Germany has entered a new and unsettling chapter in its understanding of national security. For years, the country watched from a distance as hybrid warfare unfolded elsewhere — a cyberattack here, a disinformation campaign there, a suspicious act of sabotage that could never quite be proven. But now, the threat is no longer abstract, and it is no longer something that happens to other countries. Chancellor Friedrich Merz and his cabinet have begun to speak openly about what intelligence agencies and security officials have been quietly warning about for months: Russia is waging a deliberate, sustained and increasingly brazen campaign against Germany, not with tanks or missiles, but with drones, sabotage, lies and psychological pressure. These are not acts of war in the traditional sense, but they are not acts of peace either. In a press conference after the attempted drone strike at Leipzig/Halle Airport, Merz made it clear that Germany is not at war with Russia, yet it is unmistakably under attack. He described a Kremlin that is willing “to act with growing ruthlessness, accepting serious damage to property and even injuries and deaths.” Those are not the words of a leader trying to calm public anxiety; they are the words of a leader trying to prepare a nation for something it has not faced before. For the first time since the start of Russia’s full-scale invasion of Ukraine, the German government explicitly blamed Moscow for an attempted attack on its own soil. The targeted location was no coincidence: Leipzig/Halle Airport hosts Ukrainian Antonov cargo aircraft, which are used to transport military equipment for Ukraine. That single detail ties the incident directly to Germany’s support for Kyiv and reveals the logic behind the hybrid campaign. Germany, because of its size, its central role in Europe, its economic power and its visible commitment to Ukraine, has become one of the most exposed countries on the continent. The threat level, as Interior Minister Alexander Dobrindt has now said, has been raised from “abstract” to “high” — a change that sounds clinical but carries real weight for everyday life, because it means the danger is no longer hypothetical. It is happening now, all around us, often in ways we do not notice and cannot easily recognize.
What makes hybrid warfare so deeply unsettling is not just the damage it causes, but the difficulty of seeing it clearly in the first place. It is a shadow war, fought in the grey zone between peace and conflict, where the attacker often remains invisible and the victim is left to wonder who struck and why. Russia, of course, is the most obvious actor in this new landscape, but it is far from alone. According to the Federal Office of Civil Protection and Disaster Assistance, China, Iran and North Korea are also using hybrid methods against Germany. Each acts in its own way and for its own reasons, but together they create a climate of constant low-level pressure on German democracy, infrastructure and social cohesion. The challenge, security expert Ferdinand Gehringer explains, is that “not every cyberattack, act of sabotage or attempt at disinformation is automatically part of a hybrid campaign.” That is a crucial point. Hybrid warfare is not just a collection of isolated malicious acts. It is a coordinated pattern, a strategy that connects different measures through a common actor, shared strategic objectives and carefully chosen timing. A lone cyber intrusion might be the work of a criminal gang. A single false story online might be a random conspiracy theory. But when the same actor, or the same network of actors, repeatedly strikes at the same kind of targets, using similar methods, at moments that serve a larger political goal, then the picture changes. Then individual pieces begin to form a campaign. Gehringer calls this the “overall situation assessment” — the difficult, painstaking work of connecting information across fields that usually do not talk to each other: police records, intelligence reports, military observations, cyber defence logs and private sector warnings. Only by looking at technical traces next to crime patterns, timelines next to disinformation narratives, can one begin to identify the hidden hand. In the case of Leipzig/Halle, the pieces fell into place: an explosive-laden drone found near Ukrainian cargo planes, the specific technology used, the method of operation and intelligence findings all pointed in the same direction. Dobrindt spoke of “low-level agents” working on behalf of a Russian intelligence service — ordinary people, perhaps, recruited for a single dangerous task, leaving few traces and even fewer answers. And yet, despite the obvious flaws in such operations, they are effective precisely because they are hard to attribute, hard to prove and hard to respond to.
The question that now haunts Berlin and other European capitals is simple: how do you defend a country against an enemy who refuses to cross the threshold of open war? Hybrid warfare is designed to stay below that threshold, to exploit vulnerabilities, to erode public trust in institutions and to destabilize society from within. It does not require an invasion to succeed; it only requires enough confusion, enough distrust and enough fear to weaken a nation’s ability to act. This is why rearming the Bundeswehr, although necessary, is not enough. You cannot bomb a disinformation campaign. You cannot shoot down a conspiracy theory. You cannot respond with artillery to a sabotage operation carried out by a “low-level agent” who vanishes into the crowd. So what can a state actually do? Germany has been trying to find an answer since 2022, when the scale of hybrid threats became impossible to ignore. The federal government has established an interdepartmental task force specifically designed to deal with disinformation and other hybrid threats, bringing together ministries and agencies that previously worked in isolation. There are now procedures for attributing cyberattacks and foreign information manipulation to their likely originators — a complex and politically sensitive task, because attribution is never just technical; it is also a statement of intent and a basis for possible countermeasures. At the European level, the so-called “Hybrid Toolbox” provides a mechanism for joint responses by member states, recognizing that hybrid threats do not respect national borders and that no country can defend itself alone. More recently, in a significant institutional innovation, the Joint Centre for Countering Hybrid Threats (GAZ Hybrid) was created to bring together information on espionage, sabotage, disinformation and other hostile activities. Its purpose is early detection: to see the pattern before it becomes an attack, to connect the dots before the public even learns that dots exist. When the drone attack in Leipzig occurred, the German government responded, in its own words, “resolutely, calmly and proportionately.” It closed the Russian consulate general in Bonn and the Russian House in Berlin, promoted EU-level sanctions against additional Russian individuals involved in hybrid activities, tightened entry controls and intensified pressure on Russia’s shadow fleet — the anonymous tankers and cargo ships that help Moscow evade sanctions and maintain its economic lifelines. These are not dramatic military gestures, but they are meaningful moves in a conflict that is fought with tools, laws, economic measures and diplomatic pressure.
Yet the deeper truth about hybrid defence is that it cannot be left entirely in the hands of governments. The state can build task forces, create warning systems, impose sanctions and close consulates. But the ultimate target of hybrid warfare is not a government; it is a society. And a society can only defend itself if it understands what is happening and knows how to respond. This is why, as Gehringer argues, Germany needs to move away from a purely reactive posture and toward an anticipatory one. The goal should be to make attacks more expensive for the aggressor, disrupt their planning, uncover their networks as early as possible and blunt the impact of whatever attacks still get through. That requires a fundamental shift in mindset. Instead of waiting until a cyberattack cripples a hospital, a sabotage operation knocks out a power grid or a disinformation campaign sways an election, the state must try to identify hostile activities while they are still in the planning stage and stop them before they become operational. In some cases, this can take very concrete forms. If an attack on a substation were to cause a power cut, households and businesses could protect themselves by having emergency power supplies and backup plans ready. This is not about living in constant fear; it is about simple preparedness. In the best case, preparation could become so good, so embedded in the daily routines of institutions and citizens, that hybrid attacks lose their element of surprise almost entirely. At that point, the attacker’s calculus changes: why bother, if the target is ready, resilient and unwilling to panic? Preparing for attacks in advance, Gehringer says, also means preparing for communication. The state and society need to know how to talk about an attack when it happens — quickly, credibly and transparently. That may seem like a small thing, but it is actually decisive. One of the most powerful effects of hybrid warfare is intimidation. When people are confused and frightened, they become vulnerable to manipulation. When they are instead informed and calm, the entire operation loses much of its power. In this sense, effective communication is not just a public relations tool; it is an essential part of national defence.
It may be tempting to think of the public as a passive target, a population to be protected by officials in sealed rooms. But Gehringer rejects that view strongly. The public, he says, plays a very important role in hybrid defence, and yet it is “still being needlessly wrapped in cotton wool.” That phrase captures an uncomfortable truth: many governments, for understandable reasons, are reluctant to tell their citizens how vulnerable they actually are. They worry about causing panic, about being accused of scaremongering, about political consequences. But this paternalistic approach, however well-intentioned, leaves society unprepared and therefore more vulnerable. The public is not just an object of protection; it is part of the solution. Disinformation, for example, can never be fully prevented. In an open society, manipulative information is always going to exist — that is the price of freedom. The goal, therefore, cannot be to isolate people from lies, but to make them more able to recognise and resist lies. This is what Gehringer means by resilience rather than isolation. Citizens need to be able to assess information critically, to question sources, to notice when a narrative is designed to inflame anger or sow division. The media must operate independently, without fear of state pressure or foreign manipulation, and investigative journalism must continue to shine light into dark places. The state, for its part, must earn trust by communicating honestly and quickly, even when the news is bad. Secrecy and silence create a vacuum that conspiracy theories will quickly fill. Openness, on the other hand, gives people a solid foundation on which to build their own judgement. It also robs hostile actors of their most effective weapon: the sense that something is being hidden, that events are out of control, that no one can be believed. None of this is easy. It requires a level of maturity and honesty in public discourse that has often been lacking, not only in Germany but across the democratic world. It also requires a long-term commitment to education, media literacy and civic engagement — investments that may not yield immediate results but are essential in the long run.
In the end, the response to hybrid warfare is not a single weapon or a single plan. It is a combination of deterrence, defence and resilience — a triangular structure in which government, institutions and citizens all have their parts to play. Germany is still learning how to do this. The threat level has been raised, new institutions have been created, and the government has finally begun to name the enemy. But naming the enemy is only the first step. The deeper challenge is to build a society that can withstand pressure without losing its democratic character, a society that does not become paranoid or authoritarian in its attempt to defend itself, a society that can be attacked and remain calm, informed and united. That is a difficult balance to strike, and it will take time. Hybrid attacks are designed to exploit weakness, and Germany has structural weaknesses like any other nation: digital infrastructure that is not fully secure, existing social divisions that can be amplified, a long-standing reluctance to talk seriously about national defence and a public that has been protected from hard truths for decades. These weaknesses do not make Germany doomed, but they do make it vulnerable if it does not adapt. The good news is that adaptability is possible. The measures already taken since 2022 — the task forces, the warning systems, the European cooperation, the increased scrutiny of foreign agents — show that the state is beginning to learn. What remains unclear is whether the wider society is ready to learn as well. The threat may be invisible, but it is real. It is unfolding in the skies over Leipzig, in the dark corners of the internet, in attempts to influence the minds and hearts of ordinary people. Germany does not need to resemble a fortress to survive this. It needs to resemble a healthy community: aware but not paranoid, prepared but not afraid, open but not naive. That, in the end, is the true meaning of resilience in the face of hybrid war — and it is a task that belongs to everyone, not only to the state.