Atlantic Council: Russian Hybrid Ops Target European Airports and Supermarkets in Suspected Intimidation Campaign

An Atlantic Council analysis by Maksym Beznosiuk documents a surge in suspected Russian hybrid warfare incidents across Europe in recent weeks, including bomb threats targeting airports in Rome, Copenhagen, Prague, Warsaw, and Lisbon, and cyberattacks on frozen food sections of supermarkets across multiple European countries causing millions of dollars in damage. European security agencies have not yet confirmed Russian attribution for either campaign.

If European agencies cannot attribute these incidents to Russia with the evidentiary standard required for a formal response, the practical effect is that Moscow can sustain a civilian disruption campaign indefinitely at low cost.

The retail cyberattack vector is particularly instructive: targeting supermarket cold-chain systems rather than power grids or financial networks keeps damage below the threshold of critical infrastructure attacks while still generating visible public disruption.

If this pattern holds through the Abu Dhabi talks period — with Russia simultaneously at the negotiating table and running hybrid operations against NATO members — European governments will face pressure to decouple their Ukraine support posture from any ceasefire diplomacy.

WHY IT MATTERS

The Leipzig Airport bombing attempt in August 2026 marked a threshold crossing; the airport bomb threats and retail cyberattacks described here represent a further evolution toward operations targeting civilian daily life rather than military or government infrastructure.

Attribution remains unconfirmed, which is precisely the mechanism: Russia's use of criminal intermediaries and Telegram-recruited disposable agents is designed to keep incidents below the threshold that would trigger a formal NATO or EU collective response.

European interior ministries and national intelligence services — particularly in Poland, Germany, and the UK, which have the largest Russian intelligence footprints — now face the enforcement burden of countering an adversary that deliberately avoids the evidentiary standard required to invoke alliance-level countermeasures.

WHAT THIS DOESN’T TELL US

Has any European government formally attributed the early-November airport bomb threats or the supermarket cyberattacks to a specific Russian intelligence service or proxy, or do all investigations remain at the 'bears hallmarks of' stage?

Fault Lines

Strategic intelligence, synthesized daily — with a public track record. Every call graded against what actually happened.

Front page → Get the weekly brief →