When a drone carrying explosives was found near Ukrainian Antonov cargo planes at Leipzig/Halle Airport in August, it marked a turning point for Berlin. For the first time, the German government explicitly blamed Russia for an attempted attack on its soil. Chancellor Friedrich Merz and several ministers have since made clear that while Germany is not at war with Moscow, it is facing a sustained campaign of hybrid aggression.
These attacks are designed to stay below the threshold of armed conflict, making them difficult to detect and even harder to counter. They include drone overflights, sabotage of critical infrastructure, espionage and disinformation campaigns. Merz described Moscow's willingness to act with "growing ruthlessness," accepting serious damage to property and even casualties.
In response, Interior Minister Alexander Dobrindt has raised Germany's threat level from "abstract" to "high." The federal government has also announced concrete measures: closing the Russian consulate general in Bonn and the Russian House in Berlin, pushing for EU-level sanctions on individuals linked to hybrid attacks, tightening entry controls, and stepping up pressure on Russia's shadow fleet.
What counts as a hybrid campaign?
Not every cyberattack or act of sabotage is automatically part of a hybrid campaign, says security expert Ferdinand Gehringer. The key is the identifiable link between different measures: a common actor, coordinated timing, recurring targets or methods, and above all a shared strategic objective.
In the Leipzig case, investigators found a pattern that pointed to Russian intelligence. Dobrindt said they suspect so-called "low-level agents" may have been involved on behalf of a Russian intelligence service. The technology used, the crime pattern and intelligence findings all led the federal government to conclude that Moscow was behind the attack.
Gehringer argues that such assessments require pooling information from police, intelligence services, the Bundeswehr, cyber defence and the private sector. "Only by examining technical traces, crime patterns, timelines and disinformation narratives together can links be identified," he said.
Defending below the threshold of war
Hybrid warfare aims to exploit a country's vulnerabilities, erode trust in state institutions and destabilise society. Rearming the Bundeswehr alone is no answer. Kinetic responses are rarely appropriate for attacks that remain below the threshold of an armed assault.
Since 2022, the federal government has stepped up its precautions. An interdepartmental task force now deals with disinformation and other hybrid threats. Procedures have been established to attribute cyberattacks and foreign information manipulation to potential originators.
At the EU level, the so-called "Hybrid Toolbox" provides a mechanism for joint responses. Since this year, the Joint Centre for Countering Hybrid Threats (GAZ Hybrid) has been operational, bringing together information on espionage, sabotage and disinformation to enable early detection and more effective action.
Berlin's response to the Leipzig incident was described as "resolute, calm and proportionate." But Gehringer insists that defence must begin long before an attack occurs. "We need to move away from merely reacting and towards a more anticipatory approach," he said. "The goal must be to raise the costs for attackers, disrupt their planning paths, uncover networks as early as possible and blunt the impact of attacks."
This includes building societal resilience. If an attack on a substation caused a power cut, households and businesses could bridge the gap with emergency power until the grid operator repairs the damage. In the best case, preparation would eventually be so good that hybrid attacks could be absorbed without significant disruption.
Germany is not alone in facing these threats. According to the Federal Office of Civil Protection and Disaster Assistance (BBK), China, Iran and North Korea also target Germany with hybrid measures. The challenge is shared across Europe, and the response must be coordinated.
As Berlin continues to strengthen its defences, the debate over how to respond to attacks that stop short of war is far from settled. The line between peace and conflict has become increasingly blurred, and Germany is learning to navigate it.
