The Kyiv-based Sahaidachnyi Security Center has catalogued 522 incidents across Europe since 24 February 2022 that officials link to or say fit the pattern of Russian hybrid operations. Lithuania publicly backed Estonia after a 15 August fire at Milrem Robotics in Tallinn that Estonian authorities describe as sabotage — a claim denied by Moscow. Analysts say these activities have evolved from isolated cyber and intelligence actions into a multidomain campaign combining drones, electronic warfare, GNSS interference, maritime operations and sabotage. Experts call for systematic investigation, transparent public reporting and coordinated NATO/EU responses.
Map Reveals 522 Suspected Russian Hybrid Attacks Across Europe Since 2022
This map from the Sahaidachnyi Security Center shows military provocations, sabotage acts and cyberattacks in Europe linked to Russia since the start of the full-scale invasion of Ukraine.
Since Russia's full-scale invasion of Ukraine, the Kyiv-based Sahaidachnyi Security Center has mapped 522 incidents across Europe that either have been attributed to Moscow by officials or match patterns consistent with Russian hybrid tactics. Recorded cases range from airspace violations, GNSS jamming and cyberattacks to sabotage and drone strikes.
Key Incidents And Allegations
On 15 August a fire damaged a building in Tallinn owned by defence firm Milrem Robotics; Estonia's Internal Security Service has described the blaze as sabotage ordered by Russian intelligence, an accusation Moscow denies. Other recent episodes include a drone crash in Hîrbovăț, Moldova, a Geran-5 drone strike near Yahodyn on the Ukrainian–Polish border, and a foiled drone attempt at Leipzig/Halle airport in Germany.
What The Map Shows
The Sahaidachnyi dataset documents incidents across countries including the United Kingdom, Italy, Germany and Poland, drawing on verified open-source intelligence. It records airspace incursions by aircraft, missiles and drones; GNSS interference and spoofing; electronic-warfare activity; cyber operations; maritime incidents; and sabotage of critical and military infrastructure.
Investigators examine the aftermath of a Russian drone strike on an apartment building in Galati, Romania, on May 29, 2026.
Elena Davlikanova, a senior fellow at Sahaidachnyi, told Newsweek that the purpose of these operations is 'to coerce allies into reducing support for Ukraine and undermine public support by imposing social and economic costs on European societies.' Kremlin spokesman Dmitry Peskov has previously dismissed Western allegations of hybrid operations as 'scare stories.' Newsweek requested comment from the Kremlin on the latest claims.
Sahaidachnyi analysts identify two clear surges of sub-threshold activity—in spring 2024 and autumn 2025—with elevated activity continuing into 2026. They say that after early battlefield setbacks Russia ramped up drone production, electronic-warfare and cyber capabilities, expanded infrastructure used to evade sanctions, and refined the use of inexpensive autonomous and remotely controlled systems.
Why It Matters
Analysts warn that the campaign's political goal may be to pressure European publics to seek de-escalation and accommodation with Moscow rather than to cause isolated destruction. Western experts and NATO officials urge methodical investigation, coordinated public reporting and stronger collective messaging from NATO and the EU to document incidents and explain Russian tactics to citizens.
Contact: Newsweek editors Matthew Robinson and Sam Wilson.
Help us improve.
