At a quarter to midnight on Monday, Vilnius International Airport stopped accepting arrivals. The cause was not weather, not a technical fault, and not a drone.

It was balloons.

Lithuanian authorities detected what the airport described as “navigational markers—characteristic of balloons” in airspace where they posed a risk to aircraft. Arrivals were suspended; departures were allowed to resume at 00:55 under safety conditions; the restrictions lifted at 02:45 on Tuesday morning. And the airport named the cause in its own announcement with a directness that European institutions rarely manage.

Why a balloon closes an airport

It sounds absurd until you think about what an aircraft on approach actually is: a large machine descending through a narrow corridor at around 150 knots, with engines that ingest whatever is in front of them and control surfaces that do not tolerate impacts.

A balloon is slow, small on radar, and effectively invisible to the systems built to find aircraft. It cannot be negotiated with, does not squawk, and drifts. Controllers have no way to predict where it will be in ten minutes, and no way to guarantee separation from something they cannot reliably see. The only safe answer, as with drones, is to stop putting aeroplanes into the same volume of sky.

Which is the entire point. A balloon costs almost nothing. Closing an international airport for three hours costs a great deal, and no one has to be blamed for launching weather balloons.

“There has definitely been an uptick”

Hours before the balloons arrived, a senior NATO military official had told TWZ exactly what the alliance is seeing.

That was said after the shoot-down last week of a suspected Russian drone that had crossed into Lithuanian airspace from Belarus, which we covered in NATO Jets Shoot Down a Drone Over Lithuania. A week earlier, Vilnius Airport had gone to alert and NATO had scrambled a Typhoon at what turned out to be a flock of birds.

That sequence is the story, not any single incident. When an airport has been alerted three times in a fortnight, the third alert costs the same whether or not anything hostile is actually up there.

Aviation is where the hybrid campaign lands

Europe has been absorbing Russian hybrid activity for years in forms that rarely make the news: cyber intrusions, sabotage of rail and cable, disinformation. What has changed in 2026 is that a great deal of it now shows up in the air, where it is visible, expensive and impossible to ignore.

In August, German Federal Police defused a drone found inside the secured area at Leipzig/Halle carrying roughly 1.3 pounds of explosives, parked close to a Ukrainian-operated An-124 used to move weapons to Ukraine. Germany blamed Russia. We covered that at the time in Eine Bombendrohne neben Europas Frachtriesen, and the follow-up when Moscow demanded proof.

On 18 September, President Emmanuel Macron ordered the French government to prepare “a plan to protect our critical infrastructure” and the “most sensitive” defence industry and technology sites, specifically against drone and cyber attacks. A day earlier, Polish Prime Minister Donald Tusk had warned parliament that Russia would present such incidents as accidental in order to weaken NATO's willingness to respond.

What NATO is actually doing about it

The alliance's air commander, US Air Force Lieutenant General Jason T. Hinds, who also commands US Air Forces in Europe and US Air Forces Africa, told reporters last week that he has been tasked with implementing two NATO air and missile defence plans. He did not name them and gave no force numbers.

That is the difficulty in miniature. Air defence is built to stop things that are fast, metallic and powered. The current threat is slow, cheap, sometimes made of rubber, and specifically designed to sit below the threshold at which anyone feels able to shoot back. Sweden's military intelligence chief Thomas Nilsson put the escalation question plainly to The Guardian: an armed drone sent into a busy European airport, he said, with consequences for life or critical infrastructure, “I think that is a gamechanger”.

Until then, the response is the one Vilnius used on Monday night. Stop the arrivals. Wait. Reopen at a quarter to three in the morning and count the cost.

A balloon is not a gamechanger. Two hundred of them, over two years, across a dozen airports, might be.

Coverage of an earlier round of balloon incursions that disrupted Lithuanian flights. This footage is from late 2025, not from Monday night: the tactic is not new.

Sources: TWZ, Vilnius Airport, The Guardian, The Associated Press, Bloomberg News, Polish Radio.