An escalating dirty-tricks campaign has rattled Europe this week, leaving government officials and company executives convinced a barrage of bomb threats and cyberattacks is coordinated. The thing they can’t figure out: Who is behind it?

It started on Monday with supermarkets tossing out bags of meatballs and mozzarella after hackers gained access to freezers, turned their temperatures as high as 120 degrees and spoiled mounds of produce. The next day a wave of bomb threats landed in the email inboxes of airports and airlines across the continent.

By Friday evening, the week had seen hackers access refrigerators at blood banks in France, 50 flights affected by claims of explosives on board, and similar bomb hoaxes sent to media groups, including Britain’s Sky News. Several media outlets in Ireland evacuated newsrooms, some suspending live programming as staff exited buildings.

“It’s a disgraceful attack on the media, on free media, and unfortunately, probably where it comes from, they don’t really appreciate the importance of free media,” said Kevin Bakhurst, head of Ireland’s biggest broadcaster, RTÉ.

So far, no states or groups have credibly claimed responsibility for the disruption, which for the most part, has proven more of an expensive nuisance than a true security threat. Still, the campaign has sent authorities scrambling to identify who is behind it and how to curtail it.

“The most likely conclusion is that we are facing an attempt at hybrid aggression and psychological warfare,” Spain’s foreign minister, José Manuel Albares, said in an interview with a local broadcaster after bomb threats were sent to Madrid Airport.

Publicly, authorities are reluctant to say who they think is responsible and have yet to confirm that the actions even form a single coordinated campaign. Behind the scenes, suspicions are coalescing around Europe’s primary antagonist, which has already denied involvement: Russia.

The denials—from the Kremlin, Russia’s foreign ministry and its embassies in Europe—have done little to soothe the suspicion. Over the past year, European leaders have repeatedly blamed Russia for a string of attacks on European soil. In August, drones carrying explosives were flown into a German cargo airport in Leipzig but failed to detonate.

U.S. intelligence officials have briefed European counterparts that the attack was the first step toward escalating a sabotage campaign against NATO’s European members ordered directly by Russian President Vladimir Putin, The Wall Street Journal has reported.

Since then, Europe has seen an uptick in efforts to sabotage everything from drone factories in Estonia, Poland and Slovakia, to commercial ships in the Black Sea and Starlink stations in Lithuania and Bulgaria.

“It is in some ways easy to create a threat, because with only one email or a phone call, you can create a problem,” said Luis Gallego, chief executive of IAG, which owns airlines including British Airways and Ireland’s Aer Lingus. “I hope that the situation ends soon, but we cannot do anything else than to follow the strict procedures that we have.”A potential clue or a potential red herring: a reference to a Russian fringe ultranationalist group in an email sent to the operator of Rome Fiumicino Airport early on Thursday morning.

It named two flights already en route to the Italian capital: a Finnair aircraft set to arrive from Helsinki and a second from Dublin operated by Aer Lingus. Pilots on the latter were instructed to redirect to a nearby airfield—a military base in the north of France—but when the pilot initially refused, stating a preference to continue to a civilian airport, jet fighters were scrambled to force the diversion, according to French officials.

The email, which started with a simple “Hello,” declared that explosive devices had been placed on both aircraft and would trigger within an hour. “They are heading to your airport,” the email read, according to a person familiar with its contents. “Today your sky will be red.”The message identified as its sender a fringe, ultranationalist group in Russia called the “Male State” that was founded in 2016. Five years later it was banned by a Russian court and designated an extremist organization after being accused of leading harassment campaigns against Russian businesses, including making a string of false bomb threats to a chain of restaurants for featuring a Black model and a rainbow in its marketing.

But founder of the group, Vladislav Pozdnyakov, rejected claims that it was behind the actions causing chaos in Europe this week and said the organization was disbanded after the 2021 court ruling.

“Someone is using this brand for their own malicious purposes,” Pozdnyakov said when reached by the Journal.

An email sent to Ireland’s media outlets claimed to be from the same organization responsible for the bomb threats. It arrived with the subject line: “MESSAGE TO THE WEST,” according to local media reports, and gave the Irish news outlets 45 minutes to leave buildings. “The clock is ticking,” the message ended.

The frequency and geographical scope of the disruption campaign have unnerved a continent already on edge over the wars in Ukraine and Iran, street protests and the Trump administration’s adversarial approach to the region.

“To have this in a coordinated way, I don’t think we’ve seen before,” Air France-KLM chief executive, Ben Smith, said of the bomb threats. “It’s unfortunate and we hope it won’t give consumers any reason to slow down or reduce their travel plans.”For investigating authorities, getting to the bottom of who pressed send on a hoax email could be nigh impossible, not least because of the tendency for copycats to emerge and exacerbate the disruption. It is what makes the threats this week all the more painful: The resources required to find the culprit behind a bomb hoax far exceed what it costs to send one.

“It’s quite easy to disrupt the Western world by simple means,” Peter Nilsson, head of the EU’s aviation security agency, Airpol, said in an interview. “There’s always speculation about the Russians but we don’t have anything that we can say it is. Your guess is as good as mine.”