France Prepares for Russian Hybrid War as Macron Orders Infrastructure Defence

That shift matters because the incidents now being cited are increasingly physical. Energy infrastructure, airports, defence factories, transport networks and unmanned-systems manufacturers have become part of the security picture alongside computer networks and information campaigns.

From intelligence concern to the home front

Macron’s meeting with the leaders of France’s main political parties at the Élysée Palace on September 18 marked an unusually public treatment of the threat. He warned that “no one is safe” and ordered the government to develop measures covering critical infrastructure and the defence industrial and technological base.

Nuñez followed with an unusually direct assessment on BFMTV-RMC, saying European intelligence services broadly agreed that Russia’s covert activity was escalating.

The reaction from Éric Ciotti, mayor of Nice, exposed the political difficulty that accompanies the change. Ciotti dismissed the warnings as political communication and argued that there were no fundamentally new elements compared with the past.

That disagreement is itself part of the security problem.

A government can quietly increase intelligence monitoring of suspected Russian activity. It is much harder to persuade local authorities, private companies and the public to accept the costs of permanent protection against a threat whose individual operations are designed to remain ambiguous.

The incidents cited by European governments and security researchers make that ambiguity increasingly difficult to sustain.

In August, an explosive-laden drone was found on a runway near a Ukrainian cargo aircraft at Leipzig-Halle Airport. Berlin attributed the incident to Moscow, while EU officials referred to characteristics of what they described as state terrorism. In September, two separate explosions targeted subsea power cables more than 500 kilometres apart. France has also pointed to a missile incident near a Danish naval frigate and a drone attack on a passenger and cargo train travelling between Kyiv and Warsaw.

Over the weekend before Nuñez's statement, unidentified drone swarms and overflights were reported near several major European airport hubs.

None of these incidents, taken alone, necessarily amounts to an act of war. Together, they change the environment in which European governments have to make security decisions.

The physicalisation of the shadow war

The evolution is visible over several years.

In 2024, the pattern was dominated by cyber operations and political interference. A Russian-linked campaign on TikTok was associated with interference in Romania’s presidential election, while the Sandworm/APT44 group carried out major cyberattacks against German power-grid systems.

By 2025, physical sabotage had become more prominent. Arson targeted WB Electronics in Poland, a drone manufacturer supplying Ukrainian forces. Sabotage hit German munitions producer Diehl Metall, while BAE Systems facilities in Wales were also targeted by arson. In Norway, pro-Russian hacktivists breached software controlling a hydroelectric dam.

Poland's criminal investigations offer another indication of the changing scale. Authorities opened 67 cases under Article 130 of the country's Penal Code for foreign espionage and state-sponsored sabotage in 2025. Prosecutor Przemysław Nowak said more than 40 additional espionage and sabotage investigations had begun in the first eight months of 2026.

The geography has widened further this year. Attempts to set fire to the plants of Ukrainian drone developer Skyeton in Slovakia and Milrem Robotics in Estonia occurred in August. The targets were not simply government buildings or military formations. They were industrial facilities embedded in Europe's defence supply chain.

That distinction is important.

The vulnerability of a defence factory can affect military production without a single soldier crossing a border. A disruption to a power cable can impose costs without destroying a power station. An attack on a logistics route can interfere with support for Ukraine without directly confronting a NATO military unit.

The advantage for the attacker is obvious: the economic and political consequences can be disproportionate to the resources required to cause them.

A war below the threshold

The strategy described by the French government and European security assessments is built around precisely that imbalance.

Proxy operatives, cyber groups, criminal recruits and other intermediaries can provide distance between a state and an individual act of sabotage. Since the operation does not necessarily present the clear signature of an armed attack, governments are left with a difficult attribution and response problem.

That helps keep activity below the threshold associated with NATO's collective-defence mechanism.

The objective, according to the briefing, is not necessarily to destroy European infrastructure outright. It is to make supporting Ukraine more expensive, complicate defence production and force governments to devote resources to protecting their own territory.

The resulting pressure is cumulative.

European governments must secure airports, energy networks and factories while continuing to finance conventional military capabilities. Companies must invest in cybersecurity, physical security and resilience. Intelligence services require more personnel and broader investigative capacity. Local authorities are drawn deeper into national security planning.

The cost is therefore distributed across the economy rather than concentrated on the attacker.

This is why France's response extends beyond conventional policing. Macron has ordered government agencies, regional prefects and local authorities to strengthen protection of power grids, transport nodes, water facilities and defence production sites. France is also increasing resources for Viginum, the agency established to counter foreign digital manipulation and influence operations.

The same logic is reaching international energy policy. Paris plans to convene an extraordinary G7 Energy Ministerial meeting in the coming weeks, with protection of critical energy infrastructure expected to be a central issue.

Europe’s security boundary is moving inward

For decades, European defence policy rested on a broad distinction between external military threats and internal security. Armies dealt with hostile states; police and intelligence services dealt with espionage, terrorism and criminal activity.

Hybrid warfare makes that separation increasingly difficult to maintain.

A power grid can be attacked without a conventional military strike. A defence manufacturer can become a battlefield without a frontline. A civilian airport can become a target because it handles military logistics. A commercial transport network can be disrupted in ways that have strategic consequences.

That is forcing the private sector into a role traditionally reserved for the state.

Energy companies, logistics operators, manufacturers and transport firms are becoming part of the defensive architecture. European cybersecurity rules, including the implementation of NIS2 requirements, are already pushing critical entities towards stronger security standards. The new French initiative would add a more explicit physical-security dimension.

There is an economic trade-off that governments cannot avoid. Permanent readiness means more guards, surveillance, resilient infrastructure, cybersecurity systems, counter-drone capabilities and contingency planning. For infrastructure operators, those costs can translate into higher insurance, compliance and operating expenses.

For defence manufacturers, the stakes are even higher. The same companies Europe needs to expand production for Ukraine and its own armed forces are themselves potential targets.

The political vulnerability

The most difficult part may not be technological.

European governments can purchase counter-drone systems and reinforce substations. They can expand intelligence budgets and improve protection around factories. What they cannot easily manufacture is political consensus over a threat that operates precisely by creating uncertainty about its scale and attribution.

That is where the dispute between Nuñez and Ciotti becomes more significant than a domestic French disagreement.

If every unexplained incident is treated as evidence of Russian action, governments risk undermining their own credibility. If clearly documented cases of sabotage are dismissed as routine espionage or political theatre, governments may find themselves responding only after infrastructure has been damaged.

The challenge is to maintain a credible distinction between the two.

For Moscow, ambiguity can itself be an operational advantage. For European governments, it creates a policy dilemma: how to build resilience against a sustained campaign without treating every disruption as an act of war.

France is now choosing to build that resilience before the boundary between domestic security and military defence becomes even harder to define. The significance of Macron’s order is therefore less about any single drone or cyberattack than about the infrastructure of European life being incorporated into the strategic contest itself.