Europe increasingly faces destabilization that falls outside conventional military conflict and traditional public security risks. Incidents in autumn 2026 point to the emergence of a new class of threats. Their targets are no longer limited to specific infrastructure facilities or information resources. Instead, they aim to undermine the overall resilience of state systems. These operations aim to create prolonged pressure by exploiting vulnerabilities in civilian infrastructure and divisions within society. This allows external actors to pursue political and destabilizing goals without crossing the threshold into open military confrontation.
The logic of asymmetric attacks on civilian infrastructure
Kinetic and digital incidents targeting public utilities and commercial facilities across Europe reveal a shift in the nature of sabotage. Traditional approaches to critical infrastructure protection focused on secure government networks and highly classified facilities. New methods, however, exploit widespread digitalization and the growing connectivity between everyday and industrial devices (IoT).
Remote interference with the control systems of ordinary commercial equipment can disrupt the operations of hundreds of retail outlets, damage production lines, or create risks for the storage of medical supplies. This became clear during the large-scale attacks on refrigeration systems in European supermarkets and blood service facilities in October and November 2026. As a result, the economy and everyday life become part of a vulnerable rear area. The main advantage of such operations for the attacker is their extremely low cost compared to the damage they can cause. The resources needed to carry out digital interference are minimal compared to the losses suffered by private companies and public services as they deal with the consequences.
At the same time, vulnerabilities in remote control systems are widespread and systemic. Control over engineering infrastructure is often divided among numerous private contractors whose security standards fall below those used in corporate IT systems. This creates a permanent range of opportunities for remote interference, without requiring the attacker to have a physical presence in the target country.
Cyber operations can also be combined with targeted acts of physical sabotage and arson attacks on commercial warehouses, logistics hubs, and retail networks. Local operatives are recruited through anonymous digital platforms to carry out such attacks. This allows those behind the operations to remain at a distance and keep their operational costs low.
How kinetic attacks and information pressure reinforce each other
The effectiveness of hybrid strategies depends on the combined impact of technical disruptions and the information that follows them. On their own, equipment failures or waves of false reports about threats to European flights and media outlets create only local problems. However, under conditions of heavy information pressure, such incidents can trigger wider processes of destabilization.
Information operations do not necessarily create a crisis from scratch. Their purpose is to shape how people interpret events and amplify their consequences. Coordinated campaigns that spread narratives about governments’ inability to guarantee security, the failure of migration policies, or economic weakness shift public attention from a technical incident to a wider crisis of trust in state institutions. External actors exploit the atmosphere of uncertainty and use local media networks and proxy channels to promote the idea that the Western model of governance as a whole is vulnerable.
Mass false threat reports serve a similar purpose. Even when no real explosive devices exist, mandatory security procedures force public authorities to commit significant resources to inspections. This creates a structural imbalance. The attacker spends very little to create a threat, while the state faces huge response costs and must deal with a constant state of public anxiety.
Exploiting uncertainty over attribution to limit the response of allies
Identifying those who organize and commission such operations remains a major challenge for European security. Hybrid threats are deliberately designed to operate in the gray zone between criminal activity, industrial espionage, and acts of state aggression. The use of intermediaries, compromised infrastructure in third countries, and conventional tools makes it difficult to prove direct links to a state.
Officially attributing large-scale cyberattacks to a specific government-backed group requires close cooperation between technical experts, intelligence agencies, and diplomatic services. One example is the discovery of links between Iranian state units and the October attacks on French infrastructure. However, in most cases, it is extremely difficult to distinguish between criminal groups, hired proxies, and state security services.
Another challenge comes from the convergence of interests among external actors. Cyber groups and information networks operate in parallel within the same geopolitical window of opportunity, increasing overall pressure, including on European institutions, without formally combining their resources.
This uncertainty directly limits the ability of allies to deter such operations collectively. Since individual incidents do not formally reach the threshold of an armed attack, traditional collective defense mechanisms cannot be activated automatically. External actors exploit this gap by carrying out repeated low-intensity attacks. These operations test the response speed and coordination of allies while avoiding the threshold that would require a direct military response.
Building a multi-layered system to counter hybrid threats
Countering hybrid threats requires a shift from fragmented responses to individual incidents toward a system of resilience. It is impossible to fully eliminate the risks of digital intrusions and information manipulation in open democratic societies. Therefore, prevention must go hand in hand with efforts to limit damage and quickly restore essential functions. Particular attention should go to threats whose consequences are difficult or impossible to reverse.
This approach requires stronger and more consistent security standards for connected equipment across Europe. It also calls for independent monitoring of critical infrastructure, regardless of who owns or operates it, and better systems for rapid data exchange between national cybersecurity centers.
At the same time, transparent communication with the public remains one of the most important elements of an effective response. Stronger oversight of financial flows through crypto assets is also essential, as these assets are used to pay local operatives involved in sabotage. Together, these measures can limit the spread of information-driven crises, disrupt recruitment networks, and maintain public trust in state institutions under sustained pressure.
