When mysterious drones began appearing over oil rigs and wind farms off Norway’s coast about three years ago, officials were not certain where they came from. But “we knew what they were doing,” Stale Ulriksen, a researcher at the Royal Norwegian Naval Academy, said in a recent interview. “Some of it was espionage, where they are charting a lot of things. Some of it, I think, was positioning in case of a war or a deep crisis.”
The drones were suspected of being launched from Russian-controlled ships in the North Sea, Mr. Ulriksen said, including some ships that were near underwater energy pipelines. Norway could not do much to stop them, he added, given that they were flying over international waters.
In recent weeks, reports of drone swarms over the United States’ East Coast have brought fears of hybrid warfare to widespread attention. Only 100 out of 5,000 drone sightings there required further examination, U.S. officials said, and so far none are believed to have been foreign surveillance drones. But it is a different story for the drones spotted in late November and early December over military bases in England and Germany where American forces are stationed.
Military analysts have concluded that those drones may have been on a state-sponsored surveillance mission, according to one U.S. official familiar with the incidents, who spoke on the condition of anonymity to discuss an open investigation. British and German defense officials declined to discuss details of the sightings.
Experts said the drones’ presence was indicative of a so-called hybrid or “gray zone” attack against the West, where a range of tactics — military, cyber, economic and even psychological — are used to covertly attack or destabilize an enemy.
Hybrid attacks are not new, but they have escalated in recent years. One of the most visible and potentially deadly incidents came in July, when a series of packages exploded in Europe. Postmarked from Lithuania, the parcels contained electric massage machines with a highly flammable magnesium-based substance inside. Two exploded in DHL cargo facilities in Britain and Germany, and the third in a Polish courier firm.
Western officials and Polish investigators said they believed the packages were a test run by Russia’s military intelligence agency to plant explosives on cargo planes bound for the United States and Canada.
“We are telling our allies that it’s not random; it’s part of military operations,” Kestutis Budrys, Lithuania’s foreign minister, said of the explosions. “We need to neutralize and stop it at the source, and the source is Russia’s military intelligence.”
Other examples of hybrid tactics include cyberattacks on Albania in the past several years, which an investigation by Microsoft concluded were sponsored by Iran, and Russia’s unsuccessful attempt to sway presidential elections using disinformation in Moldova in October and November, according to Moldovan and European officials.
European countries are also investigating whether a number of ships intentionally cut underwater cables in recent months in an attempted attack.
While China, Iran and North Korea have shown a growing appetite for hybrid attacks, officials said that Russia in particular has deployed them as covert sabotage against NATO allies since the Kremlin’s full-scale invasion of Ukraine in 2022.
“Russia has stepped it up across the board, and as a result, it is reaching levels that are of growing concern,” James Appathurai, a NATO deputy assistant secretary general who oversees hybrid warfare strategy, said in an interview. “They are willing to accept more risk to us, to the safety of our citizens’ lives.”
Britain, Germany, the United States and Baltic and Nordic countries close to Russia’s border are among the Western countries most targeted by hybrid threats, in part because of their prominent support for Ukraine, officials said.
The European Union is also stepping up its efforts, imposing sanctions in mid-December for the first time against people specifically accused of engaging in pro-Russian hybrid threats. It also recently tasked four senior commissioners with countering hybrid threats.
Officials and experts agree a wide range of measures are needed to deter and protect against hybrid attacks, including more “naming and shaming” of adversaries and imposing legal penalties; improving intelligence and technical systems to monitor threats; and military exercises and other displays of force to demonstrate that even covert aggressions will not go unpunished.
But that will require unity among NATO members, especially when attacks cross international borders. And because hybrid warfare is by its nature designed to evade clear attribution of responsibility, officials have hesitated to launch powerful responses without having indisputable evidence of an adversary’s identity.
That has emboldened Russia and China to push the limits, according to officials, diplomats and experts.
“As long as NATO and European member states disagree on how to respond more assertively to the Kremlin’s hybrid warfare, Europe will remain vulnerable,” Charlie Edwards, a former British intelligence and security strategist, wrote in November. “Failing to act will mean the Kremlin retains the strategic advantage.”