War era, Soviet espionage far outmatched Western efforts. A secretive police state was much harder to penetrate than the West’s open democracies, and Soviet operatives faced far fewer ethical constraints. Also apparent early on, many Europeans were uneasy with what they saw as brash U.S. methods—paramilitary operations, covert action, and efforts to destabilize foreign governments. Then, in the decades after the Cold War, Europeans bet big on diplomatic engagement with the Kremlin, inviting Moscow into Western forums and structuring their economies around trade with Russia.
All of this left Europe at a disadvantage when Russia attacked Ukraine in 2014 and began experimenting with what we now know as hybrid tactics. Fearful Western capitals hesitated to alienate Moscow or endanger trade. The downing of Malaysia Airlines Flight MH17 in 2014—Russian-backed separatists in Ukraine used a Russian missile to crash the commercial airliner, killing all 298 passengers and crew—brought a burst of condemnation, but no fundamental shattering of trust. Even in 2022, when Russia again invaded Ukraine and resumed escalating in the gray zone, Europe was slow to see the hybrid threat and uncertain how to react. One scathing Ukrainian, who I won’t name, called it “deterring by ignoring.”
Sahaidachnyi Senior Fellow Elena Davlikanova points to 2024 as a turning point in the everywhere war. By then, Moscow could see it would be a long slog in Ukraine. Russia had survived two years of Western sanctions and restructured its economy on a wartime footing. The Kremlin had also adapted to the West’s 2022 expulsion of the diplomats once responsible for the bulk of Russian espionage, establishing mechanisms to recruit a new generation of operatives—former criminals, alienated migrants, and other marginal, underemployed civilians.
The upshot, according to one count by the French Institute for International and Strategic Affairs: the number of gray-zone operations in Europe grew eightfold between 2022 and 2024, with the top categories being sabotage, vandalism, influence operations, and assassination. But even then, Europeans were unsure how to react, consumed by concerns about ethics and the rule of law.
The debate has been unusually one-sided, with almost all voices favoring restraint and few, if any, arguing explicitly for a muscular, punitive response. Finnish researcher Minna Alander summed up the widely shared consensus behind this cautious approach: “We should never forget what we are protecting,” she wrote, “our free societies based on democracy and the rule of law.” No matter what Russia does, it’s clear to everyone that the West cannot hit back symmetrically—cannot set fire to a shopping mall or try to assassinate a CEO, as Moscow has done repeatedly in Europe in recent years.
But that’s not the only reason for Europe’s timidity. Many leaders still hesitate to alienate Russia, or they fear escalation. It has proved maddeningly difficult to coordinate even a modest continent-wide response—capitals differ widely in their assessment of the Russian threat and how much effort Europe should expend to counter it. Attributing assaults to Moscow—tracing the link between the Kremlin and a petty criminal in Poland or Norway—is arduous and often impossible. Perhaps the biggest stumbling block is public opinion. No leader wants to frighten voters by revealing a threat they cannot counter, and it’s far from clear how many Europeans have an appetite for confronting Russia.
The result, even as Moscow escalates, has been a carefully calibrated “asymmetric” response. Most European tactics, nationally and continent-wide, center on protecting the homeland rather than punishing the Kremlin. The EU approach rests on five pillars: intelligence sharing, protection of critical infrastructure, building societal resilience, public condemnation, and economic sanctions. NATO stresses coordination, protection, and prevention. The toolbox of choice for national leaders has been similarly heavy on defense and cautious, diplomatic steps: increased military spending, sanctions, and continued aid for Ukraine.
Separately and together, these efforts have made some difference. Military aid for Ukraine has protected Europe from more concerted Russian aggression. NATO cooperation in patrolling the Baltic Sea appears to have discouraged underwater cable-cutting. Intelligence sharing is crucial, alerting countries to looming dangers they don’t see, and aligned public condemnation—all or most of the continent speaking with one voice—sends a signal to the Kremlin that its efforts to divide Europe aren’t working.
But the Leipzig attack may finally be pushing Europe to go further, opening the door ever so slightly to thinking the unthinkable—how to take the fight to Russia.
German media reports suggest Berlin is moving toward a more muscular approach. Among proposed changes, an expanded Federal Police anti-drone force will be authorized to protect airports, railway stations, and government offices by shooting down enemy drones. So, too, the private companies that operate most critical infrastructure in Germany—they will now be legally authorized to counter incoming unmanned systems. Other reports in the international press point to similar quiet reassessments at think tanks across the continent.
But arguably the most far-reaching recommendation comes from Ukraine—and it’s more about political will than any particular tactics, lethal or nonlethal. “Acts of sabotage, disinformation, interference in electoral processes, espionage, attacks on critical infrastructure and industrial facilities . . . These are not isolated incidents,” Ukrainian Foreign Minister Andrii Sybiha wrote recently on social media. They are part of a “deliberate” Russian strategy that “must not go unpunished.”
The first and all-important step for Europe, according to Sybiha: a new mindset. “The reality is that Russia considers itself at war with Europe,” he warned, “even if Europe does not consider itself at war with Russia.”
Davlikanova of the Sahaidachnyi Center spells out the thinking behind his argument. “Hybrid attacks aren’t just about scaring countries that are helping Ukraine,” she explains. “Europeans tell themselves that the war in Ukraine is a fight between two distant countries with historical differences. What they don’t see is that Putin is gunning for them, too. He is determined to recreate the Cold War Soviet sphere of influence, reclaiming half of Europe—including a third of Berlin.”
Recognizing that the continent is at war—not hybrid or gray-zone but actual, existential war—would have profound repercussions for Europe. Countries at war feel a sense of urgency. They’re much less hesitant about imposing costs on the enemy. They look for ways not just to protect but to punish and retaliate. This needn’t mean abandoning Western principles or the rule of law. Any allied response must be proportionate and legal, and the more capitals that come together to advance it, the better—if not NATO or the EU, then a coalition of the willing.
Most experts agree the process starts with reconsidering the rules—treaties, laws, and administrative regulations—that currently tie Europe’s hands.
Should NATO pilots on air policing missions have more leeway to engage the enemy? What about ground-based air defense crews? Surely, there’s room for more information warfare—not disinformation of the kind Moscow spreads but conveying the truth about world events to the Russian public. Many argue that the law should allow for confiscation of Russian assets, whether by nation-states or in Brussels. Finally, perhaps the most dramatic step being talked about, what about offensive cyberattacks against enemy military installations?
But legal change is only a first step. What’s stopping Europe isn’t just restrictive law. Much of the public, particularly in southern Europe, still doesn’t grasp the nature of the Russian threat—doesn’t see how far Putin’s ambitions reach or what he’s willing to do to achieve them.
How many hybrid incidents will it take to wake European voters? The Sahaidachnyi tracker counts 420 attributed attacks—from fighter-jet flyovers to assassination attempts—since February 2022. In the meantime, as Leipzig shows, if Europe can’t find a way to make the Kremlin pay a price, the assaults will only grow bolder.
