When mysterious drones began appearing over oil rigs and wind farms off Norway’s coast about three years ago, officials were not certain where they came from.

But “we knew what they were doing”, Stale Ulriksen, a researcher at the Royal Norwegian Naval Academy, said in a recent interview. “Some of it was espionage, where they are charting a lot of things. Some of it, I think, was positioning in case of a war or a deep crisis.”

The drones were suspected of being launched from Russian-controlled ships in the North Sea, Ulriksen said, including some ships that were near underwater energy pipelines. Norway could not do much to stop them, he added, given that they were flying over international waters.

In recent weeks, reports of drone swarms over the US’s East Coast have brought fears of hybrid warfare to widespread attention. Only 100 out of 5,000 drone sightings there required further examination, US officials said, and so far none are believed to have been foreign surveillance drones. But it is a different story for the drones spotted in late November and early December over military bases in England and Germany where American forces are stationed.

Military analysts have concluded those drones may have been on a state-sponsored surveillance mission, according to one US official familiar with the incidents, who spoke on the condition of anonymity to discuss an open investigation. British and German defence officials declined to discuss details of the sightings.

Experts said the drones’ presence was indicative of a so-called hybrid or “grey zone” attack against the West, where a range of tactics — military, cyber, economic and even psychological — are used to covertly attack or destabilise an enemy.

As Russia, Iran and other hostile states become increasingly brazen in their hybrid attacks on Western countries — such as the hacking of sensitive computer systems and alleged assassination plots — defence officials face a thorny challenge. How to deter such acts without touching off a broader and potentially deadly conflict? And how to assign blame against the attacker when the strikes are designed to evade culpability?

Hybrid attacks are not new, but they have escalated in recent years.

One of the most visible and potentially deadly incidents came in July when a series of packages exploded in Europe. Postmarked from Lithuania, the parcels contained electric massage machines with a highly flammable magnesium-based substance inside. Two exploded in DHL cargo facilities in Britain and Germany, and the third in a Polish courier firm.

Western officials and Polish investigators said they believed the packages were a test run by Russia’s military intelligence agency to plant explosives on cargo planes bound for the US and Canada.

“We are telling our allies that it’s not random; it’s part of military operations,” Kestutis Budrys, Lithuania’s foreign minister, said of the explosions. “We need to neutralise and stop it at the source, and the source is Russia’s military intelligence.” Russia denies being behind acts of sabotage.

Other examples of hybrid tactics include cyberattacks on Albania in the past several years, which an investigation by Microsoft concluded were sponsored by Iran, and Russia’s unsuccessful attempt to sway presidential elections using disinformation in Moldova in October and November, according to Moldovan and European officials. European countries are also investigating whether a number of ships intentionally cut underwater cables in recent months in an attempted attack.

While China, Iran and North Korea have shown a growing appetite for hybrid attacks, officials said that Russia in particular has deployed them as covert sabotage against Nato allies since the Kremlin’s full-scale invasion of Ukraine in 2022.

“Russia has stepped it up across the board, and as a result, it is reaching levels that are of growing concern,” James Appathurai, a Nato deputy assistant secretary-general who oversees hybrid warfare strategy, said in an interview. “They are willing to accept more risk to us, to the safety of our citizens’ lives.”

Britain, Germany, the US and Baltic and Nordic countries close to Russia’s border are among the Western countries most targeted by hybrid threats, in part because of their prominent support for Ukraine, officials said. Last year, according to Western officials, American and Nato intelligence agencies uncovered a Russian plot to kill the chief executive of a German weapons giant, Rheinmetall, which has built millions of dollars worth of arms and ammunition for Ukraine.

Russia has repeatedly denied launching hybrid attacks against Nato, in many cases ridiculing the accusations, even though Nato officials say Moscow has set up a special directorate focused on carrying them out.

Russian officials also say they are the ones being targeted. “What is going on in Ukraine is that some people call it hybrid war,” Russia’s foreign minister, Sergey V. Lavrov, said in an interview with Tucker Carlson in early December. “I would call it hybrid war as well.”

New York Times News Service