By Jabir Deralla
In cooperation with CIVIL Hybrid Threats Monitoring Team

I was standing in the little square near the monument to Garibaldi in Talamone, Tuscany, when the calm of an early October afternoon was torn apart by the deafening roar of Italy’s Aeronautica Militare Eurofighter Typhoon jets on a routine patrol.

Have you ever heard that sound — the thunder of fighter jets above your city, cutting through the air to keep your country safe? It’s reassuring, almost heroic.
Now imagine those are not your jets. Imagine they belong to the enemy.

That thought, fleeting but unsettling, returned to me days later — when Russian warplanes once again crossed into NATO airspace over Lithuania. What seemed like an eighteen-second technical incident was, in fact, another carefully calculated signal in Russia’s long hybrid confrontation with Europe.

18 Seconds: Not a Glitch in the Radar Systems

At 18:03 local time on Thursday, October 23, two Russian military aircraft — a Su-30 fighter jet and an Il-78 tanker — crossed roughly 700 meters into Lithuania’s airspace near the border with Kaliningrad. The intrusion lasted barely eighteen seconds before the planes turned back. Within minutes, NATO’s Baltic Air Policing scrambled Spanish Eurofighter Typhoons, and Vilnius lodged a formal diplomatic protest.

It wasn’t the first such event, nor the longest. On September 19, three MiG-31 fighter jets violated Estonia’s airspace near Vaindloo Island, remaining inside for about twelve minutes. Just two months earlier, on July 28, a Russian-made drone slipped into Lithuanian territory and went undetected for several days before being discovered.

By comparison, the October 23 incursion — fleeting, almost invisible — signaled something new. Russia appears to be refining its tactics: shifting from prolonged violations to precise, momentary incursions designed to probe response times, measure NATO readiness, and test political nerves. These are not navigational errors — such aircraft do not drift by mistake. Each brief crossing is a message, a test, and a reminder.

The Kremlin’s method is both calculated and psychological. Even a seconds-long breach carries strategic intent: to signal presence, test resolve, and stretch the vigilance of Europe’s defenders. The incident over Lithuania may have passed in less than half a minute, but its implications — for NATO cohesion and Europe’s security posture — will echo much longer.

Such fleeting provocations are not isolated events. They form part of a wider campaign in which Russia blends military gestures with covert operations, sabotage, and information warfare. Each brief incursion in the sky mirrors a pattern unfolding on the ground — in parcels, warehouses, and city streets — where deniable networks act as Moscow’s invisible extensions.

The Shifting Face of the Hybrid Battlefield

Over the past three months, the tempo of Russia-linked hybrid operations across Europe has accelerated noticeably. While drones and cyberattacks dominate headlines, a quieter and more insidious campaign unfolds in post offices, warehouses, and residential neighborhoods. Its weapons are ordinary: parcels, ignition devices, and fear. Its targets are not soldiers, but the confidence of societies.

In September 2025, Lithuanian prosecutors uncovered a multi-country sabotage network spanning the Baltic states and Poland. The group, allegedly directed by Russian intelligence, had planned parcel-based arson and explosive attacks. Investigators seized about six kilograms of explosives and arrested fifteen suspects — the clearest sign yet of what analysts now call parcel warfare: a doctrine meant to spread panic and distraction rather than mass casualties.

A month later, on October 21, Polish authorities detained eight individuals suspected of preparing acts of sabotage, including reconnaissance of military and energy infrastructure. The next day, Romania’s intelligence service (SRI) revealed that two Ukrainian nationals under direct Russian coordination had planted incendiary devices at the Nova Post courier hub in Bucharest. The devices — hidden in everyday objects such as car parts and headphones — were remotely tracked by GPS.

That same week, France’s domestic intelligence agency DGSI arrested four suspects in connection with an alleged assassination plot against Vladimir Osechkin, the exiled Russian human-rights defender who exposed torture inside Russian prisons. Osechkin described the attempt as part of a “shadow war” waged by the Kremlin against its critics abroad.

Individually, these cases might appear isolated. Together, they form a mosaic of low-budget, high-impact operations designed to unsettle Europe’s sense of safety. They rely on civilians, courier networks, and psychological shock to achieve what Moscow’s army cannot accomplish with tanks: the erosion of normality itself.

Tradecraft: Simple Tools, Complex Intentions

The pattern is unmistakable — and deceptively simple. Russia’s contemporary tradecraft no longer relies on Cold War sophistication but on the banality of everyday logistics. Saboteurs operate through courier firms, postal networks, even ride-sharing apps. Many are recruited via Telegram job offers promising “quick cash for simple delivery tasks” — a digital evolution of the old cut-out method that hides the chain of command.

The tools are cheap: a lighter, a modified power bank, a GPS tracker, a prepaid SIM card. The cost of an operation rarely exceeds a few hundred euros, yet the payoff is disproportionate. A single incendiary parcel can dominate headlines, trigger emergency alerts, and drain security resources for weeks.

This new generation of hybrid operatives often works without ever meeting a handler. They are freelancers of disruption — lured, manipulated, or coerced through encrypted channels. EU investigations show that many suspects were unaware of the full nature of their tasks until after arrest; some thought they were testing devices or delivering promotional kits, others were simply desperate for money.

For the Kremlin, that ambiguity is the point. Each incident remains plausibly deniable: a courier caught with explosives can be dismissed as a criminal; a warehouse fire, as negligence. By keeping every act below the threshold of war, Moscow sustains continuous pressure without open confrontation.

Meanwhile, the information ecosystem amplifies the confusion. State-linked media, troll farms, and outlets like RT and Sputnik quickly recast each event — claiming it was a false flag or Western hysteria. The objective is not persuasion but pollution: to flood public space with contradiction until truth itself becomes suspect.

Hybrid warfare today is less about destruction than distortion. It weaponizes uncertainty. A parcel bomb in Bucharest, a data breach in Riga, a drone over Tallinn — each becomes a data point in a psychological campaign aimed at exhausting Europe’s attention span, testing institutional resilience, and blurring the boundary between war and peace.

Why Lithuania Matters

At first glance, the brief airspace breach over Lithuania might appear trivial — a blip on the radar, resolved in seconds. Yet in the logic of hybrid warfare, even the shortest violation carries layered meaning. It is a signal, a rehearsal, and a reminder of geography’s permanence: that Russia, despite its setbacks in Ukraine, still presses against NATO’s borders — testing not only air defenses, but political nerves.

Lithuania sits at the sharp edge of Europe’s security architecture. Wedged between Belarus and the heavily militarized Russian exclave of Kaliningrad, it forms part of the Suwalki Gap — a narrow, 65-kilometer corridor connecting the Baltic states to the rest of NATO. This corridor is widely considered the alliance’s most vulnerable chokepoint, where even a minor incursion could isolate Estonia, Latvia, and Lithuania from their allies to the south. In every NATO exercise, the Suwalki Gap features as the hypothetical flashpoint of any larger European conflict.

For Moscow, Lithuania embodies both symbolism and strategy. It was among the first Soviet republics to declare independence in 1990, and among the earliest to join NATO and the EU. Since then, it has become one of Ukraine’s most steadfast defenders — supplying weapons, training, and moral support far beyond its size. To the Kremlin, Lithuania represents defiance: a small but unyielding democracy that disproves the myth of Russian dominance in its former imperial sphere.

That defiance makes Lithuania a prime target for coercion. Russian intelligence and military planners know that even a single incident — a drone incursion, a border provocation, a cyberattack on infrastructure — can generate outsized strategic effects. Each “micro-crisis” forces NATO into alert, triggers diplomatic consultations, and tests alliance unity, while feeding the domestic narrative that Russia can still intimidate the West.

Kaliningrad plays a central role in this strategy. Once known as Königsberg, the city hosts Russia’s Baltic Fleet, Iskander-M missiles, and S-400 air-defense systems, giving Moscow a dense hybrid platform just 300 kilometers from Warsaw and 500 from Berlin. From there, Russia conducts electronic warfare, airspace probes, and psychological operations against the Baltics and Poland — a constant reminder that its shadow still reaches into the heart of Europe.

Every brief violation, therefore, is a calibrated act of theater. It tells several audiences different stories at once:

• To Europe, it whispers that NATO’s eastern flank remains fragile.
• To Ukraine, it signals that support comes at a price.
• To Russians at home, it sustains the illusion that their military still commands fear abroad.

This is why Lithuania matters far beyond its borders. It is not merely the site of an airspace incident, but a barometer of Europe’s deterrence — a testing ground for NATO’s cohesion and a frontline in a contest that blends intimidation, information, and ideology.

For the Kremlin, such actions are low-risk, high-yield coercion. For Europe, they are high-stakes warnings. The real battle is not for airspace, but for perception — whether citizens in Vilnius, Warsaw, Berlin, or Rome still believe that peace in their skies is guaranteed.

Europe’s Overly Cautious Response

Europe’s reaction to these incursions and covert acts has been overly cautious — often quick, but rarely unified. After each airspace violation or sabotage plot, statements are issued, arrests made, alerts raised. The machinery of democracy still works, but the tempo of response lags behind the tempo of threat.

When Lithuanian radars detected the Su-30 and Il-78 crossing the border, the reaction followed a well-rehearsed choreography. Spanish Eurofighter jets scrambled from Šiauliai within minutes. NATO’s Combined Air Operations Centre in Uedem logged the incursion, and Vilnius filed a formal protest within the hour. In procedural terms, the alliance functioned perfectly — yet hybrid warfare does not measure victory in procedures. The real test lies in endurance: how many such alarms can Europe absorb before fatigue sets in?

Across the continent, similar scenes unfold with quiet regularity. In Warsaw, counter-intelligence teams chase saboteurs photographing train depots and sending coordinates to handlers abroad. In Bucharest, investigators dissect the circuitry of GPS-guided incendiary devices found in courier parcels. In Paris, the DGSI protects Russian exiles on Kremlin hit lists. And in Riga and Tallinn, cyber-units trace digital fingerprints that lead, again and again, to clusters of accounts registered in St. Petersburg, Minsk, or Moscow.

Since 2022, Europe’s intelligence coordination has improved markedly. NATO and EU structures that once operated in parallel now share data through hybrid-threat fusion cells, exchanging information on sabotage, cyber-operations, and disinformation in real time. Lithuania’s State Security Department, for example, coordinates daily with Polish, Latvian, and German counterparts within what insiders call the Eastern Shield network. Yet even these advances cannot erase the structural asymmetry: while Moscow operates through one command pyramid, Europe responds through twenty-seven national legal systems — each with its own thresholds, definitions, and bureaucratic rhythms.

That legal patchwork remains one of the continent’s soft spots. Many of the recently arrested saboteurs were charged under ordinary criminal law, not anti-terrorism statutes, because the acts fell below existing definitions of terrorism or war. A parcel that burns a warehouse, a drone that crashes near a military base, a data breach that leaks personal records — each sits in a gray zone where responsibility is blurred and jurisdiction contested. The Kremlin thrives in that ambiguity.

Still, the response is evolving. NATO has expanded its Baltic Air Policing mission, increased funding for early-warning systems, and begun integrating civilian infrastructure — energy grids, ports, and rail networks — into defense planning. The European Union, often slower to act, has created Hybrid Rapid Response Teams, deployable within days to assist member states facing coordinated threats. France and Germany are reviewing protection measures for Russian and Belarusian dissidents, while Poland and the Baltic states are forming joint task forces linking counter-espionage, customs, and border security.

But hybrid warfare’s ultimate arena is not military. It is society itself — the collective psychology of democracies. The Kremlin’s goal is to erode trust: in institutions, in facts, and in one another. Defense, therefore, must also be societal. Journalists who verify before they amplify, teachers who explain manipulation to students, NGOs that track disinformation networks, and citizens who refuse to share unverified claims — all are part of Europe’s invisible front line.

In Vilnius, Riga, and Warsaw, media-literacy programs now accompany counter-espionage briefings. Estonia’s Digital Resilience Curriculum, launched in 2024, teaches high-school students how to recognize manipulated content. CIVIL and other civic initiatives in Southeast Europe run hybrid-threat monitoring teams that link journalists with open-source investigators to expose coordinated propaganda. These efforts are still modest but essential: they build what military planners call cognitive defense — the capacity of a society to stay rational under pressure.

Europe’s response, then, remains a work in progress — a network of fighter jets, prosecutors, journalists, and citizens slowly learning to act in concert. The challenge ahead is to move from reaction to anticipation, from firefighting to foresight. For the threats are continuous, adaptive, and increasingly psychological.

Standing again under that Tuscan sky, I remembered the sound — the same low thunder that had shattered the quiet afternoon in Talamone. Then, it was a comforting note in Europe’s daily rhythm of security. Now, it echoes differently: a reminder that vigilance, too, can grow weary. Across the continent, that sound still rolls — not only through the air, but through Europe’s conscience.

The Long Shadow

The October 23 airspace incursion over Lithuania may have lasted less than twenty seconds, yet it casts a far longer shadow — across borders, screens, and minds. This was not just a fleeting episode, but a signal in a broader sequence: one more node in the evolving architecture of hybrid confrontation that I described in my earlier piece on Russia’s hybrid war against Europe:

“Hybrid warfare is less about destruction than distortion.” (CIVIL Today)

That observation now feels more relevant than ever. The Kremlin’s arsenal may have shifted from tanks to drones, yet its tactics of intimidation and slow-burn operations of influence only evolve in form — their essence remains the same.

The tactics of modern warfare are more sophisticated than ever.

The frontlines are no longer defined by coordinates but by perceptions — the invisible terrain of psychology, politics, and trust.

The Kremlin’s forces have rarely succeeded in overt military operations — except in their capacity for total destruction and brutality against civilians. Where Moscow truly excels is in calibrated incursions, covert manipulations, and psychological warfare. Its hybrid craft — a blend of intimidation, deception, and deniability — has long proved more effective than its tanks. Through this asymmetric approach, the battlefield has expanded: from the skies over Vilnius and the parcel networks of Bucharest to the courts of Warsaw and the information feeds of Brussels, Berlin, and Paris — as well as the growing pro-Russian sentiments and politics across the Balkans, not only in what’s called the Western Balkans.

Europe now stands at a new threshold of deterrence. The old edges — tanks, missiles, declared wars — have blurred into something both more pervasive and more insidious. The front line is no longer confined to border posts; it runs through logistical networks, financial transactions, and the everyday trust that citizens extend to one another and to their institutions.

So, what must Europe now do?

Europe must finally move from reaction to resilience. If every brief incursion or parcel bomb becomes part of a continuous campaign, then Europe cannot afford to treat each episode as an isolated anomaly. The defense must shift from firefighting to preparedness — from reaction to strategy.

To understand and accept reality is one thing, but appeasement, Europe’s longstanding political reflex, is not the answer. Adapting to reality means preparing for what is to come — not seeking half-measures to secure a quiet mandate.

Freedom requires endurance. The hybrid front shows that peace requires vigilance.

Even the peculiar and transactional figure of Donald Trump 2.0 has noted — cynically but not incorrectly — that Europe must do more for its own defense, turning that fact into his political advantage. Indeed, Europe has neglected its security since the fall of the Iron Curtain, placing hard-defense development at the bottom of its priorities. Human assets were dropped even further down the list.

It is high time for Europe to invest not only in its hard assets, but also in its societal resilience, and to renew its political commitment to democratic values. Fighter jets, radars, and interceptors remain vital. Yet the greatest vulnerability now lies in the societal immune system — the ability of citizens, journalists, educators, and fact-checkers to recognize manipulation before panic sets in. The long shadow is cognitive as much as it is physical.

The Only Logical Response

Hybrid tactics exploit seams — between civil and military, national and transnational, legal frameworks and societal norms. The path ahead lies in integration: linking intelligence with civil protection, legal systems with innovation, and military deterrence with civic literacy. In other words, European countries must overcome their national silos and build collective defense systems.

The value of these operations lies precisely in their fleeting, ambiguous nature. A drone disappears. A parcel arrives. A jet crosses for seconds. The target may not even know — at least not immediately. In that ambiguity lies the erosion of confidence. Therefore, Europe must reclaim clarity: attribution, consequence, narrative. Without it, the long shadow becomes a haze.

The propaganda machine — strongly confirmed by officials such as Sergey Lavrov — will insist this is exaggerated, that there is no intent in these violations, or that they never happened at all. These claims will find their amplifiers among local skeptics and propagandists. Russia will say: “Don’t exaggerate.” Local skeptics will say: “Our government is hysterical.” The only logical response, actually, is: why fly fighter jets over our heads in the first place?

The cost and impact of these operations may seem low in isolation, yet together they are devastatingly effective. A momentary airspace violation, an incendiary device hidden in headphones, a disinformation campaign that erodes trust — each may fade on its own, but together they form a campaign of attrition. That is the slow-burn game, and Europe must learn how to play it — or the defeat will be disastrous.

In the end, the skies above Lithuania are not simply a regional concern. They mirror a broader reality: Russia’s reach endures, even amid its disastrous battlefield performance in Ukraine. Europe’s defense cannot be only about territory — it must be about resolve. The incursions may be brief, but their shadow is long.

This article is part of the Democracy Navigator project – a strategic response to disinformation and hybrid threats, building democratic resilience. 

About the Author: Jabir Deralla is an award-winning journalist, analyst, and human rights advocate focusing on democracy, disinformation, and hybrid warfare in the Balkans and Europe. Among his works are the book “Ukraine – Years of Heroism” and the co-authored the “Defending Democracy and Human Rights.”

Author’s Note: This article combines verified open-source intelligence, institutional monitoring, and AI-supported research and synthesis (ChatGPT, OpenAI) — demonstrating the responsible use of technology in defending truth against disinformation. The views expressed are those of the author and do not necessarily represent the official positions of CIVIL’s partners or donors.