Poland, Lithuania, Latvia and Estonia are tightening security around dams, power plants and gas infrastructure over intelligence assessments that Russia may stage a false-flag drone attack to test NATO.
Lithuania said on 6 August that Russia is considering such a staged attack, and the other three governments have warned of sabotage meant to probe the alliance's response. All four states border Russia or its territory at Kaliningrad and have found Ukrainian-made drones on their soil this year. The warnings land while the United States runs a six-month review of its force posture in Europe, and while no ally has called Article 4 consultations at any point in 2026.
Lithuanian Defence Minister Robertas Kaunas said, "We are not naive, we see the information, we read between the lines."
Riot police and military deployments
Lithuania last month sent the military to reinforce riot police at its liquefied natural gas import terminal, an oil products terminal, a power link with Poland and the Kruonis pumped-storage hydro plant. Klaipeda, the LitPol Link substation at Alytus and transformer sites were among the locations given extra guards.
Kaunas described the scenario his ministry regards as most plausible as "a potential false-flag operation where a fake Ukrainian drone could be used". Russia recovers wreckage from Ukrainian long-range drones downed over its own territory, and Lithuanian military intelligence assesses that it can rebuild those components into a working device.
According to Prime Minister Andris Kulbergs, Latvia has increased security around all critical infrastructure, including the dam on the Daugava River near Riga and the Incukalns underground gas storage site.
"A potential hybrid threat is more likely than it was before," Kulbergs said.
Russia accused the Baltic states in May of planning to let Ukrainian drones attack it from their territory and pledged to retaliate, a threat that fed concern a staged attack could follow. Estonia, Latvia and Lithuania issued a joint statement on 10 April rejecting the accusation as part of a Russian disinformation campaign.
False flag
A Baltic intelligence official said assessments indicated Russian military and domestic intelligence agencies are planning a possible false-flag attack on infrastructure in Russia or the Baltics and Poland, using Ukrainian-made drones, within days of approval from leaders including President Vladimir Putin.
Services in the region rate the "political chaos" among NATO members debating a response above the immediate damage as the main concern. The CIA has also warned governments in the region of possible Russian attacks. A European government official quoted in the same report said Russia may be creating the impression of an impending attack to sow fear, and said there were no signs of preparation for a conventional invasion.
Kremlin spokesman Dmitry Peskov said last month that warnings of clandestine Russian attacks were "scare stories" used to justify militarisation against Russia. Russia says the West, out of "Russophobia", accuses it without evidence. NATO and the Russian embassy in Vilnius did not respond to Reuters requests for comment.
Poland's gas routes and forged documents
Orlen, Poland's biggest oil and gas company, is analysing alternative gas import routes in case the usual ones are compromised, a person familiar with its operations.
Orlen imports 80 per cent of Poland's gas through the Swinoujscie LNG terminal on the Baltic Sea and an undersea pipeline from Norway that lands nearby. Gaz-System, which owns the infrastructure, said it is operating under increased vigilance.
Polskie Elektrownie Jadrowe, the state-owned developer of Poland's first nuclear power plant, said forged company documents meant to confuse stakeholders had appeared and could be traced to somewhere "east of Poland". The company is investigating with security services and law enforcement and monitoring the planned construction site for sabotage, spokesman Marcin Skolimowski said.
Poland's power grid operator and an arm of the military began increasing security in July around a power link with Ukraine that helps stabilise the war-hit grid, which Russia has repeatedly attacked.
"This is an area where heightened vigilance is required," said grid operator spokesman Maciej Wapinski.
Prime Minister Donald Tusk said on 29 July 2025 that 32 people had been detained in Poland on suspicion of coordinating with Russia, and that more than 30 faced trial. Poland closed the Russian consulate in Poznan in 2024, the consulate in Krakow in May 2025 after confirming Russian involvement in the fire that destroyed Warsaw's largest shopping centre, and the last remaining consulate in Gdansk on 19 November 2025 after a railway bombing.
Polish services detained a Russian citizen on 7 August, Tusk said on 13 August, over a plot to attack a US citizen of Ukrainian origin on Polish soil. The target "was uncomfortable for the Putin regime", Tusk said, and the operation carried political authorisation.
Drones across Europe
German police recovered a quadcopter carrying roughly 800 grams of Semtex and PETN with a detonator at Leipzig/Halle Airport on 5 August, four hours after it crossed the perimeter fence and struck the wing of a Ukrainian Antonov An-124 loaded for Ukraine. The charge did not go off. An airport bus driver found it.
Interior Minister Alexander Dobrindt said the device represented "a new threat scenario" and that it appeared modified to slip past the airport's installed drone defences. He did not assign blame. The Federal Public Prosecutor's Office is investigating and no arrests have been made. DNA recovered from the drone matched entries in the European database with a trail to Lithuania, and matched material from a July 2024 arson at a DHL logistics centre at the same airport, an attack Lithuanian prosecutors attribute to a network run by Russian citizens tied to military intelligence. German prosecutors have not confirmed the match.
Russia's embassy in Berlin called the incident a "provocation directed against Moscow" and said it would produce a new wave of anti-Russian feeling in Germany. Chancellor Friedrich Merz has avoided naming Russia.
Romanian F-16s shot down drones over national territory on three consecutive days from 24 July, the first such engagements in Romanian airspace, one of them 12 km north-east of Sulina over territorial waters. President Nicusor Dan said it was "inadmissible and intolerable" for Russia to keep violating Romanian airspace.
An object crashed at Tarnawa Kolonia near Lublin at about 04:00 on 30 July, leaving a crater 10 metres wide in a field. Ukrainian Foreign Minister Andrii Sybiha identified it as a Russian Kh-101 cruise missile that had missed its target. Two Polish F-16s, a NATO tanker, a Polish airborne early warning aircraft and a Mi-24 were scrambled. The object left radar before interception.
NATO's council met on 12 August over the Polish and Romanian violations. Secretary General Mark Rutte called the latest incident "yet another reckless act by Russia". Alliance spokesperson Allison Hart said Russia's behaviour showed "increasing tolerance for risk". No ally requested Article 4 consultations, the mechanism Poland used on 10 September 2025 and Estonia on 23 September 2025.
Wojciech Kononczuk, director of the state-funded OSW Centre for Eastern Studies said that Russian claims the Baltics are working for Ukraine may be preparing the ground for attacks there. Russian forces are bogged down in Ukraine and Ukrainian strikes are hurting Russia's economy, and the aim of a staged attack would be to regain the upper hand, Kononczuk said.
Europe absorbs Russian attacks
There have been 145 confirmed cases of sabotage across Europe attributed to Russia or its proxies, in an investigation published in December 2025 drawing on interviews with more than 40 European and NATO officials in 13 countries. Arson and explosive incidents rose from one in 2023 to 26 in 2024. The head of one major European intelligence service said that investigations into Russian interference now take up as much of his agency's time as terrorism.
The Center for Strategic and International Studies counted three Russian attacks in Europe in 2022, 12 in 2023 and 34 in 2024, using a rule that each incident required at least three credible sources and excluding cyber operations without physical effects. Transportation and government targets accounted for 27 per cent each, critical infrastructure and industry for 21 per cent each.
Researchers at the International Centre for Counter-Terrorism in The Hague logged 151 incidents between February 2022 and February 2026, with Poland worst hit at 31, then France at 20, Lithuania and Germany at 15 each, the United Kingdom at 12 and Estonia at 11. They identified 172 perpetrators, 25 of them under 21. Most were recruited through Telegram and paid per task, and the report says the true figure is likely higher.
The International Institute for Strategic Studies documented 144 drone incidents across 13 European states between August 2024 and February 2026, with 48 per cent over military facilities, 26 per cent over critical infrastructure and 18 per cent over civilian airports. Sightings rose from an average of four a month to 22.5 a month between September and December 2025. Germany alone recorded 58. The institute assessed that vessels from Russia's shadow fleet likely served as launch platforms, naming the tanker Boracay, boarded by French commandos in September 2025, and the signals intelligence ship Zhigulevsk.
A total of 11 undersea cables in the Baltic Sea have been damaged since October 2023, according to a Windward risk report published on 3 August. No European court has convicted anyone of sabotage in any of them. Helsinki District Court dismissed charges against the crew of the tanker Eagle S on 3 October 2025, ruling that Finnish criminal law could not be applied to a navigation incident. Swedish prosecutors ruled the Vezhen cable break accidental. Finnish investigators found anchor drag marks running for tens of kilometres after the Fitburg case in December 2025 and released the vessel in January.
Six men were sentenced at the Old Bailey on 23 and 24 October 2025 over a Wagner-ordered arson at a Leyton warehouse holding Starlink equipment for Ukraine, with ringleader Dylan Earl given 17 years. A Vilnius court jailed 18-year-old Daniil Bardadim for three years and four months on 24 November 2025 for the IKEA arson there, an attack for which he had been offered 10,000 euros and a BMW. A Prague court sentenced a Colombian national to eight years on 9 June 2025 for setting three buses alight at a depot.
Thermite devices concealed in massage pillows and cosmetics tubes ignited at logistics centres in Leipzig and Birmingham and in a delivery truck in Poland in July 2024. Lithuanian prosecutors said in September 2025 that the network was run by Russian citizens tied to the GRU, charged 15 people and said the devices were a test run for a plot against cargo aircraft bound for North America. Five men went on trial in Vilnius on 17 April 2026.
A C-4 device detonated under a freight train near Mika on the Warsaw to Lublin line at about 21:00 on 16 November 2025, on a route used for Ukraine aid. A second attack the following evening near Pulawy downed overhead wires as a passenger train carrying 473 people braked hard. Tusk called it "perhaps the most serious national security situation" Poland had faced since the full-scale invasion began. Interpol issued red notices in December for two Ukrainian nationals who fled to Belarus, and Poland put 10,000 soldiers on rail protection duty.
German and US intelligence agencies foiled a Russian plan to assassinate Armin Papperger, chief executive of Rheinmetall, in 2024. NATO later confirmed the plot publicly. It was described at the time as the most advanced of several plans against European defence industry executives supplying Ukraine.
Satellite navigation loss in European airspace rose about 220 per cent between 2021 and 2024 across 18.4 million flights, according to the joint EASA and Eurocontrol action plan published on 26 March 2026. Estonia put the damage from jamming at more than 500,000 euros in three months and said 85 per cent of flights over its territory were affected, with four jammers located between Narva and St Petersburg.
Retired Lieutenant General Ben Hodges, formerly commander of US Army Europe, said that attacks on ports, railways and cables serve to probe the routes NATO would need for reinforcement. Poland's rail network to Lublin and Rzeszow carries most Western supply into Ukraine, and the Suwalki corridor between Belarus and Kaliningrad is the only land route linking Poland to the Baltic states.
NATO's lack of readiness
Pre-delegated authority to open fire remains unsettled across NATO. Allied jets tracked but did not engage a Russian drone that struck Galati in Romania on 28 and 29 May 2026. Romania passed a national law permitting shootdowns before its July engagements. Estonia escorted three MiG-31s out of its airspace in September 2025 rather than firing. Poland shot down drones in September 2025.
General Alexus Grynkewich, Supreme Allied Commander Europe, told the US Senate Armed Services Committee on 12 March 2026 that NATO was rewriting its standing defence plan for integrated air and missile defence for the first time in decades and expected to finish by the summer.
A Patriot round costs more than 3 million dollars. The Merops interceptor drone, which Lithuania bought on 22 April 2026, costs about 15,000 dollars a unit and potentially 10,000 dollars at scale. Ukrainian-built interceptors run at 1,000 to 3,000 dollars. An F-35 costs between 33,000 and 42,000 dollars an hour to fly and an AIM-120 round about 1 million dollars, figures that make fighter interception of cheap airframes unsustainable at volume.
Ursula von der Leyen proposed a European drone defence line in September 2025. EU Defence Commissioner Andrius Kubilius has promised initial capacity by the end of 2026 and full function by the end of 2027, with the wider eastern flank surveillance effort due in 2028. Ulrike Franke, senior policy fellow at the European Council on Foreign Relations, said in July that European counter-drone defences are "largely missing in action". No continuous detection and interception line exists along the 4,000 km eastern border, a Baltic funding request was rejected in March 2026 and the initiative remains a set of national plans rather than fielded hardware. Poland contracted its own 3.5 billion euro counter-drone programme, SAN, in January 2026.
NATO's Baltic Sentry mission, launched on 14 January 2025, cut the time to reach a suspected cable incident from 17 hours to about one, according to Allied Maritime Command, with 12 boardings by allied nations in its first year. Eastern Sentry followed on 12 September 2025 after the Polish drone incursion, and Arctic Sentry on 11 February 2026, leaving three standing vigilance missions drawing on the same pool of ships and aircraft.
The US variable
About 80,000 US troops are stationed in Europe. The Trump administration withdrew 5,000 from Germany in May 2026, leaving roughly 30,000 there, and cancelled a planned armoured brigade rotation to Poland of more than 4,000 soldiers along with a long-range fires battalion. President Donald Trump said the cuts would go further than 5,000.
Grynkewich said on 19 May that Europe should "absolutely" expect more withdrawals as European capacity grows. Defense Secretary Pete Hegseth announced a six-month review of US force posture in Europe at the NATO defence ministerial on 18 June, describing the current arrangement as an "unhealthy codependence". The review began in late July and reports in early 2027.
The FY2026 National Defense Authorization Act sets a floor of 76,000 US personnel in the European command area. The Ankara summit declaration of 8 July 2026 restated Article 5 in wording identical to previous years.
Race against time
Lieutenant General Christian Freuding, head of the German Army, said in June that Russia may have the capability to invade a NATO member in 2029, and that the date is "not a German timeline. It's NATO-agreed intelligence".
Denmark's Defence Intelligence Service assessed in December 2025 that Russia could be able to fight a war against NATO within one to two years of a reduction in the intensity of the fighting in Ukraine, compressing earlier estimates that ran to a decade. The Dutch military intelligence service said on 21 April 2026 that Russia could generate combat power for a regional conflict with NATO within a year of hostilities ending under conditions most favourable to Russia, and that a conventional war is virtually ruled out while the fighting continues. It put Russian permanent personnel losses since 2022 at 1.2 million, including more than 500,000 killed.
Estonia's Foreign Intelligence Service reported on 10 February 2026 that Russian artillery ammunition production has risen more than seventeenfold since 2021, and that Russia is highly likely preparing for a future conflict while the war continues. The same service said Russia has no intention of attacking Estonia this year.
General Carsten Breuer, chief of the German armed forces, said that hybrid attacks occur daily across NATO, with the eastern flank under the heaviest pressure, and that the Russian services watch how each government responds and adapt. Ukrainian military intelligence estimates Russia now builds about 3,000 Geran attack drones a month at Yelabuga, with new construction at the site visible on satellite imagery in July.
Lithuania approved a record defence budget of 4.79 billion euros for 2026, 5.38 per cent of GDP and the highest ratio in the alliance. Estonia is projected at 5.11 per cent and Latvia at 4.92 per cent. Poland set 200 billion zloty, about 46.8 billion euros, or 4.8 per cent of GDP, the largest share in NATO. East Shield, a 2.5 billion dollar fortification line, runs 700 km along the Polish borders with Russia and Belarus, with German engineering units arriving in April 2026 for a two-year deployment.
