On a recent September afternoon, David Petraeus, the former CIA director, was heading home by train from a security conference in Kyiv. What should have been a routine trip into Poland was upended when the state railway, Ukrzaliznytsia, ordered passengers off the train. Fifteen minutes later, Russian drones were heard overhead, and the train was struck shortly after the last passengers had been evacuated.

The attack is just one of the indications that Russia’s decades-long campaign against the West has outgrown the label of “hybrid war.” While Moscow’s efforts remain below the threshold of open war, they have grown more brazen and kinetic. And while European allies are moving quickly to counter Russia’s escalation, the United States lags behind.

The past few months have seen a striking number of Russian operations against Europe and a sharp change in tactics towards the United States. In August, a Russian drone carrying explosives struck the wing of a Ukrainian cargo plane at Germany’s Leipzig airport, a hub for NATO airlift to the eastern flank; the attack only failed due to a faulty detonator. That was just the most recent incursion into alliance airspace by Russian drones and even jets; IISS has tracked more than 100 confirmed or suspected incursions, including an explosive-laden drone shot down over Lithuania to a drone that struck an apartment building in Romania. 

Of the train incident, Ukrzaliznytsia officials have said it was “entirely possible” that the drone had missed its intended target: a diplomatic train carrying two former prime ministers, Sweden’s Carl Bildt and the UK’s Boris Johnson, which had departed from Kyiv earlier than planned. Whether Petraeus was the intended target is irrelevant. The strike was a close call; injuring or killing a former U.S. official would have marked a sharp and reckless escalation in U.S.-Russian relations. This incident nevertheless reflects the Kremlin’s growing comfort with operations that put senior U.S. figures at risk. 

Just days after that, the U.S. Justice Department announced a striking indictment that underscored how far the Kremlin’s escalation against the United States has gone. It charged five people connected to Russian intelligence with conspiracy to finance terrorism, and three of them with conspiracy to commit murder for hire. The network allegedly recruited people inside the United States to surveil and ultimately “eliminate” or “disappear” critics of Russia’s war in Ukraine. In one alleged plot, the network sought to have a Russian dissident killed on U.S. soil. Dozens of such plots have been uncovered in Europe but they have remained rare in the United States. This one places Russia alongside Iran, which has repeatedly plotted to kidnap or kill dissidents and former officials on American soil

Analysts have long believed that the Kremlin has sought to maintain deniability, plausible or implausible, when it moves against the West. Plausible deniability refers to a state’s ability to disclaim responsibility because the evidence is too ambiguous to act upon; implausible deniability refers to a state’s denial when attribution is obvious, often a way to signal with only a veneer of “escalation control” or aimed at its domestic audiences such as Russian-speaking communities rather than the targeted government. Yet the bold, sometimes sloppy character of the past year’s operations suggests the Kremlin is increasingly willing to forgo even that to continue to intimidate foreign governments and their citizens and to gather military intelligence. As the war in Ukraine has dragged on, economic pressure on the Kremlin has mounted, and Moscow appears to have entered a new phase in its conflict with the West. Raising the costs of Western support outweighs the value of deniability. At that point, these are no longer hybrid operations, but overt external operations.

European allies, for their part, have begun to escalate their own responses, even as diplomats and officials continue to describe the Russian threat as hybrid. Rather than simply announcing when a Russian drone or ship enters NATO territory, or summoning Russian diplomats, governments across Europe have begun shooting down drones and responding militarily. In late September, Poland’s Deputy Defense Minister Cezary Tomczyk announced that Polish fighter jets would no longer need visual confirmation from a pilot before downing a Russian drone; radar-based “positive identification” would now suffice.

The United States, by contrast, continues to treat the Russian threat as largely latent. To be fair, Russia’s tactics on the European continent remain more brazen and kinetic than those it employs against the United States. But Washington’s NATO commitments alone make Russia’s campaign against Europe an American concern, and Moscow is now escalating against the United States directly as well. If the pattern observed in Europe holds, its operations against the U.S. will grow only more brazen and openly hostile. While some U.S. agencies may recognize the rising threat, as the DOJ’s unsealing of charges against the Russian network and CIA Director John Ratcliffe’s August visit to Moscow could demonstrate, Washington still remains divided on how to classify it, and much of that division stems from the White House itself. 

Messaging from the White House over the past month alone is mixed. On Sept. 15, Attorney General Todd Blanche stood in the White House Rose Garden to announce charges against a Russian intelligence network accused of plotting to murder a dissident in the Washington area. Eight days later, the administration invited Vladimir Putin to the G20 summit in Miami. The same month, President Trump signed the most significant Russia sanctions legislation since 2017, only for his administration to reportedly weigh sanctions relief days later. 

The administration may view engagement with Russia as necessary to broker an end to the war in Ukraine, but these mixed signals leave agencies without a clear mandate and Russia without a clear message to de-escalate. Treating the Russian threat for what it is requires messaging from the top. A plot by Russian intelligence to commit murder on U.S. soil is a significant escalation, and it demands a clear response. Until Washington decides how it should view the threat from Russia, and respond accordingly, Moscow will continue to escalate until it finds a red line. 

This commentary is published in coordination with the 2026 Global Security Forum, of which Defense One is a media partner.

Nikkie Lyubarsky is a Research Associate at The Soufan Center. 

]]>

The U.S. military recently completed its withdrawals from Iraq and Syria, ending a decade of leadership in the counterterrorism fight against the Islamic State in the Levant. The gradual drawdown was meant to avoid a sudden vacuum that proxy militias, malign regional actors, terrorist organizations, and great-power rivals could fill, as happened in Iraq and Afghanistan. Yet ISIS, while greatly reduced, persists in Iraq and Syria, which must now build a sustained regional counterterrorism effort to prevent the group’s resurgence. 

The absence of an American footprint in the two countries reduces cost and risks to personnel, but it also diminishes visibility into ISIS networks, undermines security relationships, and eliminates a forward position from which Washington could detect and disrupt terrorist threats before they affect U.S. interests and foreign partners.

While ISIS has mounted fewer attacks in Iraq and Syria since 2025, this is evidence not of diminished capacity but of strategic recalibration. In Syria, ISIS has been busy diversifying its targets and methods. In June alone, ISIS attacked oil tankers, commercial trucks, security checkpoints, military regional headquarters, political figures, judges, and buses ferrying personnel from the Ministry of Defense. In July, a bomb killed 10 people at a Damascus café frequented by officials working in the Justice Palace. Two more bombs exploded during President Macron of France’s first state visit, killing 10 and 18 people near the Four Seasons Hotel and Ministry of Tourism respectively.

Counterterrorism infrastructure, never perfect to begin with, can erode quickly after American forces leave. This has been seen in the dissolution of the Counter-ISIS mission and the emptying of ISIS detention camps like Al Hol and Al Roj. It has also been seen in the region’s prisons. As ISIS has lost operational capacity and territory, the group has turned to prison breaks as a strategic imperative, undertaking campaigns like the “Breaking the Walls” Campaign of 2012-13 in Iraq to replenish its ranks.

The threat is acute in Iraq, which took in 5,700 ISIS-affiliated prisoners—not only Iraqis and Syrians, but residents of 61 other countries—after the SDF’s January collapse in northeast Syria. It put them in prisons that were already overcrowded and under-resourced, and accepted responsibility for their detention, interrogation, and trial. The U.S. presence had helped encourage the humane treatment of prisoners and fair trials for those charged with terror crimes, reducing ISIS’ ability to use the prisons for recruiting, networking and organizing. Now, the troops have departed amid real concerns about backsliding.

In Syria, concerns remain about whether Syrian forces can integrate effectively and quickly to sustain ISIS’ defeat, in the face of recent incidents like ISIS infiltration into the Syrian Army and recent high-profile plots and attacks beyond ISIS’ traditional area of operations. Syrian prisons have also been targeted for breakouts, including ISIS’ 2022 attack on Al Sinaa prison and a January attempt at the Shaddadi detention facility. 

Throughout the fight against terrorist organizations in Iraq and Syria, American personnel provided intelligence, surveillance, reconnaissance, airpower, special operations capacity, logistics, and local partnerships to local forces. This allowed the U.S. and its partners to monitor and disrupt groups like the Islamic State and defeat its territorial caliphate, while also giving Washington on-the-ground insight into terrorist organizations’ rapidly evolving tactics, as well as local political and security dynamics. 

Absent these resources, it is likely the number and severity of ISIS plots and attacks will increase. Washington, its partners, and the Iraqi and Syrian governments must find creative ways to fill the security gaps. Syrian and Iraqi neighbors—Jordan, Türkiye, Lebanon, and other regional players—must begin forging close relationships with Damascus and Baghdad. Without these relationships, the region risks losing years of counterterrorism progress—and the U.S. may be forced to intercede once again.

This commentary is published in coordination with the 2026 Global Security Forum, of which Defense One is a media partner.

Caroline D. Rose is a Senior Director at the New York City-based Soufan Center, a nonpartisan research institution, where she conducts research on the crime-terror nexus, security, counterterrorism, and U.S. defense policy with a focus on Iraq and Syria. She is a Senior Nonresident Fellow at both the New Lines Institute and Orion Policy Institute, both where she writes about trends in terrorism and geopolitics.

Dr. Julie Chernov Hwang is an Associate Professor of Political Science and International Relations at Goucher College. She is a Senior Research Fellow at the Soufan Center & a Harry Frank Guggenheim Distinguished Scholar with over a decade researching terrorist behavior, notably social networks, radicalization, commitment, role assignment, disengagement, rehabilitation, reintegration, repatriation, and deradicalization.

]]>