European intelligence agencies are scrambling to trace the source of coordinated bomb threats that have paralyzed air travel and rattled public infrastructure, with the Financial Times reporting that the primary lead points toward Russia. The investigation, described as a transnational effort by security services, is examining whether pro-Kremlin activists or state-aligned hacker groups are behind the blitz of false alarms that have targeted 35 flights across the continent in just three days.
The scale and sophistication of the attacks have exposed deep vulnerabilities in Europe’s defenses against hybrid warfare.
35 Flights, 0 Explosives, Near-Total Disruption
The sheer volume of the threats is staggering, yet their actual impact has been measured in disruption, not destruction. Eurocontrol, the European air traffic management organization, provided ANSA with a precise breakdown: 14 flights were targeted on November 6, 14 on November 5, and 7 on November 3. When contextualized against the total volume of European air traffic, the numbers seem almost microscopic—representing just 0.047% of daily flights on the busiest day.
The Financial Times reported that intelligence officials are focusing on the Russian connection due to the “motive, modus operandi, and precedents,” a pattern that echoes past destabilization campaigns attributed to Moscow-linked groups.
FBI Alerts Police to Bomb Threats
As Europe’s intelligence services piece together the digital breadcrumbs, a surprising detail has emerged from Portugal. The radio station Observador reported that in at least three cases, it was the FBI that directly alerted Portuguese police to bomb threats against a Ryanair flight from Lisbon to Rome and two TAP Air Portugal flights to Paris and Copenhagen. In the case of the Ryanair flight, the warning arrived before departure, allowing police to conduct security checks. For the two TAP flights, already in the air, the FBI’s tip-off triggered coordinated responses with French and Danish authorities, who cleared the planes to continue after finding no evidence of a threat.
Portuguese police had initially described the alerts as coming through standard “international police cooperation channels,” but the Observador radio station confirmed the FBI as the direct source of the intelligence. This transatlantic collaboration underscores the global nature of the threat and the critical role of the U.S. in assisting its European allies. Meanwhile, the digital trail of the threats themselves is deliberately complex. The Financial Times noted that the emails were sent from anonymous accounts, with one traced to Colombia.
Russia, North Korea, and the “Hybrid War” Blame Game
While the Russian hypothesis dominates the intelligence investigation, other possibilities remain on the table. The Italian investigation, led by the National Anti-Mafia and Anti-Terrorism Prosecutor’s cyber unit, is focusing on the emails sent to Rome’s Fiumicino and Milan’s Malpensa airports, which were signed by “Male State Fighters,” a name linked to a Russian ultranationalist movement. A Telegram account associated with the group has since denied involvement to the BBC.
The difficulty in pinpointing a culprit is a hallmark of hybrid warfare. As the Vatican News service observed, Europe still lacks an adequate system of response and defense against these blended attacks that straddle the line between cybercrime and political terrorism. The European Union is responding by convening an emergency meeting of security experts next week in Brussels, as announced by Apostolos Tzitzikostas after a visit to Eurocontrol.
“These attacks are not just about causing fear; they are a stress test of our collective resilience. The question is not if Europe can withstand the assault, but how quickly we can build a defense that anticipates the next move.”
— European security analyst, speaking on the nature of hybrid threats
The Human Cost of a Digital Crisis
Beyond the statistics and the geopolitical chess match, the most tangible impact of these threats is on the daily lives of millions.
By exploiting the vulnerabilities of our interconnected world, a small group can trigger a chain reaction of panic, inconvenience, and economic loss.
