Μake us preferred on Google

Over the past few weeks, Europe has experienced a troubling succession of security incidents. Anonymous bomb threats have forced passenger aircraft to divert, make emergency landings or undergo security inspections, and have even closed schools.  Elsewhere, drone incursions near airports, cyberattacks affecting supermarket refrigeration systems and other disruptions to civilian infrastructure have raised questions about Europe’s vulnerability to unconventional attacks.

The timing and geographic spread have prompted a larger question: Are they the work of individuals, opportunistic criminal networks, or, part of a coordinated state-backed campaign to destabilize Europe? Or could several of these forces be at play?

European security officials have raised concerns about hybrid warfare, a strategy that combines conventional and unconventional tactics, including cyberattacks, sabotage, disinformation and intimidation, often without openly identifying those responsible.

To understand what may be happening, To Vima International Edition spoke with Dr. Triantafyllos Karatrantos, an expert on European security, terrorism and emerging threats. He examines whether the incidents could be connected, the challenges of identifying those responsible, and the vulnerabilities facing Greece and the wider European Union.

Aircraft fly over Dombovar, Hungary, November 6, 2026, as Hungarian Defence Minister Romulusz Ruszin-Szendi says Hungarian Gripen fighter jets escorted an Airbus A321 flying from Brussels to Sofia after bomb threats affecting civilian passenger aircraft, in this picture obtained from a video. Lorincz Peter Gabor/via REUTERS THIS IMAGE HAS BEEN SUPPLIED BY A THIRD PARTY. MANDATORY CREDIT. NO RESALES. NO ARCHIVES.

Q. Are Europe’s recent security incidents separate attacks, or are they part of a coordinated campaign?

Karatrantos: It could be both, actually.

First of all, there is great concern within different European agencies that Europe as a whole, and the EU member states in particular are under hybrid operations and attacks from malign external actors, mainly Russia and Iran.

Over the last month, or the last weeks, as you described, we’ve had these incidents linked with cyberattacks on different systems.

In France, Italy and other countries, there have been false bomb threats disrupting air travel and affecting many flights to different EU destinations.

But we have also had different drone incidents in different countries, starting from Latvia and Lithuania to Germany, involving drones linked mainly with airports. Again, disruption to flights is a very important dimension.

In the wake of the incidents, European agencies have called on member states to thoroughly investigate in order to determine who is behind the attacks. This is actually the only way to disrupt what we call the “gray zone” that a hybrid actor is trying to create between itself and its targets.

Examining the recent case of cyberattacks on France’s food system and health sector, it appears this could be a hybrid operation.

However, in the case of the bomb threats in Italy, a group supporting Russia claims it is responsible. But there is also a denial from the person who presents himself as the leader of this organization. Yet this contradiction is not strange as such groups usually want to have plausible deniability in order to avoid responsibility.

Clashes between protesters and police occur during a demonstration against the high cost of living at Strasbourg–Saint-Denis in Paris, France, on October 17, 2026.

The tactic, in such cases, is to develop ad hoc organizations or groups that claim responsibility, while at the end of the day the same actor may be behind the situation.

There are also investigations in Poland and Germany into the attack against the railway system in Krakow, Poland in 2025. The assessment of the intelligence agencies of both countries is that there is a sabotage link to Russia.

So probably the first and most plausible assessment is that all these attacks are linked through different hybrid operations in different member states.

This is not actually new, because sometimes these hybrid operations run for a couple of weeks or even months, especially when there is an information component.

We see something tangible: the cyberattack, the drone incident, the emails about bombs. But it is not impossible that there is also a background of disinformation operations.

For example, in France there is a very big discussion, and even some assessments from agencies, that Russian-driven bots tried to manipulate large demonstrations in France. The objective could be to exacerbate polarization, leading to more violence and destabilization of the current government and political system.

So that’s the first and most important block.

A notice informing customers that refrigerators are temporarily out of service is displayed on an empty case at the Delhaize Shop & Go store in Belgium, November 2, 2026. Photo: Reuters / Stephanie Lecocq

But we cannot exclude the possibility that this situation creates an opportunity for other individual actors or entities. For example, a hacker.

A good example of this is the hacking of a cloud system in the United States that supported web check-in at at least five or six big airports in Europe, including Heathrow and Zaventem.

An investigation by British authorities eventually concluded that it was not a hybrid operation, but a single hacker attacking this cloud system in the United States and creating major disruption to five or six European airports.

This creates a feeling of insecurity. It also creates opportunities for individual malicious actors who are not directly linked to states conducting hybrid operations, or even for copycat attacks.

Sometimes people copy the method of an attack because it seems very useful or attractive to them.

An employee works on empty freezers in a store where a cyberattack has taken down several of its freezers in Stockholm, Sweden, November 2, 2026. REUTERS/Marie Mannes

How do investigators determine who is responsible?

Karatrantos: First of all, they need to identify who is actually responsible for the situation. They need the physical evidence of who is actually placing a bomb or sending a bomb hoax email.

Then they’re trying to find the links, at least the network, that could lead to a state actor or to an organization. This could take a few months or even years in complicated cases.

Communication exchanges, messages via cryptographic platforms, possible meetings, exchanges, or even support are some of the things looked at.

Usually, when we’re talking about cyberattacks, there are a number of actors. Some of them are directly linked with the Federal Security Service of the Russian Federation (FSB). The Russian cyber espionage group Fancy Bear is a very famous malicious cyber actor linked with cyberattacks.

A police car parks outside Copenhagen Airport as police investigates threats directed at air traffic in Copenhagen, Denmark November 6, 2026. REUTERS/Tom Little

A Finnair aircraft from Helsinki on the tarmac at Fiumicino Airport after it was safely escorted to its scheduled landing in Rome by Italian Air Force jets following bomb threats that forced airliners to make unplanned landings across Europe, in Fiumicino, near Rome, Italy, November 5, 2026. REUTERS/Remo Casilli

In the case of cybercrime, sometimes actors want the credit that they conducted the act. While in other cases, another group of actors is hired for the job.  When cybercrime is offered as a service, we usually find a state actor behind the actions.

Meanwhile, in the case of Iran, they have the capacity to conduct cyberattacks. But sometime they hire criminal teams or individuals, depending on the system.

And the third link that investigators examine is coordination.

They try to find the timeline that could link one incident with something else. Cyberattacks are not necessarily linked with a hybrid operation. They can stand alone.

But if we have, in parallel, a lot of rumors or fake news linked with this attack that could create more destabilization or distrust through coordinated disinformation, this is probably a second element that could characterize the incident as a hybrid operation.

How do states recruit or support the groups carrying out cyberattacks and other hybrid operations?

Karatrantos: Usually the dark web. But there are other pathways.

If we’re talking about groups like Killnet, a well-known pro-Russian cyber group, some organizations offer their services for payment.

These services can be used by Russia or Russia-linked organizations. Sometimes we also find China backing or using similar organizations.

But there is a second category, which is more complex. A state can develop an organization, provide capabilities, training, funding or other resources, while allowing it to present itself as independent.

For example, we have the case of Russia’s troll farms. Yevgeny Prigozhin, who also developed the Wagner Group, financed the Internet Research Agency, which was very active during the 2016 US presidential election.

Here, someone is working on behalf of a state within a hybrid operation, but the organization does not necessarily present itself as an official state agency.

FILE PHOTO: Founder of Wagner private mercenary group Yevgeny Prigozhin leaves a cemetery before the funeral of a Russian military blogger who was killed in a bomb attack in a St Petersburg cafe, in Moscow, Russia, April 8, 2023. REUTERS/Yulia Morozova//File Photo

How vulnerable is Greece and how ready is the EU to protect itself?

Karatrantos: Both Greece and the EU are trying to accelerate efforts to develop a coherent response. But the biggest problem is coordination.

Hybrid operations and cyberattacks exploit the gray zone between civilian and military responses. Without a direct link to another state, authorities must rely on civilian measures involving the police, cybersecurity agencies and intelligence services.

In Greece, you have a highly decentralized system involving the Ministry of Citizen Protection, the National Cybersecurity Authority, which is supervised by the Ministry of Digital Governance, and the National Intelligence Service (EYP). Depending on the nature of the threat, other agencies may also need to be involved.

The problem is that these actors are not always on the same page, or lack the infrastructure to share intelligence and identify early warning signs.

The second issue is polarization and distrust in institutions and traditional media, which are particularly pronounced in Greece. According to surveys, including the Eurobarometer and OECD reports, a high percentage of Greeks get their news from social media without necessarily verifying the sources. This creates ground for disinformation campaigns, which are often the starting point for hybrid operations.

Another challenge is Greece’s geography, with its many islands and interconnected infrastructure systems.

FILE PHOTO: Ukrainian Foreign Minister Andrii Sybiha shows Israeli Foreign Minister Gideon Saar a Russian kamikaze drone Geran, a copy of an Iranian-made Shahed-136 unmanned aerial vehicle, amid Russia’s attack on Ukraine, in Kyiv, Ukraine, July 23, 2025. REUTERS/Valentyn Ogirenko/File Photo/File Photo

We recently established a national framework for critical entities and infrastructure. We’re now working to identify and close gaps, bringing together different stakeholders, mainly from the private sector, to take the necessary measures.

Until recently, hybrid threats were not part of security assessments. Organizations prepared security plans for terrorism and natural disasters, but cybersecurity incidents and hybrid operations were much harder to address.

Take drones, for example. They are currently among the most difficult hybrid threats facing European countries because there is no coherent legal framework. There are also limited tools for determining what a drone is carrying or whether it is simply a commercial drone being used for recreation or filming rather than a potential threat.

For a country like Greece, with so many airports and tourists during the summer, drones can be particularly disruptive. Even an unauthorized drone flight near a regional airport, without malicious intent, could disrupt flights for five hours.

That alone would be a significant problem to manage.

FILE PHOTO: A drone is pictured during the Drone Resilience Day, where security agencies, industry experts, and technology partners present realistic scenarios for detecting, identifying, and countering drone-related threats at the former airport Tegel in Berlin, Germany, July 7, 2026. REUTERS/Fabrizio Bensch/File Photo

How far has Greece progressed in developing its counter-drone defenses?

Karatrantos: First of all, the institutional framework is now in place. There are two dedicated bodies: the General Secretariat for the Protection of Critical Entities, within the Ministry of Citizen Protection, and the National Cybersecurity Authority, supervised by the Ministry of Digital Governance.

These two bodies need to coordinate to address the full range of threats through an all-hazards approach.

Secondly, Greece is investing in new technologies, tools and systems for the police, the National Cybersecurity Authority and other agencies, including the National Intelligence Service (EYP).

At the EU level, there is also a drone and counter-drone action plan that provides a framework for member states. Greece is working toward developing its own concrete action plan to address drone threats and protect critical infrastructure.

The country is also in the process of identifying several hundred critical entities, particularly in sectors such as energy transmission, water supply and telecommunications, that will be required to adopt an all-hazards approach to resilience.

For the first time, Greece has a specific legal framework establishing obligations for these entities.

Stockpiling. By Julia M Cameron

Is this disruption for the sake of disruption, or are they testing Europe’s systems? Are we at risk of a dangerous escalation?

Karatrantos: We are already examining a very bad incident- the case with the armed drone in Germany at a military airport. Very sensitive infrastructure was used by bad actors in order to put an armed drone there.

And that’s one of the worst-case scenarios: to move from just drones without any weapons to something that is armed, that could create a lot of problems where human lives could be lost.

If we go with the scenario that these incidents are state-prepared and state-driven, then they’re testing our response mechanisms and our time frames. This is important information for them.

Also, they are creating the sense of insecurity.

Travellers with think twice when they hear around diverted flights, drone incidents at different airports, emails about possible bombs.  And then we have the case with cyberattacks against web check-in.

It creates the feeling of: “I’m not sure about what will happen to me and where, and if we are prepared for this situation.”

These incidents put pressure on governments and European agencies to explain what is happening and demonstrate that they are capable of responding effectively.

Now if we consider the EU’s Preparedness Strategy and the recent communications that all Europeans must have emergency kits- it creates a sense that we are under some kind of attack.

Alternatively, these incidents could be intended to divert attention and security resources, creating an opportunity for attackers to strike elsewhere.

Police officers walk inside the A.B. Cairoli primary school after it was evacuated following a bomb alert that prompted evacuations in at least 300 schools across Italy, in Rome, Italy, November 11, 2026. REUTERS/Francesco Fotia

Dr. Triantafyllos Karatrantos is a Greek expert on European security, terrorism and emerging threats. He is a senior research associate at the Hellenic Foundation for European and Foreign Policy (ELIAMEP) and a security policy adviser to the Greek government. He also serves on Greece’s Coordination Committee for Cybersecurity Issues and represents the country on the OECD’s High Level Risk Forum, which addresses emerging risks and critical infrastructure resilience.