False bomb alerts, cyber attacks on supermarket refrigeration systems, sabotage attempts: in recent weeks there has been constant talk in Europe of “hybrid warfare”.
To get a more complete picture of the situation, without causing alarmism, we interviewed Alessandro Marrone, Head of the “Defense, Security and Space” program of the Institute for International Affairs (IAI), who explained to Geopop what a hybrid war really is, when sabotage attempts against Europe have increased and why every single attack must be traced back to a broader campaign.
Let’s start immediately with a definition, since everyone has been talking about it lately: what exactly is a hybrid war and why is it often so difficult to recognize it?
Hybrid warfare is the key to interpretation that European and transatlantic thought has developed over the last ten years to understand what Russia, China and Iran are doing towards some subjects. In particular, what Russia is doing towards Europe; however, the concept does not only apply to Russia, but also to other actors.
Hybrid warfare is therefore a mode of conflict that Not recurs in a way explicit nor open to the use of the armed forces in a more or less large-scale, more or less high-intensity war, like the one in Ukraine.
The use of force it is not excluded a prioria possible escalation being possible, but first there is a systematic and coordinated use of a variety of means and actions of various nature, which can be, for example, infrastructure sabotageeven physical sabotage, such as civilian ships severing gas pipelines, oil pipelines or submarine internet cables in the Baltic Sea with their anchors, cases which have already occurred.
Hybrid warfare also includes drone overflights that do not damage airports, but the simple fact of flying over the airspace of an airport triggers safety procedures, resulting in tens of thousands of passengers being left stranded.
Other modalities are cyber attacks, which can have a range of objectives. They can target intelligence, data theft, but also disrupt the operation of critical infrastructure leading to malfunctions or blockages. This can apply to the energy network, to the transport network, to food supply chains, such as the cyber attacks in recent weeks on supermarket refrigeration systems.
The impact is significant: around 35 bomb alerts in three days in Europe led to dozens of flights diverted or interrupted, with the consequent activation of security procedures and checks which entailed a cost for operators, but above all for the perception of insecurity. Then we are talking about a very small percentage compared to the quantity of daily flights, but the episodes still affected public opinion.
Then there are also the acts a straddling the line between espionage and intimidation. In general, hybrid warfare is a very diverse portfolio of actions that have some characteristics in common:
- The first is that there is no official use of the military of a hostile country. So there is not that explicit and open use of military force that we have seen in Ukraine over the last four years.
- The second element is that it is It is difficult to attribute the paternity of the attacksit is difficult to trace who made them. Because there are no operators on board the drones to interrogate or prosecute, and in the case of cyber attacks it is very complex to trace who is responsible. And this allows the attacker to plausibly deny their involvement. In some cases it is possible to gather enough evidence or clues to make such an accusation. In other cases no, or the analyzes are still ongoing, so it takes time.
In recent weeks, news of sabotage attempts against Europe has multiplied: from false bomb alerts to cyber attacks on refrigeration systems. Is there a reason why these sabotages are happening right now?
Certainly in recent weeks there have been new types of attacks (cyber and bomb scares), which have involved various European countries, from Italy to France and Belgium. But this It’s not an entirely new phenomenonbecause during 2025 there were sequential drone intrusions in Polish airspaceBaltic and Romanian.
So we have already witnessed to concentrated periods over time, in which certain hybrid warfare actions have increased – there have been dozens and dozens of them over the previous years. At the same time, cyber attacks have been increasing exponentially for several years, but they are nothing new.
It is though difficult to tie individual attacks to international circumstances, such as the peace negotiations now underway in the Gulf countries. The question must be seen as one systematic campaignprolonged over the years, which concerns multiple critical infrastructures (air traffic, submarine cables, etc.) and which involves public opinion at multiple levels, because there is also work on social media, done by fake accounts, by fake news, by a certain manipulation or interference in public debate, which are themselves an instrument of hybrid warfare.
AND the effect that matters it’s not that of single attack, but that’s it cumulative on public perceptionthe effect of insecurity, of disorientation, of distrust in institutions, in critical infrastructures.
There are several studies on the fact that this hybrid warfare campaign yes it is intensified throughout Europe from 2022 onwards, coinciding with the Russian invasion of Ukraine. During this period Russia saw that European governments, even of different political colors over the 4 years, continued to support Ukraine in a way that Russia did not expect and which contributed to Ukrainian resistance.
This does not mean every attack is automatically attributable to Russia: we need to see case by case whether there is evidence, whether there are enough clues, whether it was a group not linked to any state.
So unfortunately it is a very complicated situation, so much so that it is called a “grey area”, in the sense that they are attacks below the threshold of open military conflictwhere it’s not immediately clear who is attacking you.
Several European leaders are already saying this. We are not in wartime, we are not even in peacetime. We are not in a state of war, but we are no longer in a state of peace as we knew it years ago.
You don’t have to look a lot at temporal circumstance, to the occasion in which a single attack occurs, but to the fact that the single attack is part of a larger campaign. Otherwise you risk noticing the tree and not the forest.
Trying to clarify the issue without generating alarmism: how serious is the situation for Europe?
In the European framework, critical infrastructures have a certain resilience and over the years they have been approved regulations that they have raised The standard of this resilience.
For example, the risk analysis procedures and preparing plans to manage emergencies, building material capabilities to overcome a possible interruption of services, and restoring operational continuity in the shortest possible time.
There is a more than ten-year journey on resilience, that is ability of a system to absorb a shock (which can be the one induced by a hybrid attack, but also by a natural disaster) and to restore its functioning in the shortest possible time, with the least possible social and economic damage.
We must not think that we are in year zero, there is a regulatory frameworkthere are institutions that work, and then there is the military apparatus of NATO which is what has so far dissuaded Russia from attacking a member state of the Alliance.
At the same time we must be aware that there is no zero risk situation: the risk exists, it must be managed, or rather it must be communicated and managed. Communicating the risk also serves to lead citizens to adopt preparedness measures.
The media often exaggerates the fact that the European Union or other governments, such as the British one, are telling citizens to take preparedness measures, suggesting that they prepare cash, water and food items for at least 72 hours.
But it’s not that the European Union or governments are presenting these plans today because it means something is going to happen tomorrow. These plans are the product of months and years of work in regulatory adjustments, identification of vulnerabilities, investments in cyber security capabilities and other types of security. In short, there is constant work by the institutions which then involves communications to the public, also because there are updates to national and regional plans, or new measures to manage new technologies.
I repeat, the discussion on the resilience of critical infrastructure in Europe has been going on for at least a decade and since 2022 it has accelerated, both in intensity and speed, because Europe is becoming better equipped to defend itself from a hybrid campaign that has also accelerated and intensified.
So, even in this case, when you point to the Moon you shouldn’t look at your finger: when there is a communication from a government or a European institution on preparation measures, you shouldn’t focus on what can happen tomorrow, but on the fact that the plan gives a perspective of months and years in which we need to be more resilient and more prepared, so as to have a normal functioning of societies despite this hybrid campaign, which will continue for years anyway.
Then, without diminishing the importance of hybrid warfare, greater resilience of critical infrastructures and the social fabric also serves to respond to some effects of climate change, which lead for example to increasingly frequent and more intense extreme meteorological events which can therefore themselves have disruptive and unexpected effects on infrastructures.
They are phenomena of different origins, and we should not put them in the same category, but increasing the resilience of critical infrastructures and society protects the citizen and the community simultaneously when faced with multiple risks of different nature.
