France attributes the attack against hundreds of supermarkets to Iran; China develops influence and coercion operations, and the border pressure in southern Europe by Morocco also falls under that array of hybrid threats, which constitute the challenge of autocratic regimes against democratic and free societies.
The latest bomb threats, all false, against commercial planes triggered alarms and initiated emergency protocols, flight diversions, and passenger evacuations while security teams inspected the airplanes. This wave of false threats disrupted European air traffic. Although no explosives were found, each message activated a security device, mobilized resources, and sowed uncertainty among thousands of travelers. The operation managed to produce real effects without placing a single bomb. The same has happened this week with threats in more than 6,000 Italian schools.
These false threats are not the only alarm signal in European skies. Interferences in satellite navigation systems, false GPS signals, and drone incursions have forced a review of procedures and increased surveillance. On land, there are fires, sabotage, cyberattacks, and disinformation operations. At sea, the target is the underwater cables. And, increasingly, people recruited via the internet appear to carry out tasks that can range from placing stickers or gathering information to starting a fire or participating in a cyberattack.
Not all these episodes have the same origin nor can they be automatically attributed to the same actor. But they share a common scenario: a Europe under increasing pressure in that gray area between peace and war. Sometimes the objective is to destroy; other times, it is enough to interrupt a service, force the deployment of resources, test a response, or convince the population that nothing is safe and that their governments are ineffective.
From the sabotage attributed to Russia in Central and Eastern Europe and the recruitment of collaborators, the map of this shadow war is broader than a confrontation between Moscow and the West. It also includes influence campaigns linked to China and forms of geopolitical and border pressure exercised by other states, such as Morocco in Ceuta. In addition to causing fear and chaos among passengers, the threats allow for observing how airports react, how long it takes to activate protocols, and what resources the authorities mobilize. They are an attempt at hybrid aggression and psychological warfare.
However, a bomb threat is not the same as interference in navigation systems or a drone incursion. They are distinct phenomena, with different mechanisms and risk levels. That they occur in the same context of tension does not prove that they respond to a single operation nor that they necessarily have the same perpetrator. Since the Russian invasion of Ukraine in February 2022, the European Union Aviation Safety Agency (EASA) has detected a significant increase in interferences in navigation systems. The episodes are especially concentrated in areas close to conflicts and strategic zones: the Baltic, the Black Sea, the Mediterranean, the Middle East, and the Arctic. Their consequences can include positioning errors, alterations in navigation systems, and abnormal alerts, which require crews and controllers to apply alternative procedures.
In this area, there is indeed a formal international attribution. In October 2025, the Assembly of the International Civil Aviation Organization condemned Russia for harmful interferences in systems that affect air operations in Europe, based on evidence presented by Estonia, Finland, Latvia, Lithuania, Poland, and Sweden. This condemnation, however, does not allow attributing to Russia any GPS incident that occurs in Europe. Caution in attribution is essential: in hybrid warfare, confusion can be part of the objective.
The interferences are compounded by recurrent drone incursions. Their unauthorized flights or sightings near airports, military facilities, and critical infrastructure can force temporary closure of airspace, interrupt operations, and test surveillance systems. A commercial drone can be cheap and relatively easy to acquire, but its use for observing, provoking an alarm, or interfering with strategic activity can result in disproportionate consequences.
The shadow war also unfolds underwater. Undersea telecommunications and energy cables are essential for the functioning of European economies. They carry communications, data, and electricity between countries. Their strategic importance contrasts with their physical vulnerability. There have been incidents in the Baltic Sea where vessels have damaged cables and other underwater infrastructures. In some cases, anchor drags and shipping routes have raised suspicions.
Concern extends to the protection of energy infrastructure, ports, communication networks, and the systems that allow the everyday functioning of countries. The problem is that these infrastructures are extensive, difficult to monitor, and, in many cases, privately owned. Their protection requires cooperation between governments, businesses, armed forces, and security agencies. It also requires the ability to detect anomalies and share information quickly.
Hybrid threats are not new. They combine known instruments -espionage, sabotage, propaganda, economic pressure, or the instrumentalization of social conflicts- with technologies and forms of action that multiply their reach.
The novelty lies in the combination, speed, and difficulty in identifying those behind them. Hybrid warfare develops in the context of armed conflict, while hybrid threats can also operate in peacetime, in that gray area where there is no declaration of war, but there is sustained confrontation. Disinformation, cyberattacks, economic pressure, sabotage, or clandestine actions can be part of that strategy.
The purpose does not have to be physical destruction. It may consist in weakening trust in governments, fueling polarization, creating doubts about institutions, or provoking a sense of permanent vulnerability. The action can be small, but its repercussions, amplified by social media and the press, can reach millions of people. It is not about destroying the enemy, but dividing it. The battle is also fought in perceptions: what we believe, whom we trust, and to what extent we think our institutions can protect us.
The Russian invasion of Ukraine intensified this scenario. The expulsion of dozens of Russian diplomats from Western countries, many of whom were suspected of engaging in intelligence activities, reduced part of Moscow's traditional operational presence in Europe. At the same time, reliance on intermediaries, criminals, sympathizers, and individuals recruited online, the so-called disposable agents, increased. It is not always necessary to send a professional agent to carry out an operation. Sometimes it is enough to find someone willing to perform a task in exchange for money, ideological affinity, or a mix of both.
They act on behalf of another actor and allow for concealing who is behind it. This is not a practice exclusive to Russia, but European investigations have documented their use in operations attributed to Russian services. Recruits can be criminals, economically vulnerable individuals, political sympathizers, or individuals seeking an opportunity to earn money. The distance between the one commissioning the work and the one executing it complicates attribution and allows those responsible to deny any relationship.
In September 2026, the EBU Investigative Journalism Network put faces and names to a Latin plot of Russian sabotage by disposable agents. The investigation reconstructed a recruitment and sabotage network that operated in Lithuania, Poland, the Czech Republic, and Romania. It was made up of young people, many of whom were Latin Americans, who had been lured through social media, job search platforms, and volunteer forums. They ended up receiving assignments for surveillance, reconnaissance, or sabotage.
The investigation identified Oemis Romagoza Durruthy, of Cuban origin and a Russian citizen, as a central figure in the network. Also identified was the Cuban-Russian Alexeis Pecora. Both live in Russia. According to the Lithuanian Prosecutor's Office, the plot was connected to Russian military intelligence, the GRU. The case shows a transformation in sabotage methods: operations that previously would have required trained personnel can now be assigned to inexperienced individuals recruited remotely and paid for a specific task. They are disposable agents because those who use them do not need to protect a professional structure or expose their own operatives.
NoName057(16) is one of the most well-known pro-Russian hacktivist groups in Europe. Their specialty is distributed denial-of-service (DDoS) attacks, which flood websites and servers until they can no longer function normally. Their targets have included public administrations, companies, and agencies from countries supporting Ukraine or part of NATO. In July 2025, an international operation coordinated by Europol and Eurojust and led by Spain struck the group's infrastructure. Operation Eastwood successfully disconnected over a hundred servers, conducted raids, and issued international arrest warrants. It was a significant blow, but it did not lead to their disappearance. The group poses a threat not only due to cyberattacks but also because of the impact they have on companies, clients, and citizens. Participants may believe they are engaging in a militant action, without necessarily knowing who sets the objectives or how the results are used. In cyberspace, borders and distances cease to be an obstacle.
In their Telegram channels, threats are often presented as conquests. Screenshots, plans, photographs of facilities, and supposed proofs of access to networks of public agencies, energy companies, or water supply systems are published. The administrators celebrate these materials as trophies and announce new targets: treatment plants, depots, power grids, or municipal services. The image they project is one of almost unlimited capacity to penetrate the heart of European infrastructures. However, a screenshot does not demonstrate that control has been taken over a facility. A plan may come from open sources; a photograph does not prove an intrusion; and access to a webpage does not equate to controlling the industrial systems regulating a dam, a water plant, or an electricity network.
The damage may be limited and temporary, although the campaign is presented on Telegram as a great victory. That does not mean the risk is fictitious. In April 2025, an intrusion into the control system of a dam in Norway allowed a valve to be opened and kept operational for hours, according to published information about the incident. In the United States, authorities have also warned of unauthorized accesses to water and wastewater systems. These episodes show that a digital vulnerability can reach the physical world, although not all groups announcing attacks have that capability.
Neither does ideological affinity with Russia alone demonstrate that the Kremlin directs each action. Propaganda also serves its own function. Displaying plans or announcing that a facility may be sabotaged amplifies the sense of vulnerability, forces systems to be reviewed, and pressures authorities, even when no physical alteration has occurred. The propaganda success can outweigh the technical damage. The critical question is to detect when this exhibition ceases to be a staged event and becomes an intrusion capable of modifying real processes.
Numerous sabotage operations, fires, recruitment, and cyberattacks have been linked to networks acting on behalf of Russia. However, it would be a mistake to turn that observation into a singular explanation. The gray area is a space of competition between states with different capabilities, interests, and methods. Not everyone resorts to physical sabotage; not everyone seeks the same effect; and not all operations have the same degree of attribution. France provided one of the most compelling examples of this diversification in November 2026.
On the night of October 11-12, the cooling control systems of around 700 French retail establishments were compromised. The attackers modified the defrosting parameters and raised the temperatures of the equipment. Large quantities of food were lost. On November 9, the French government officially attributed the operation to the Shahid Kaveh cyber unit, linked to the electronic and cyber center of the Islamic Revolutionary Guard Corps of Iran. Their attribution was based on technical evidence, infrastructure used, tools, linguistic traces in Persian, and the subsequent amplification of the operation by a propaganda body related to the unit.
The attack had a feature that differentiates it from many hacktivist campaigns: it did not just leave websites offline or publish a claim on social media. The intrusion reached connected industrial controllers and produced material consequences in civilian installations. The objective was not only to interrupt a communication but to alter the cold chain on which food preservation depends. The episode shows how a cyber operation can turn into physical sabotage without the authors having to enter the establishments. Concern grew when, on the night of November 1-2, a new wave affected over a hundred supermarkets and food stores in at least nine European countries: Belgium, Luxembourg, the Netherlands, Ireland, Sweden, Finland, Italy, Portugal, and Estonia.
In parallel, the monitoring and control systems of refrigeration units at three regional centers of the French Blood Establishment were attacked. Staff received alerts and moved the reserves to refrigerators not connected to the compromised systems. The Ministry of Health confirmed there was no impact on the blood supply. Attacks on supermarkets and blood banks signal a vulnerability that directly affects everyday life. The hybrid threat then ceases to be a geopolitical abstraction: it manifests in a cold storage facility, in a food warehouse, or in a center that preserves blood reserves.
China represents a different profile. European reports on manipulation and informational interference describe campaigns aimed at promoting narratives favorable to Beijing, amplifying messages through intermediaries, pressuring critical voices, and exercising transnational intimidation. These are operations of influence and coercion that seek to condition public debate, protect strategic interests, and reduce the space for criticism of the Chinese government. They should not be confused with physical sabotage attributed to Russia or the destructive operation that France has attributed to Iran.
On the southern flank, the relationship with Morocco shows another form of pressure. The management of borders and migration movements can become a tool of political coercion when deliberately used to shift costs and generate a crisis in the neighboring country. The experience of Ceuta in May 2021, the recurrent tensions surrounding Melilla, and the dispute over Western Sahara are part of a complex bilateral context, where police cooperation, trade, security, and territorial disagreements intertwine. The massive entry of around 100,000 Moroccans into Ceuta on July 30 poses a hybrid threat in the form of instrumented irregular migration. Hybrid strategies can use practically any instrument as a weapon, including proxies, criminal organizations, terrorist groups, or security companies. In the case of Morocco, the analysis refers to mechanisms distinct from those attributed to Russia: diplomatic pressure, economic coercion, and the use of migration flows to influence Spanish decisions, including their position on Western Sahara, and to generate difficulties in Ceuta and Melilla.
The concept of hybrid threat should not become a catch-all label. A Chinese influence campaign, an Iranian cyber sabotage, a Russian recruitment network, and a border crisis with Morocco are not interchangeable. They require tailored responses for each case. The European map is not of a single secret war directed from one capital, but of competition among actors exploiting different vulnerabilities. The hybrid threat poses a challenge because it crosses all traditional security lines. Armed forces prepare to respond to military aggression, police investigate crimes, intelligence services seek to anticipate operations, and civilian authorities protect infrastructures and manage emergencies. Yet, a single campaign can start with a fake email, continue with a cyber attack, rely on a network of intermediaries, and end in a fire or border crisis.
The case of disposable agents shows that recruitment can begin with an offer on Telegram. The attacks on French supermarkets show that a cyber intrusion can disrupt industrial equipment and cause physical damage. The hacktivists showcasing plans of water plants remind us that propaganda can anticipate or accompany attempts at real access. And tensions at the borders reveal that pressure does not always take the form of a digital attack or sabotage. Hybrid warfare does not need a declaration to establish itself. It feeds on the vulnerabilities of open societies. Its battlefield is trust: in airplanes, in food, in water, in institutions, and in the ability of democracies to protect their citizens.
An article written by Pilar Requena (RTVE), initially published on 12 November 2026, 07:00 (CET)