Western intelligence agencies are increasingly concerned that Russia could escalate its aggression against NATO members, with potential scenarios ranging from drone attacks and cyber warfare to territorial incursions, according to recent assessments. The heightened alert follows a discreet visit to Moscow by CIA Director John Ratcliffe.
This period marks a tense juncture for the North Atlantic Treaty Organization, as Russian drones have repeatedly probed the defenses of countries along its eastern flank. U.S. officials are reportedly worried that Moscow might attempt to seize NATO territory within weeks of deciding to act. Potential Russian actions could involve significant cyberattacks, armed groups occupying territory, or incursions along NATO's eastern borders.
Russia has already been accused of engaging in a shadow war across Europe through sabotage, cyberattacks, drones, disinformation, and intimidation. These tactics are designed to cause disruption without crossing the threshold that would trigger a direct military response. British spy chief Anne Keast-Butler has warned that the United Kingdom and its allies are operating in a space "between peace and war," with Russian activities spanning "from the seabed to cyberspace."
Drone Incursions and Attacks
Russian drones have been testing European airspace and defenses, prompting numerous scrambles of Western fighter jets. Ukraine recently intercepted a drone that had entered Romanian airspace. The number of fighter jet scrambles over the Baltic region has increased significantly, with Lithuanian President Gitanas Nauseda warning of the possibility of "targeted kinetic operations" against critical infrastructure. Russian opposition politician Garry Kasparov suggested that Putin might attempt small incursions using drones, driven by a need for a "winning narrative" not currently offered by the war in Ukraine.
Lithuania's defense minister has cautioned that Moscow could use captured Ukrainian drones in a false-flag attack against Baltic infrastructure. Germany has also experienced unexplained drone incidents, including one at Leipzig-Halle airport, a significant NATO military logistics hub. Researchers suggest such incidents could be intended to send a message of deterrence, encouraging countries to focus on their own national interests.
Sabotage and Hybrid Warfare
In recent weeks, Russia has reportedly launched a new wave of attacks targeting European defense manufacturers, employing local criminals for sabotage. These attacks are believed to be carefully calibrated to avoid triggering Article 5 of the NATO mutual defense clause. Latvia detained three of its nationals over a suspected arson attack on a drone manufacturer supplying Ukraine. Explosions have also occurred at arms manufacturers in Italy and Bulgaria, and a Czech plant making drones and thermal optics for Ukraine was targeted earlier this year. In Britain, a factory and warehouse complex belonging to a Ukrainian business leader was set on fire, with police linking the ringleader to individuals associated with the Russian Wagner Group.
European intelligence officials have warned about an increase in hybrid warfare operations, including infrastructure sabotage and false-flag attacks. Since Russia's full-scale invasion of Ukraine in 2022, Moscow has been linked to numerous acts of sabotage, arson, and disruption across Europe. Teenagers across Europe have reportedly been recruited through messaging apps to conduct sabotage for payment. Germany is investigating a suspected Russian intelligence weapons cache discovered near Berlin.
Cyber Warfare and Undersea Infrastructure
European countries have faced a growing campaign of cyberattacks, disinformation, and digital disruption orchestrated by Russia. A European diplomat noted that while a direct military assault might be unlikely due to the ongoing conflict in Ukraine, "there is room for other types of escalation" through hybrid warfare tactics. Cyber units have targeted critical systems, including power plants. The 2022 cyberattack against the Viasat satellite internet system, which caused outages across central and eastern Europe, was condemned by the EU, U.S., and UK as Russian.
Russia has also been accused of using electronic warfare to interfere with civilian communications and navigation. Nordic and Baltic countries have reported increased GPS jamming and spoofing since 2022, affecting civilian aviation and maritime traffic. The Kremlin has claimed GPS interference is a defensive measure, but Baltic officials dispute this, citing incidents far from Russia's borders.
The destruction of sections of the Nord Stream pipelines in 2022 highlighted the vulnerability of Europe's seabed infrastructure. Since then, several incidents involving undersea cables and pipelines in the Baltic Sea have raised concerns about Russian activity. The Balticconnector gas pipeline between Finland and Estonia was ruptured, as were fiber-optic internet cables connecting Finland with Germany and Sweden with Lithuania's network. The Estlink two power cable between Finland and Estonia was also cut, along with nearby telecommunication cables. This pattern has alarmed regional governments, given the crucial role of undersea infrastructure in Europe's energy and communications.