It was almost midnight on a warm August evening when a bus driver at one of Europe's busiest cargo airports noticed what appeared to be drone debris next to a large Ukrainian aircraft.
The driver, ferrying pilots on the night shift at Leipzig Airport, in Germany's east, parked his bus and tentatively approached the wreckage, poking at pieces with his foot.
He was unaware a vegetable soup can among the debris was packed with 600 grams of Semtex explosive — enough to unleash a fireball capable of obliterating everything within 10 metres.
When airport police arrived 30 minutes later, officers discovered two more drones carrying over a kilogram of high-powered explosives.
CCTV footage later revealed the explosive-laden drones had flown directly into the wing of the Ukrainian Antonov aircraft, which had just been filled with 25,000 litres of jet fuel.
For some reason, the payload failed to detonate.
Officials say if the plot to blow up the freshly refuelled plane had succeeded, dozens of people could have died.
It quickly became obvious to German intelligence Russia was behind the attack, marking an escalation in its hybrid warfare against NATO member states.
Moscow's tactics are deliberately varied: threatening drone incursions over restricted airspace, cyber-attacks on state infrastructure, and the physical sabotage of undersea data cables and oil pipelines, to name but a few.
While exact numbers are hard to quantify, European intelligence officials say Moscow has launched at least 200 hybrid attacks in 2026, though NATO suspects the true number is much higher and doesn't include hundreds of attempted cyber attacks and multiple fires across Europe.
"We have seen a significant intensification of these hybrid attacks regarding numbers and regarding the escalation of violence," said Colonel Johan Schmid, a senior ranking member of the German armed forces and a leading global authority on Russia's hybrid aggression.
"By attacking Germany and other nations within NATO, Russia is implementing a price on us, on the West, for its support towards Ukraine."
Colonel Schmid, who has held senior roles within NATO and spent 16 years warning of Moscow's covert operations, told the ABC many countries remained unprepared for hybrid attacks.
"From 2014 to the time of Russia's full-scale invasion of Ukraine, hybrid warfare wasn't taken seriously enough," he said.
"It took the military escalation by Russia in Ukraine to really wake everyone up."
He added that the war in Ukraine proved Moscow does not separate hybrid tactics from conventional military methods.
"For eight years leading up to the full-scale invasion, plausible deniability was the core element of Russia's approach towards Ukraine, working via proxy actors in conjunction with more robust military interventions," Colonel Schmid said.
While Colonel Schmid believes Russia views its hybrid campaign as equal in importance to its conventional battlefield efforts, NATO categorises them separately.
Under current NATO agreement, a Russian-sponsored hybrid attack that kills civilians or military personnel in an NATO country would likely trigger Article 4 of the alliance, which calls for emergency consultation rather than collective military action.
Article 4 was triggered twice last year in response to Russian hybrid aggression, and both times Moscow dismissed it.
Some European spy senior officials believe the Kremlin welcomes Article 4 invocations as evidence that its shadow war is working, because the threshold to trigger Article 5 — a unified military counter-attack — remains ambiguous by NATO's own admission.
Poland's Prime Minister, Donald Tusk, has previously noted Russia uses these hybrid attacks to intimidate and show that Article 5 is "more theoretical than practical".
While the Kremlin has began hybrid attacks across Poland, Luxembourg, and the Baltic states, Germany has emerged as one of its primary targets, with attacks in the country growing increasingly brazen.
"Russia has shifted to open aggression on German soil," Konstantin von Notz, a German MP who is also deputy chair of the country's parliamentary intelligence committee, told the ABC.
"Germany, as a very important country of the European Union and one of the most important supporters of Ukraine, is a major target for Russian hybrid aggression."
While Moscow likely views Germany as Ukraine's European ally, analysts believe the Kremlin also sees the nation as uniquely vulnerable.
Following the atrocities committed by the Schutzstaffel or SS — a prominent and depraved Nazi paramilitary unit that reported to Adolf Hitler — during World War II, subsequent constitutional reforms stripped Germany's intelligence agencies of centralised power.
While seen as a safeguard at the time, it has left the country's contemporary spy network fractured, legally barred from making arrests or even questioning suspected foreign operatives.
Mr von Notz has long opposed expanding German intelligence powers, but Moscow's aggression has made him warm to the idea.
"The German special police took part in the Holocaust, so [the separation of powers] is a very important part of our constitution," he said.
"But in a time where we have such relevant threats from the inside and from the outside, from countries that are not democracies, I think we have to be more robust."
The parliamentary committee Mr von Notz co-chairs has documented attacks on the national rail network, drone incursions over military facilities, an assignation plot, and a surge in Russian-led disinformation campaigns.
However, it was the near-miss in Leipzig that prompted German politicians to demand a beefing up of national defences.
"In Leipzig, you had drones carrying bombs that flew into a fuelled aeroplane, and by pure accident, the drones didn't explode," Mr von Notz said.
"That's an airport where not only cargo planes are flying; that's an airport where everyday people are flying on holidays to Mallorca. This is a tough fact we have to confront here in Germany."
Following the failed Leipzig attack, Germany shut down a Russian embassy outpost in Bonn and a Moscow-funded "cultural centre" in Berlin, which officials once described as merely a cover for espionage agents.
German authorities claim to have identified the main culprit behind the Leipzig plot: a Latvia-based Russian spy working for the GRU, Russia's military intelligence arm, who led a team of two lower-level spooks.
All three suspects are alleged to have fled to Russia.
The Kremlin has denied responsibility for the Leipzig attack, routinely claiming its hybrid attacks are either accidental infrastructure failures or a Western conspiracy designed to espouse Russophobia.