U.S. intelligence assesses that Russia could mount a limited attack on a NATO member state at some point between this autumn and 2029.

The assessments describe a range of possible actions running from cyberattacks and sabotage, through unmarked armed groups taking and holding ground, to a small land incursion on the alliance's eastern flank. The Lithuania, Latvia, Estonia and Poland are named as the likeliest targets. Putin's aim would be to force a test of Article 5 of the North Atlantic Treaty and to split the United States from its European allies.

U.S. officials had previously judged that Putin would avoid provoking NATO while his forces remained committed in Ukraine. Ukraine's long-range strikes on Russian oil and commercial infrastructure, together with the collapse in the rate of Russian ground advances, changed that judgement, according to the Journal's account. Officials still rate an actual ground invasion as low probability, rising.

What the reporting establishes

Heather Conley, a senior fellow at the AEI think tank, says the question remains how the United States would respond to a sub-Article 5 attack. She pointed to the 2007 cyberattack on Estonia, which allies handled bilaterally rather than collectively.

NATO spokesperson Colonel Martin O'Donnell said the alliance was "ready to deter and defend as necessary, which we continue to demonstrate".

Robertas Kaunas, Lithuania's defence minister since 11 November 2025, said on LRT Radio on 6 August that Putin needed a new escalation or a new victory, and that the Baltic region and Poland were the closest targets. Rimantas Sinkevičius, who chairs the Seimas committee on national security and defence, said on 14 August that the threat level was unchanged and that the intelligence briefing had caused unnecessary anxiety. Lithuanian troops have guarded the Klaipėda LNG terminal, the LitPol Link and the Kruonis pumped-storage plant since 18 June.

NATO airspace

Romania's defence ministry counted 33 Russian drone incursions into Romanian airspace between February 2022 and 26 July 2026, of which 18 fell in 2026 alone. Debris or intact airframes were recovered on Romanian soil in 16 of those cases. Romanian and allied aircraft scrambled 34 times. More than 100 Russian strikes have landed near the Romanian border since 2022, over 40 of them this year.

A drone crashed onto the roof of an apartment block in Galați on the night of 28 May 2026, lightly injuring two people, the only injuries a drone has caused on NATO territory. Romanian investigators recovered fragments carrying the Cyrillic inscription ГЕРАН-2 and matched the electronic components, navigation system, control modules, engine, structural elements, materials and fuel type to Geran-2 airframes recovered in Romania before. Nicusor Dan announced the finding on 31 May and said it would be shared with NATO allies and the EU. Putin had publicly demanded proof three days earlier.

Romanian radar tracked five more drones near the coast at about 01:00 on 13 August 2026, one of which briefly entered Tulcea county airspace before turning back towards Ukraine. Another was detected at about 09:00 on 12 August.

Moldova, which is not a NATO member and fields no fighter aircraft, recorded 60 Russian and Iranian missiles and drones crossing its airspace over the same period, 21 of them in 2025 and 15 in the first seven months of 2026. Debris landed on Moldovan territory in 28 cases, at least 12 of them carrying explosives. Moldova recalled its ambassador in Moscow on about 10 August 2026 after a drone came down near the Ukrainian border.

Poland has taken the only deaths. A Ukrainian S-300 interceptor came down at Przewodów on 15 November 2022, killing two men at a grain drier. Polish prosecutors concluded in September 2023 that the missile was Ukrainian and out of control.

Russian cruise missiles crossed Polish airspace on 29 December 2023, for about three minutes and roughly 40 km, and on 24 March 2024, for 39 seconds near Oserdów. One crossed again on 30 July 2026 and detonated at Tarnawa-Kolonia in Lublin voivodeship, leaving a crater and no casualties. Donald Tusk said everything indicated it was a Russian missile. Ukrainian foreign minister Andrii Sybiha identified it as a Kh-101. Poland summoned the Russian ambassador on 31 July and did not invoke Article 4.

Polish military counts put 19 drones in Polish airspace between 23:30 on 9 September 2025 and 06:45 the next morning, the figure carried in a joint statement signed by 46 countries at the UN. Marcin Przydacz, foreign affairs adviser to the Polish president, put the number at 21. Polish authorities recovered 16 wrecks by 11 September and 17 by 12 September, from sites as far north as Oleśno. Most were Gerbera decoys built from polystyrene and plywood, carrying no explosive warhead. Allied aircraft shot down between three and four, most of them Royal Netherlands Air Force F-35s, with Polish F-16s also engaging. Italian airborne early warning aircraft, a Belgian A330 tanker and German Patriot batteries supported the response. A house at Wyryki-Wola lost its roof to an AIM-120 fired by a Polish F-16 whose guidance failed and which did not detonate. Tomasz Siemoniak confirmed the finding on 18 September 2025.

A Gerbera fitted with auxiliary fuel tanks was found in a lignite mine at Gałczyce, about 170 km west of Warsaw, on 12 March 2026. Missile fragments were recovered from a private garden at Jarosławiec on 10 April 2026.

The International Institute for Strategic Studies counted 144 drone incidents across 13 European and NATO countries plus Ireland between August 2024 and February 2026, and assessed Russian shadow fleet vessels as the likely launch platforms for part of the series. Volkel air base in the Netherlands, which stores U.S. nuclear weapons, was targeted on at least three separate days in November and December 2025, once by up to 10 drones. Dutch forces opened fire from the ground on 22 November 2025 and brought nothing down.

An academic dataset published in February 2026 counted NATO airspace violations by Russian aircraft, drones and missiles at four in 2022, five in 2023, six in 2024 and 18 in 2025.

Copenhagen Airport closed for about four hours on 22 September 2025 after two or three large drones were seen over it. Aalborg, Billund, Karup, Oslo Gardermoen, Ørland and Brønnøysund followed within a week. Munich Airport closed twice in under 24 hours on 2 and 3 October 2025, affecting about 9,500 passengers. Brussels and Liège closed on 4 November 2025, with more than 50 flights cancelled and 24 diverted. Belgian authorities logged 17 unexplained sightings that month, including at Kleine-Brogel air base and the Doel nuclear plant. No perpetrator has been publicly identified in any of these cases.

Russian fighters over allied territory

Three Russian MiG-31 fighters entered Estonian airspace near Vaindloo island on 19 September 2025 and stayed 12 minutes, flying without flight plans, with transponders switched off and without radio contact. Italian F-35s based at Ämari intercepted them, with Finnish fighters and Swedish Gripens tracking from over the Baltic. Estonia summoned the Russian chargé d'affaires and requested Article 4 consultations. Dmitry Peskov said on 22 September that Estonia had produced no monitoring data.

Estonian forces have recorded more than 40 violations since 2014, peaking at 10 in 2016, with none in 2023 or 2024 and four in 2025. A single Su-30 crossed near Vaindloo for about a minute on 18 March 2026, the only Russian manned violation of Estonian airspace so far this year.

A Russian Su-30 and an Il-78 crossed into Lithuania near Kybartai on 23 October 2025, penetrating about 700 metres for roughly 18 seconds. Spanish Eurofighters on Baltic Air Policing scrambled. Gitanas Nausėda called it a blatant breach of international law. Inga Ruginienė said shooting down violating aircraft was possible but a measure of last resort.

Norway recorded three violations in 2025 after roughly 10 years without one: a Su-24 on 25 April, an L-410 transport on 24 July and a Su-33 on 18 August. Jonas Gahr Støre disclosed them on 23 September 2025 and said they were less serious than the violations against Estonia, Poland and Romania.

A Russian Su-24MR crossed 6.5 km into Polish airspace over the Gulf of Gdańsk on 12 February 2025 and stayed one minute 12 seconds. Two Russian fighters flew through the safety zone of the Petrobaltic drilling platform on 19 September 2025, which the Polish Border Guard logged as a safety-zone violation rather than a territorial one.

Finland publishes suspected violations rather than confirmed counts, which makes an annual series impossible to construct. Finnish authorities logged incidents on 7 February, 23 May, June and July 2025, and near Porkkala on 27 May 2026. Antti Häkkänen confirmed the 2026 investigation.

Scrambles and interceptions

NATO aircraft intercepted Russian aircraft 570 times across Europe in 2022 and well over 300 times in 2023. The 2024 total ran above 400. Allied Air Command has declined to publish precise figures since, citing security. Joint Force Command Brunssum said in August 2026 that scrambles on the eastern flank in July were more than 250 per cent above July 2025, without publishing the baseline.

Lithuania's defence ministry puts out weekly interception counts for the Baltic states, the only granular open series there is. Four alerts between 20 and 26 July 2026 produced two Tu-22M bombers, two Su-35S, one Su-30SM and two Il-20M. Five alerts between 3 and 9 August produced six aircraft, four of them Su-24M. Most flew with transponders off, no flight plan filed and no radio contact. A French Rafale detachment at Šiauliai flew almost 40 alpha scrambles and nearly 70 training scrambles in the four months to 3 August. Italian Eurofighters took over that day and were airborne the same afternoon, intercepting a Baltic Fleet Su-24M, tactical number 02, registration RF-90917. Turkish F-16s hold Ämari.

Dutch F-35s and Polish F-16s made the first NATO kinetic engagement of Russian assets over allied territory on the night of 9 September 2025. Seven more have followed in 11 months.

A Romanian F-16 flying Baltic Air Policing destroyed a drone over a field at Kablaküla in Estonia at 12:14 on 19 May 2026, the first shoot-down over Estonian ground, with the Latvian control and reporting centre running the engagement. A French Rafale killed one with a MICA missile over Bērzgale parish in Latvia on 8 June. A Romanian F-16 took a Shahed-type drone over Buzău county on 24 July, which foreign minister Oana Țoiu said was the first Romania had destroyed inside its own airspace, and two more went down on 25 and 26 July. Italian Eurofighters and Turkish F-16s downed one over Balvi in Latvia on 14 August. A Spanish F/A-18 out of Mihail Kogălniceanu destroyed one over Galați county on 16 August, 17 minutes after detection. It had come in through Moldova rather than straight from Ukraine, and it was the fourth over Romania this year.

Romanian pilots held fire on 13 September 2025, when a drone loitered in their airspace for about 50 minutes, and again on 25 November. Ionuț Moșteanu said they had come very close to shooting the first one down. The population below was the reason given on both occasions. Latvian officials gave the same reason on 7 May 2026, when Brigadier General Egils Leščinskis said the criteria for a safe shot were not met.

No NATO member has fired on a manned Russian aircraft over or near allied territory since 2022. Every allied engagement has been against an uncrewed system.

Ukrainian drones, Russian jamming, a fallen government

Estonian Defence Forces assessed the drone downed on 19 May 2026 as likely of Ukrainian origin. Every other drone shot down over Baltic territory this year has been assessed the same way: Ukrainian long-range strike airframes pushed off course by Russian jamming and spoofing while flying at the Russian oil export terminals at Primorsk and Ust-Luga. Romanian and Polish incidents run the other way. The Galați airframe is the only one in either series tied to a manufacturer by a published technical finding.

A drone hit the chimney of the Auvere power station in Estonia on 25 March 2026, two kilometres from the Russian border, without interrupting transmission. Another came down at Dobročina in Latvia the same day. Finnish authorities recovered a Ukrainian AN-196 near Kouvola on 29 March with its warhead still live and destroyed it where it lay, then found a fourth armed drone at Iitti on 11 April. One detonated at the Rēzekne oil storage facility in Latvia on 7 May, damaging four empty tanks and starting a fire of about 30 square metres. One more went into Lake Drīdzis on 23 May and detonated on contact with the water. Latvian sensors had not registered it crossing the border.

Vilnius Airport suspended flights on 20 May 2026. Trains stopped, supermarkets closed and members of the Seimas went down to a shelter, on what Lithuanian officials called the first air raid alarm since the restoration of independence.

Evika Siliņa demanded her defence minister's resignation on the evening of 10 May 2026, three days after the Rēzekne strike, saying Andris Sprūds had lost her trust and the public's. Sprūds sat for the Progressives, one of her coalition partners. They left the coalition on 14 May and took her majority with them, and she resigned the same day, saying the political leadership of the defence sector had failed to keep its promise of safe skies over the country. Colonel Raivis Melnis holds the defence portfolio in the government the Saeima approved on 28 May under Andris Kulbergs.

Sybiha confirmed the drones were Ukrainian and blamed Russian electronic warfare for the deviations. Petteri Orpo said the same of the Finnish incidents, and Ukraine apologised. Sprūds, before he resigned, said they had probably been launched by Ukraine at targets in Russia and had fallen by accident. Latvian officials would not rule out Russia flying captured Ukrainian drones as a deliberate provocation. Latvia's armed forces said on 14 August only that the drone had entered as a result of Russian electromagnetic warfare.

Deputy Prime Minister of Poland Władysław Kosiniak-Kamysz said on 21 July 2026 that Russia might be planning to use captured Ukrainian drones against NATO states or to stage a false-flag attack, citing U.S. intelligence shared with Poland, and named GPS jamming, sabotage and cyber operations as further possibilities. Radosław Sikorski had said on 9 July that the Russians were planning something again and that Poland had credible information. Poland and the Baltic states began hardening infrastructure against a false-flag drone strike in August 2026.

Nearly 123,000 flights over Baltic airspace were affected by GPS jamming between January and April 2025, with a disruption rate of 27.4 per cent in April, on figures submitted to the ICAO by regional governments. Andreas Holmgren of the Swedish Transport Agency said interference incidents continued to rise.

Article 4

Article 4 of the North Atlantic Treaty has been invoked nine times since 1949. Three came after February 2022: a group invocation by eight states on 24 February 2022, Poland on 10 September 2025 and Estonia, which NATO dates to 23 September. No ally has invoked it in 2026. The Latvian refinery strike of 7 May did not trigger it, nor the Polish missile of 30 July, nor the Romanian shoot-downs of late July, nor the Latvian shoot-down of 14 August. The North Atlantic Council said on 12 August that Russia "bears full responsibility for the airspace violations, which are dangerous and unacceptable" and that they showed "Russia's increasing tolerance for risk". Norway associated itself with the statement.

Operation Eastern Sentry launched on 12 September 2025 with Danish, French, German, Italian, British and Spanish aircraft, an Italian SAMP/T battery in Estonia and a Danish frigate, covering Poland, Romania, Estonia, Latvia and Lithuania. It has no end date. NATO has not published an updated contribution list since the first pledges. Exercise Ramstein Flag ran from 8 to 18 June 2026 as its main training event.

Operation Baltic Sentry launched on 14 January 2025 to protect undersea infrastructure. Lieutenant Commander Tim Pietrack of Allied Maritime Command said on 18 June 2026 that response times to suspicious incidents had come down from 17 hours to one, and that crews had boarded 12 vessels in the first year. Russia answered with naval escorts for its shadow fleet tankers, which Antti Häkkänen described in May 2025 as unprecedented.

Operation Arctic Sentry launched in February 2026 under Joint Force Command Norfolk, with Swedish Gripens around Iceland and Greenland and four German Eurofighters. NATO's Forward Land Forces in Finland began work on 6 June, a Swedish-led battalion of about 600 at Boden, expandable to 1,200, with a multinational staff element at Rovaniemi. BALTOPS 2026 ran from 4 to 20 June with about 20 vessels, 15 nations and 6,000 personnel. The 2025 edition had more than 40 vessels and 9,000 personnel.

Estonia's navy stopped trying to board shadow fleet tankers in the Gulf of Finland in April 2026. Commander Ivo Vark said the risk of military escalation was too high, with a Russian corvette sitting near the idling tanker groups.

Sabotage, cables and the border

Researchers at the ICCT and GLOBSEC counted 151 Russian-linked hybrid incidents in Europe between February 2022 and February 2026: Poland 31, France 20, Lithuania 15, Germany 15, the United Kingdom 12, Estonia 11. Of the 172 individual perpetrators they identified, 11 were under 18 and 14 more were aged between 18 and 21. About 95 per cent had no formal affiliation with Russian intelligence at all, and about half had been recruited outside the country they attacked, mostly from Moldova, Serbia, Bulgaria and increasingly Colombia.

CSIS counted three attacks in 2022, 12 in 2023 and 34 in 2024, leaving out cyber operations and disinformation. Germany's federal criminal police logged 321 suspected sabotage cases against critical infrastructure in 2025, plus 1,289 reports of suspicious drone flights involving 2,310 drones, and put no number on how many were Russian.

Six men were sentenced in London on 23 and 24 October 2025 for the Leyton warehouse arson of 20 March 2024, which did about £1 million of damage to a business supplying Starlink terminals and aid to Ukraine. Dylan Earl had coordinated it for the Wagner Group over Telegram and got 17 years under the National Security Act 2023. Jake Reeves got 12 years for taking material benefit from a foreign intelligence service. The other four got between seven and nine.

Polish prosecutors concluded that the Marywilska 44 market fire in Warsaw on 12 May 2024, which destroyed more than 1,000 shops, was arson ordered by a GRU officer. Poland expelled 45 Russian officials and shut the Russian consulate in Kraków in May 2025. Three Ukrainians were convicted in Warsaw that autumn and got between 16 months and five and a half years. A Prague court gave a 26-year-old Colombian eight years on 9 June 2025 for burning three buses at the Klíčov depot. A Lithuanian court gave Daniil Bardadim, 18, three years and four months on 25 November 2025 for the IKEA arson in Vilnius. He had been offered €10,000 and a BMW to burn shopping centres in Lithuania and Latvia.

A charge of C-4 destroyed track on the Warsaw to Lublin line near Mika at about 21:00 on 16 November 2025, on a route used for aid shipments to Ukraine. Nobody found it until 07:40 the next morning. A metal bracket was wedged into the track at Puławy that evening, and a passenger train carrying 473 people ran into the debris. Tusk called it perhaps the most serious national security situation in Poland since the start of the full-scale war. Poland put 10,000 soldiers on railways and transport hubs on 21 November. Two Ukrainian nationals working for the FSB were named as suspects. Both reached Belarus.

Poland's internal security agency opened 48 espionage investigations in 2025, up 128 per cent on 2024, and charged 82 people with espionage over two years. It had opened 69 in the whole of 1991 to 2023. Estonia's security service made a record 16 arrests in 2025 and secured sentences of between three and six and a half years against eight people working for the FSB or GRU. Lithuanian prosecutors charged six people on 16 January 2026 over a Russian-directed sabotage gang paid €5,000 to €10,000 an action, with targets in Lithuania, Romania, Poland and Czechia. Five defendants went on trial in Vilnius on 17 April over the July 2024 incendiary parcel campaign. Five more are subject to international arrest warrants.

A quadcopter fitted with a release mechanism and two SIM cards struck the wing of a parked Antonov An-124 at Leipzig/Halle airport at about 19:30 on 4 August 2026. It was carrying Semtex in a sealed food container. The detonator did not work, and an airport employee found the payload near the southern runway about four hours later. German federal prosecutors took the case on 6 August. German media reported on 10 August that DNA off the drone matched evidence from the July 2024 DHL incendiary parcel attack at the same airport. Alexander Dobrindt called it a new quality of danger. Two drones were seen over the Bundeswehr base at Mechernich on 7 August.

Polish officers detained a 29-year-old Russian in Warsaw on 7 August 2026, alleged to have taken a contract from Russian intelligence to kill a dual U.S.-Ukrainian citizen. Tomasz Siemoniak confirmed U.S. cooperation. The case was disclosed on 13 August.

The United Kingdom and the European Union jointly attributed the wiper attack on Polish power plants of 29 and 30 December 2025 to the FSB's Centre 16 on 13 July 2026, and designated nine individuals and four entities. British assessments put what it could have done at power cut to about half a million people in winter.

Seven Baltic cable or pipeline incidents since October 2023 have produced no conviction for deliberate sabotage. A Finnish court threw out the case against the Eagle S officers in October 2025 on jurisdiction under the Law of the Sea, after the ship had dragged its anchor about 100 km along the seabed, and prosecutors appealed on 9 October. Swedish prosecutors found the Vezhen breach accidental and let the vessel go. Finnish police seized the Fitburg after the Helsinki to Tallinn cable was cut on 31 December 2025, with 14 crew aboard from Russia, Georgia, Azerbaijan and Kazakhstan, and found the anchor and chain had dragged for at least several tens of kilometres. That investigation continues. EU designations of shadow fleet vessels reached 673 with the 21st sanctions package on 23 July 2026.

Latvian border guards stopped more than 9,000 attempted illegal entries from Belarus in the first seven months of 2026: 1,700 in April, 2,433 in May, 2,263 in June, and 111 in a single day in mid-July. Guards found 15 people coming through an underground tunnel on 10 August. Kulbergs launched Operation Vilkatis the next day. Poland recorded 235 attempted crossings in the first half of 2026, against just under 30,000 in the whole of 2025. Finland's eastern border has been shut since December 2023, and the government confirmed on 4 June 2026 that every crossing point will stay closed.

Russian build up

Russia re-established the Leningrad Military District on 26 February 2024: the 6th Combined Arms Army, the 11th Army Corps in Kaliningrad, the 14th Army Corps in the Northern Fleet, the 44th Army Corps facing Finland and Baltic Fleet formations. The 44th stood up its core units over seven or eight months between autumn 2023 and spring 2024 and has since fought in Kursk oblast, in northern Sumy oblast and at Vovchansk.

A joint Nordic-Baltic investigation published on 10 June 2026 went through satellite imagery and found new or enlarged bases at 19 locations, with room for up to 115,000 troops facing Norway, Finland and the Baltic states. The infrastructure near the Finnish border is being built for about 80,000. Roughly 20,000 are there now. Russia is replacing brigades of about 4,000 with divisions of about 10,000.

A Soviet-era garrison at Rybka near Petrozavodsk, 160 km from the Finnish border, is being restored for the 44th Army Corps with room for about 15,000, against a current Karelian presence of 2,500 to 3,000. Satellite images show the site derelict in June 2024, cleared by April 2025 and holding more than 50 trucks by that October. A new complex at Novaya Vilga will take 4,000 to 6,000 in about 12 barracks blocks, each 65 metres by 24 and three or four storeys. Deputy defence minister Pavel Fradkov inspected it in late May 2026. The 200th Separate Motor Rifle Brigade at Pechenga is now the 71st Motorised Rifle Division, and the 61st Separate Naval Infantry Brigade at Sputnik is due to become a division too.

Finland's military intelligence review of 23 January 2026 said Russia was preparing to strengthen its presence near the Finnish border, that significant changes would likely start when the situation in Ukraine allowed it, and that an immediate military threat to Finland during 2026 was unlikely.

Putin's decree of 13 June 2026 set authorised strength at 1,510,000 servicemen, up from 1,502,640 in March and from the 1,500,000 target signed in September 2024. Nothing independent confirms the figure has been reached. Whisler and Kofman assessed in July that force growth had largely halted through 2025 and 2026 as casualties offset recruitment, with several planned divisions postponed indefinitely and the new formation effort redirected into unmanned systems units.

Janis Kluge, working from federal budget data, counted 71,216 new contracts in the first quarter of 2026, down 20 per cent year on year and the lowest in three years. That is about 800 men a day, against about 1,700 a day in late 2024. Some regions now offer first-year payments of up to 5.5 million roubles. Estonia's foreign intelligence service put Russian killed and severely wounded at about one million as of February 2026. Dutch military intelligence put total losses at about 1.2 million, more than 500,000 of them killed.

Russian artillery ammunition output reached seven million rounds in 2025, more than 17 times the 400,000 produced in 2021, at a procurement cost of about one trillion roubles on Estonian intelligence figures. A 152 mm shell costs under 100,000 roubles to make, about €1,050. Imports from Iran and North Korea since 2023 run to five to seven million rounds, and North Korean ammunition covered about half of Russian artillery expenditure in late 2025. Mark Rutte said in August 2025 that European production had risen sixfold in two years and would reach two million rounds by the end of it, on a narrower count covering artillery ammunition alone.

Ukraine's military intelligence directorate put Geran-4 and Geran-5 production at about 3,000 a month in August 2026. Construction of an expansion at Alabuga started in May. Every airframe depends on a Chinese turbojet engine costing $35,000 to $40,000. Russia launched 8,161 long-range drones and decoys at Ukraine in May 2026, a record 263 a day, and the Institute for Science and International Security assessed on 7 July that the year's plan runs to about 60,000 long-range drones and 50,000 decoys.

Russian missile plants overfulfilled their monthly quotas at 110 to 120 per cent in July 2026, on the same Ukrainian assessment: 87 Kh-101 against a plan of 72, 29 Kalibr against 26, 65 Iskander-M against 60. Vadym Skibitskyi said almost everything fired came straight off the assembly line rather than out of reserves. Kinzhal and Kh-32 production has been stopped since April.

New START expired on 5 February 2026, ending treaty caps on strategic arms for the first time since 1972. The limits had been 1,550 deployed warheads and 700 launchers. Russia holds about 4,400 warheads in its military stockpile, roughly 1,796 of them deployed, on the Bulletin of the Atomic Scientists count for March 2026. Russia declared the Oreshnik on combat duty at Krichev in Belarus on 30 December 2025, on a former airbase about 300 km east of Minsk, and Lukashenko has said up to 10 could be deployed. A joint Russian and Belarusian exercise on 19 and 20 May 2026 put more than 64,000 troops, 200 missile launchers, 140 aircraft, 73 surface ships and 13 submarines through a rehearsal that included handing simulated nuclear munitions to Belarusian units. No Russian nuclear test has been conducted since October 1990.

What allied services assess

Denmark's defence intelligence service published a tiered assessment on 12 February 2025, conditional on the fighting in Ukraine stopping and on NATO failing to rearm: about six months to wage a local war against a neighbour, about two years for a regional war in the Baltic Sea region and about five years for a large-scale war on the European continent without U.S. involvement.

Dutch military intelligence said in its 2025 annual report, published on 21 April 2026, that Russia could generate enough combat power to start a regional conflict against NATO within a year of the Ukraine war ending.

Lithuania's state security department and second investigation department assessed on 6 March 2026 that Russia would need one to two years to be capable of limited military action in the Baltic region if sanctions were lifted, and six to 10 years to prepare for large-scale conflict with NATO.

Johann Wadephul, Germany's foreign minister, said on 26 November 2025 that Russia was creating the option for itself to wage war against NATO by 2029, and that the threat to Germany was no longer a distant concern but already a reality. Boris Pistorius has put the same date at 2029, with some analysts at 2028. Lieutenant General Alexander Sollfrank, who heads Germany's joint operations command, said Russia could launch attacks on NATO territory at any time and that a larger assault could become possible by 2029 if rearmament continued.

General Carsten Breuer, Germany's chief of defence, said in an interview reported on 15 May 2026 that rearmament, personnel numbers and economic and political changes all pointed to 2029 as a possible date for a Russian attack on NATO. Asked whether it could happen earlier, he said yes.

Estonia's foreign intelligence service said on 10 February 2026 that Russia had no intention of militarily attacking Estonia or any other NATO member state in the coming year. Director General Kaupo Rosin said the task was to ensure that remained the case in the years ahead.

General Alexus Grynkewich, the Supreme Allied Commander Europe, told the Financial Times on 11 June 2026 that intelligence showed Russia was not looking for a conflict with the alliance. Nordic intelligence officials quoted in the June 2026 investigation said there was no indication of a decision to attack NATO countries, and identified the next one to three years as the critical window while Europe rebuilds.

U.S. officials repeatedly warned Polish counterparts in the first half of 2026 of possible Russian plans for a conventional attack on the eastern flank, including a limited Russian or Belarusian ground incursion within months, according to reporting of 4 July 2026. Tusk said Poland was preparing intensively for various scenarios and that the coming months could be truly critical. Radosław Sikorski, addressing Putin, said: "We know what you are planning. Don't do it."

What Russia can currently field in Ukraine

Russian forces took 37.85 square kilometres of Ukraine in July 2026, an average of 1.22 square kilometres a day, the Institute for the Study of War assessed on 1 August. Russia took 455.74 square kilometres in July 2025. The independent mapping project DeepState put the July 2026 figure at 36 square kilometres. Russian forces took 30 square kilometres in June 2026 against 481 in June 2025, a sixteenfold drop, with the fight for Kostiantynivka accounting for 77 per cent of the month's gains.

Ukraine's General Staff put Russian losses for July 2026 at 42,860, a monthly high for the year, up from 31,700 in January, with seven-month losses of 238,650. Against the ISW territorial figure that works out at roughly 1,132 casualties for every square kilometre taken, against 68 per square kilometre in June 2025.

A Russian incursion into NATO territory would breach the prohibition on the use of force in Article 2, paragraph 4 of the UN Charter, and would constitute the crime of aggression as defined in Article 8 bis of the Rome Statute. Russia is not a party to the Rome Statute, so the International Criminal Court could reach the crime of aggression only through a UN Security Council referral, which Russia can veto.

Ukraine and the Council of Europe signed the agreement establishing a special tribunal for the crime of aggression against Ukraine in Strasbourg on 25 June 2025. Delegates from 36 countries and the EU adopted the enlarged partial agreement on its management committee in Chișinău on 15 May 2026. The Netherlands reaffirmed on 3 July 2026 that it would host the tribunal at The Hague. No prosecutor or registrar has been appointed, no final budget has been published and the tribunal is not yet working. Its jurisdiction is confined to Ukraine.

NATO leaders agreed at The Hague in June 2025 to spend 5 per cent of GDP on defence by 2035, split between 3.5 per cent core defence and 1.5 per cent defence-related investment. The Ankara summit declaration of 8 July 2026 left the target unchanged, named Russia as the long-term threat to Euro-Atlantic security and recorded a $139 billion increase in defence investment by European allies and Canada in 2025. European allies and Canada combined are forecast to spend 2.53 per cent of their total GDP on defence in 2026, with most allies between 2.0 and 3.0 per cent and 10 of them only slightly above 2.0.

Five allies will exceed the 3.5 per cent core figure in 2026: Lithuania at 5.33 per cent, Estonia at 5.11 per cent, Latvia at 4.92 per cent, Poland at 4.68 per cent and Greece at 3.65 per cent. Latvia votes on 3 October, its first election since a drone brought the government down in May. Five men are in the dock in Vilnius over the parcel bombs of 2024, with five more names on international arrest warrants. Finnish prosecutors are still waiting to hear whether their appeal will revive the Eagle S case, thrown out in October 2025 because the cable the anchor cut lay outside Finland's territorial sea.