Yesterday 14:47

Hybrid attacks on European logistics are the more likely scenario for Russian escalation, a report argues

2eu.brussels

5 October 2026, 14:47

Foto: Pexels

Always see our news on Google

Sabotage, drones, GPS interference, and attacks on ports, airports, railways, and factories supporting Ukraine could become more likely tools of pressure against Europe than a direct conventional military attack on NATO, according to an SCEEUS–EPIK analysis. The authors propose coordinated protection of logistics routes and joint EU–Ukraine production of lower-cost interceptors and electronic systems.

Europe should prepare above all for an intensification of Russian hybrid actions against infrastructure supporting Ukraine, not only for scenarios involving a direct military conflict with NATO, according to an analysis published by the Stockholm Centre for Eastern European Studies and the European Policy Institute in Kyiv. Andreas Umland and Lesia Bidochko argue that sabotage, drones, GPS interference, and attacks on logistics infrastructure give Moscow the possibility of increasing pressure on European support without immediately crossing the threshold into a conventional war with the Alliance.

In brief

The authors consider an intensification of attacks on Ukraine and hybrid operations in Europe more likely than a large-scale conventional attack against NATO or nuclear escalation.

Infrastructure used to support Ukraine, including airports, ports, railways, and factories, is identified as a possible target for pressure below the threshold of war.

The report recommends joint EU–Ukraine production of low-cost interceptors, sensors, and electronic warfare systems to counter mass drone and missile attacks.

The authors propose a “Leipzig Protocol” to protect logistics hubs, with clear rules for threat detection, neutralization, rerouting cargo, and the rapid resumption of operations.

These are scenarios and recommendations put forward by the authors. The report is not an official assessment by the EU or NATO and does not mean that the actions described are inevitable.

The analysis starts from the changing nature of the Russian-Ukrainian war as Ukraine has developed the capability to strike targets increasingly deep inside Russian territory. Attacks on refineries, logistics infrastructure, military facilities, and other targets behind the front are putting pressure on Russia’s ability to sustain the war and making the conflict’s effects more visible to the Russian economy and population.

Umland and Bidochko argue that Moscow has several ways to respond to this pressure. Escalation could continue through more intense attacks on Ukrainian cities and infrastructure, an increase in the volume of drones and missiles, or actions against states supporting Ukraine. The authors seek to compare these options according to the costs and risks they would create for Russia, without claiming that they can predict Kremlin decisions with certainty.

A large-scale conventional military attack on a NATO state is considered less likely by the authors under current conditions. Their argument is that such a decision could force Russia to wage the war against Ukraine and a direct conflict with the Alliance simultaneously, massively increasing military costs and strategic risks. This assessment is an analytical evaluation, not an official forecast by intelligence services or NATO.

Nuclear escalation is also examined as a possibility, but the authors believe it would entail extremely high diplomatic costs for Moscow. In their assessment, the use of a nuclear weapon could damage Russia’s relations even with countries that have so far maintained economic and political ties with Moscow, such as China and India. The report does not exclude the scenario, but ranks it below conventional and hybrid forms of escalation in terms of likelihood.

In this interpretation, the most accessible area of pressure would be the space between political competition and declared war. Sabotage, cyberattacks, disruption of GPS signals, unidentified drones, or operations against infrastructure can produce concrete effects without the overt deployment of Russian armed forces against a NATO member state.

The EU has already accused Russia and actors associated with it of conducting a persistent hybrid campaign against member states and European partners. The SCEEUS–EPIK report, however, shifts the focus toward a specific category of vulnerability: the infrastructure through which Europe maintains the flow of weapons, equipment, components, and other forms of support to Ukraine.

Cargo airports, ports, rail terminals, warehouses, and defense-industry factories have strategic value because their operation ensures the continuity of European support. An attack does not need to completely destroy such a facility to produce effects. A temporary disruption of activity, security checks, the closure of an airport, or the need to move shipments to other routes can delay deliveries and increase logistics costs.

The report uses the incident at Leipzig/Halle Airport as an example of this vulnerability. German authorities attributed to Russia a hybrid attack in which a drone loaded with explosives was found near a Ukrainian cargo aircraft. The airport has both a major civilian role in freight transport and a role in the strategic transport infrastructure used by NATO.

For the authors, the importance of the incident lies not only in the damage the drone could have caused, but also in the operational problem such an action raises. An incident serious enough can temporarily block an essential logistics hub without reaching the scale of a conventional military attack that would automatically trigger a much stronger collective response.

Based on this, Umland and Bidochko propose what they call a “Leipzig Protocol.” It is neither an existing EU mechanism nor a plan adopted by NATO. It is a proposal under which airports, ports, and rail hubs important for supporting Ukraine would receive common procedures for responding to hybrid threats.

The protocol should establish who identifies a threat, who may authorize intervention, which authority has the legal right to neutralize a drone, and how shipments are moved if infrastructure is temporarily unavailable. The authors also propose identifying in advance alternative routes, backup logistics capacities, and mobile teams capable of intervening to provide drone protection or carry out repairs.

The main objective would not be to guarantee that no incident can occur, but to maintain the flow to Ukraine after an attack takes place. In this logic, the system’s success would be measured by the time needed to resume transport and the ability to quickly move cargo to other airports, ports, or railways.

The authors propose using existing European instruments rather than building an entirely new structure. European plans on drone security and the Directive on the resilience of critical entities could be used to apply such measures to infrastructure that plays a direct role in supporting Ukraine.

The second vulnerability identified is defense against mass attacks. The report considers that Russia will try to combine sophisticated and expensive weapons with cheaper systems that can be produced in larger volumes. The problem for defenses arises when neutralizing a cheap drone or missile requires the repeated use of much more expensive interceptors available in limited quantities.

Umland and Bidochko therefore recommend developing a multilayered defense architecture. High-performance air-defense systems would remain necessary against ballistic missiles and complex threats, but they should be complemented by cheaper interceptors, sensors, electronic warfare, and other solutions designed to absorb a high volume of targets.

The authors view industrial cooperation between the EU and Ukraine as one possible solution. Ukrainian operational experience and European industry could be combined for the joint production of interceptors, detection systems, electronic warfare equipment, and repair and maintenance capabilities. European programs such as the European Defence Industry Programme and the SAFE instrument are identified as possible sources for joint procurement and production.

These low-cost systems are not presented as replacements for high-end missile defense. Their role would be to reduce pressure on stocks of expensive interceptors and protect not only cities, but also airfields, command centers, logistics infrastructure, and other critical facilities.

Another recommendation concerns Western components found in Russian weapons. When Ukraine recovers parts from a drone or missile, the authors propose a permanent and rapid mechanism for transmitting the information to the European Commission, so that suppliers, intermediaries, transport companies, and financial services involved in evading restrictions can be identified more quickly.

On this basis, the Commission could propose export controls or targeted sanctions without waiting for the next broad sanctions package. The objective would be for the European regime to adapt more quickly to changes in the supply chains used by Russia’s military industry.

The report also discusses the development of Russian long-range cruise missiles with potentially lower costs, which the authors consider a significant threat if they can be produced in large numbers. Some estimates in the document concerning future production levels are based on information that has not been independently confirmed, meaning they cannot be turned into certain forecasts about the number of weapons Russia will have available.

This uncertainty does not change the core problem identified in the analysis. If the volume of attacks increases faster than stocks of advanced interceptors, defenses must find cheaper methods for simpler targets and reserve the most advanced systems for threats that cannot be neutralized otherwise.

The report does not conclude that Russia will inevitably initiate a new phase of escalation against Europe, nor does it establish a timetable for such actions. It constructs a hierarchy of scenarios based on the incentives and costs the authors attribute to Moscow and recommends measures through which European states can reduce the benefit Russia would gain from disrupting support for Ukraine.

The principle linking the recommendations is resilience. For the authors, deterrence depends not only on the threat of a response after an attack, but also on reducing the outcome the attacker can achieve. If airports can rapidly redirect shipments, if cheap drones can be neutralized without exhausting advanced ammunition, and if supply chains for Russian weapons are disrupted more quickly, hybrid pressure becomes less effective.

The report is signed by Andreas Umland and Lesia Bidochko and represents the authors’ analysis. The scenarios concerning Russia’s future behavior and recommendations such as the “Leipzig Protocol” are not positions adopted by the EU, NATO, or the governments of member states.