Analysis

Russia Hybrid War Label Spreads Just as EU Leader Says It No Longer Fits

From a UN podium to the Baltic seabed, this week's Russia stories all reached for the same label — just as its own architect admitted it no longer fits.

Mara Whitlock · Sep 23, 2026, 6:11 PM · 2 min read

✳ Produced with AI assistance Fact-check index 38/100

Published under the byline Mara Whitlock. This article was researched, written and translated by AI. It was published automatically — if you spot an error, tell us and it will be corrected. Editorial & AI policy → Legal notice →

Fact-check index: 38/100 — The article's framing claims (Dan at UN, Euractiv's hybrid-label question, Kaliningrad-as-laboratory, Ottawa's caution) are corroborated by matching headlines in the source set, but most of its specific content—the von der Leyen quote, the 'counter-hybrid playbook' details, the subsea-cable statistics, and the Tusk/Macron claims—rests on sources (The Record, FT stats, Tusk/Macron reporting) not present in the provided source material at all.

Nicusor Dan told the UN Russia's hybrid warfare threat extends beyond Ukraine to Europe — Matches the Agerpres headline 'Nicusor Dan at UN: Russian threat extends beyond Ukraine; Europe target of hybrid warfare' directly and is cited.
Euractiv is asking whether Russia's campaign against the EU can still be called 'hybrid' — Matches the Euractiv headline 'Can we still call Russia's strategy against the EU hybrid?' verbatim in theme and is cited.
Kaliningrad is described as a Russian 'laboratory' for calibrating hybrid warfare against air-traffic control, ports, and emergency services — General framing matches The National Interest headline 'How Kaliningrad Is Serving as Russia's Laboratory for Hybrid Warfare,' but the specific mechanics (air-traffic control, ports, emergency services threshold-testing) aren't verifiable from the headline alone — only the title is in the provided source material.
Von der Leyen said in her State of the Union address that hybrid threats are 'less and less hybrid and less and less threats' — No source for this quote appears anywhere in the provided source material — The Record's State of the Union coverage is not included.
Von der Leyen proposed a 'counter-hybrid playbook' letting any EU member summon the rest after an attack, flanking NATO Article 4 rather than Article 5 — Cited to therecord.media, but no Record article on this topic appears in the supplied source list — cannot be checked against source material.
Canada's Defence Minister David McGuinty and Deputy PM Chrystia Freeland commented on Russian threats, with Canada taking a 'cautious' approach — Matches the general topic of the chatnewstoday.ca/paNOW headline 'Ottawa says it's taking a cautious approach to possible emerging Russian threat,' but the specific quotes attributed to McGuinty and Freeland aren't verifiable from the headline alone.
Donald Tusk warned the Kremlin may stage drone or missile strikes and blame accidents; Macron convened a closed-door briefing with French party leaders — No corresponding source (Polish or French reporting) appears anywhere in the provided source material.
Subsea cable statistics: >95% of global internet traffic, $10tn in daily transactions, $15.4bn projected 2028 spending (up from $900m in 2023) — An FT article on undersea cables ('Undersea cables: the battle for the ocean floor') is in the source list, so the general topic is corroborated, but these specific NATO-attributed figures cannot be verified from the headline alone.
Chinese- and Russian-linked vessels have been accused of dragging anchors across fibre-optic cables serving Finland, Estonia, Germany and other NATO states — Cited to the same FT undersea-cables piece; the general topic is plausible and on-theme with the headline, but the specific incident details are not confirmed by the headline text alone.
HYPOTHESIS callout that the term's ambiguity is structurally convenient to both Moscow and Brussels — Explicitly framed as the article's own analytical hypothesis rather than a sourced fact, so it is appropriately caveated, but it extrapolates beyond what any single cited source states.

OverviewThe core of it, in under a minute+

This week, Western officials called Russia's actions against Europe — cyberattacks, sabotage, and disinformation — 'hybrid warfare,' a term for tactics that fall short of open war. Romania's president used it at the United Nations; others applied it to Russia's Kaliningrad exclave, a Canadian threat report, and undersea cable sabotage. But European Commission President Ursula von der Leyen, who built the European Union's response around that term, now says the threats are 'less and less hybrid' and closer to outright conflict. Whether one label still fits so many threats is unclear.

This week put a dent in Brussels's favourite compound noun. Romanian President Nicusor Dan told the UN General Assembly that Europe is a target of Russian hybrid warfare — cyberattacks, disinformation, sabotage, disrupted infrastructure — meant to erode trust in democratic institutions and support for Ukraine, per Agerpres. Days earlier, the official who built the EU's response around that word had admitted it might not fit anymore.

We should be under no illusions about what is happening here: hybrid threats facing Europe are less and less hybrid and less and less threats.
Ursula von der Leyen, European Commission president, State of the Union address, 16 September 2026 — via The Record

That contradiction is this week's real story: the label is spreading across geography and institutions exactly as its most prominent user says it no longer describes what is happening — and Euractiv is now asking whether Russia's campaign against the EU can still be called hybrid.

Take Kaliningrad. Analysts increasingly describe the Russian exclave not as a fortress but as a laboratory — Moscow mapping how Western air-traffic control, ports and emergency services respond when systems fail, to find the threshold between harassment and open aggression, per The National Interest. That calibration is the hybrid model in its purest form: deniable, incremental, built to avoid collective defence. It is the model von der Leyen says is breaking down.

Her fix is a "counter-hybrid playbook": any of the EU's 27 governments could summon the rest the moment one is hit by cyberattack, sabotage or drone incursion — a mechanism built to flank NATO's Article 4 consultation clause rather than invoke Article 5's collective-defence trigger, per The Record.

The geography is widening too. Ottawa says it is watching "cautiously" — Defence Minister David McGuinty won't draw conclusions ahead of the intelligence, while Deputy Prime Minister Chrystia Freeland cites "complete and open conversation" with European allies and Five Eyes partners, per wire reporting carried by paNOW. Poland's Donald Tusk, by contrast, has warned the Kremlin may stage drone or missile strikes and blame accidents; Emmanuel Macron convened French party leaders for a closed-door briefing. One word, different postures.

>95%of global internet traffic carried by subsea cablesNATO estimate

$10tnin daily financial transactions that flow through them

$15.4bnprojected annual spending on cable systems by 2028up from $900m in 2023

NATO estimates, via Financial Times

The Baltic seabed shows why the definition matters. Chinese- and Russian-linked vessels have repeatedly been accused of dragging anchors across fibre-optic cables serving Finland, Estonia, Germany and other NATO states, per the Financial Times. Civilian infrastructure, deniable method, disputed intent: another case built for the hybrid label, and another one testing it.

HYPOTHESIS: the word's elasticity may be structurally convenient to both sides, not accidental — it lets Moscow stay under any clause that triggers collective defence, and lets Brussels coordinate a response without declaring the war its own language increasingly implies. Supporting this: von der Leyen's mechanism flanks Article 4, not Article 5. Against it: her own words — "less and less" hybrid — suggest the ambiguity now costs Brussels more than it shields.

What to watch: whether the playbook produces a genuinely common response the next time a member state is hit, and whether Ottawa's caution survives if the pattern reaches North America.

Related articles

NATO tracks a summer of drone incidents and cyberattacks, avoids calling it an attack

Europe warns of Russian threat while its weapons makers pull in different directions

Europe Faces Sabotage, Propaganda and a Migration Dispute in One Week

EU moves this week to build permanent defence institutions against Russia

Post image

Report this article