On the night of 11–12 October, the cooling-control systems of about 700 retail outlets in France were compromised. France attributes the attack on hundreds of supermarkets to Iran. At the same time, the monitoring and control systems of the refrigeration units at three regional centers of the French Blood Establishment were targeted.
Sabotage, cyberattacks, and the use of intermediaries recruited remotely outline, in Europe, a hybrid threat that is no longer limited to the actions of professional agents. Fires, computer intrusions, pressure at borders, and influence campaigns follow one another, without necessarily sharing the same origin or the same sponsor.
The stakes go beyond the isolated incident. Disinformation, cyberattacks, economic pressure, sabotage, and clandestine actions can form part of a single strategy that combines familiar instruments — espionage, propaganda, the exploitation of social tensions — with technologies and methods of action that extend their reach.
Not all of these episodes have the same source, and they cannot automatically be attributed to the same actor. A Chinese influence campaign, an Iranian cyber sabotage, a recruitment network linked to Russia, and a border crisis involving Morocco are not interchangeable: each calls for a distinct response.
In April 2025, an intrusion into the control system of a dam in Norway made it possible to open a valve, which remained operational for several hours, according to information cited by franceinfo. The episode illustrates how a computer operation can turn into a physical effect without its perpetrators entering the facility.
Since the Russian invasion of Ukraine in February 2022, the European Union Aviation Safety Agency has recorded a significant increase in interference targeting navigation systems. That finding does not, however, authorize attributing every GPS incident in Europe to Russia.
These attacks differ from many campaigns presented as hacktivist: they were not limited to taking websites offline or publishing a claim of responsibility. An intrusion can reach industrial equipment and cause physical damage, with a direct effect on the daily lives of customers, patients, and citizens.
They must not be confused with the physical sabotage attributed to Russia, nor with the full range of destructive operations that Paris attributes to Iran. The degree of attribution, the intended effect, and whether or not a physical action is used vary from one case to another.
On the ground, fires, sabotage, cyberattacks, and disinformation operations have in many cases been linked to networks acting on behalf of Russia. This method of action is not exclusive to Moscow, but European investigations have documented the use of “disposable agents” in operations attributed to Russian services, according to franceinfo.
These recruits — intermediaries, criminals, sympathizers, or people contacted online — act on behalf of another actor, which makes it possible to conceal who is behind the operation. They are called disposable because their sponsors do not have to protect a professional structure or expose their own agents.
Recruitment can begin with an offer on Telegram. The missions range from putting up stickers or gathering information to starting a fire or taking part in a cyberattack. Inexperienced people, paid for a specific task, have been assigned surveillance, reconnaissance, or sabotage missions.
The case marks a transformation of methods: operations that previously required trained personnel can now be delegated remotely. It is no longer always necessary to send a professional agent. A campaign can begin with a fake email, continue with a cyberattack, rely on a network of intermediaries, and end with a fire or a border crisis.
Pressure does not always take a digital form. The mass entry of about 100,000 Moroccans into Ceuta on 30 July is presented as a hybrid threat in the form of instrumentalized irregular migration. Tensions at borders show that a state can be placed under constraint without sabotage or a computer attack.
Other groups specialize in distributed denial-of-service attacks, which overwhelm websites and servers until they are rendered inoperative. Their administrators celebrate these actions as trophies and announce new targets: treatment plants, depots, power grids, or municipal services. The impact on businesses, customers, and citizens matters as much as the intrusion itself.
Sometimes it is enough to interrupt a service, force the deployment of resources, test a response, or convince the public that nothing is secure and that governments are ineffective. A digital vulnerability can produce consequences in the physical world, even if not all groups that claim attacks have that capability.
Faced with this range of threats, responses remain divided. The armed forces prepare for military aggression, the police investigate crimes, the intelligence services seek to anticipate operations, and civilian authorities protect infrastructure and manage emergencies. Operation Eastwood, for its part, made it possible to disconnect more than a hundred servers, carry out searches, and issue international arrest warrants.