Russia’s campaign of sabotage, cyberattacks, political interference and other covert operations across Europe is increasing frequency and severity, according to a new Congressional Research Service report.

The assessment comes as German authorities investigate an explosives-laden drone discovered near a Ukrainian cargo aircraft at Leipzig/Halle Airport. 

A U.S. intelligence official told ABC News that the device and explosives were consistent with those used by Russia’s military intelligence service, the GRU.

The CRS report, Russian Hybrid Warfare Activities in Europe: Considerations for Congress, examined a growing series of Russian-linked operations since Moscow’s full-scale invasion of Ukraine in 2022. 

"Russia has multiple foreign intelligence agencies tasked with conducting traditional espionage operations to collect political, economic, and scientific/technological intelligence," the report reads. "These agencies also conduct Russia's hybrid warfare activities, in addition to their traditional espionage missions."

The report also identified assassination plots and airspace violations among the tactics attributed to Russia.

“These attacks have been increasing in number and severity,” the report also reads.

Research cited by CRS found that reported Russian hybrid attacks in Europe quadrupled between 2023 and 2024. 

Another assessment identified at least 151 reported Russian operations from February 2022 to March 2026.

The activity has extended well beyond Russia’s immediate neighbors. 

European governments have reported suspected attacks on critical infrastructure, cyber networks and transportation systems, as well as GPS interference and attempts to influence political processes.

The CRS report said Russia’s intelligence services have adapted their operations in response to increased European counterintelligence efforts, including the expulsion of Russian intelligence personnel. 

It described Russian intelligence activity as becoming “more aggressive,” while relying increasingly on methods designed to make attribution more difficult.

The Leipzig airport incident illustrates the potential security risks.

On Aug. 4, German authorities discovered the drone, which was carrying explosives and a detonator near a Ukrainian Antonov cargo aircraft. The device failed to detonate, but the discovery prompted a security response and temporarily disrupted airport operations. 

Leipzig/Halle is a major European cargo hub and is used by the United States and NATO allies for logistics supporting Ukraine, according to ABC News.

A U.S. intelligence official briefed on the investigation said that the drone’s construction and explosives were characteristic of equipment used by the GRU. German authorities have not publicly made a final determination.

The incident comes amid broader concerns about Russian activity in Germany and elsewhere in Europe. 

German Chancellor Friedrich Merz has described the country as increasingly subject to hybrid attacks, while European governments have continued to investigate suspected Russian sabotage and intelligence operations. 

For European governments, the challenge is determining responsibility and responding to operations that often fall between traditional categories of espionage, crime and military activity.

The CRS report warned that the continuing campaign has implications for U.S. and European security interests, concluding that “continued Russian hybrid warfare activities” raise questions about the long-term threat posed by Moscow.