An article by Hubs.ua examines why the threat of a Russian attack on Europe is shifting from a strategic scenario toward the formation of concrete operational infrastructure.

Mykola Zentsev, international security expert, retired Major General, and Head of the Expert Council of the Andromeda Information and Analytical Center:

Russia is building infrastructure on NATO’s eastern flank for a large-scale hybrid operation that would not require the deployment of hundreds of thousands of troops, as in February 2022.

The Kremlin’s objective would not necessarily be territorial occupation. Instead, it could seek to create several simultaneous crises, outpace NATO’s decision-making cycle, and force Europe to redirect resources from supporting Ukraine toward its own defense.

Previous Andromeda assessments highlighted the Baltic region as a potential instrument for exhausting the Ukrainian theater of war. New evidence indicates that this threat is moving from a strategic scenario toward the development of concrete operational infrastructure.

Events from September 6–12 add another layer to this picture. Three indicators have intensified simultaneously: Russian military rhetoric, Belarusian military readiness, and nuclear signaling.

Putin, Medvedev, Peskov and Lavrov have increasingly portrayed European actions as steps toward direct war with Russia. On September 6, Lavrov described accusations of Russian involvement in a drone incident in Leipzig as the beginning of a “real war” and claimed that German Chancellor Friedrich Merz was effectively moving toward declaring war on Russia.

On September 8, Putin assured US President Donald Trump that Russia had no aggressive plans toward Europe. Three days later, however, he stated that the deployment of European troops to Ukraine would mean war with Russia.

This combination of reassuring statements and simultaneous escalation resembles one element of Russia’s behavior before the February 2022 invasion of Ukraine.

The rhetoric concerning Lithuania has changed particularly sharply.

On September 11, Peskov stated that Lithuania could become a target of Russian nuclear targeting if nuclear weapons directed against Russia were deployed there. On the same day, Medvedev threatened that Lithuania could “disappear from the map” in a war with Russia and questioned NATO’s readiness to implement Article 5.

So far, there is no corresponding large-scale redeployment of Russian forces, logistics or command systems directly toward Lithuania and the Suwałki Gap. However, the combination of threats, nuclear signaling and the absence of a conventional military concentration deserves particular attention.

Operational geography: Kaliningrad, Suwałki and Narva

Kaliningrad node

Instrument: electronic warfare systems, Iskander-M missile systems, coastal defense and air defense systems.

Operators: Russian electronic warfare units and Baltic Fleet missile carriers.

Operational effect: jamming and spoofing GNSS signals over the Baltic, creating risks for NATO civilian aviation and shipping, while establishing an anti-access/area-denial zone in the southeastern Baltic Sea.

In this configuration, Kaliningrad is more than a missile platform. It is a node capable of simultaneously affecting navigation, airspace, maritime communications and NATO military logistics.

Suwałki Gap

Instrument: disruption of the approximately 65-kilometer land corridor between Kaliningrad and Belarus.

Operators: forces in Kaliningrad Oblast and western Belarus.

Operational effect: isolating the Baltic states from NATO’s main territory and forcing the Alliance to rapidly deploy reserves toward Poland and Lithuania.

Lithuania and the Suwałki Gap are increasingly becoming part of Russia’s information and nuclear pressure campaign. At the same time, there are currently no signs of large-scale preparations for a conventional ground offensive in this direction.

Narva destabilization vector

Instrument: information and psychological operations involving simulated separatism.

Operators: proxy networks and Russian military intelligence and security-service information operations.

Operational effect: promoting the concept of a “Narva People’s Republic” through symbols, pseudo-borders, artificial interethnic tensions and attempts to provoke internal unrest in Estonia.

The key objective may not be the seizure of Narva by the Russian military, but the creation of a situation in which NATO must first determine whether it is dealing with domestic unrest, sabotage, a special-services operation or an armed attack.

The delay between the beginning of an operation, attribution and a political decision by the Alliance is one of Moscow’s most valuable resources.

Belarus: the second operational platform

Instrument: artificial migration pressure, air provocations, border reconnaissance and covert force maneuvering.

Operators: Belarusian border structures working with Russian security and special services, as well as Belarusian and Russian special operations forces.

Operational effect: continuous pressure on the border infrastructure of Latvia, Lithuania and Poland, including more than 12,000 attempted illegal border crossings into Latvia over one year, while tying down NATO ground forces without formally involving Russian territory.

The pressure continues. On September 9 alone, Latvian border guards stopped 97 attempts to illegally cross the border from Belarus, followed by another 50 on September 10. By comparison, 140 such attempts were recorded on July 22 in a single day.

But another development is more significant.

On September 11, Lukashenko ordered inspections of the Belarusian Armed Forces “up to mobilization.” Tank and motorized rifle units had already undergone inspections, while an artillery brigade was being inspected. Lukashenko explicitly said the inspections should be conducted “as if it were war.”

The same day, Belarusian Defense Minister Viktor Khrenin announced the deployment of a command-and-control system for all armed forces during communications exercises and said it was ready to operate under wartime conditions.

On September 11–12, two Russian Il-76 military transport aircraft arrived in Baranovichi. Available information indicates that they subsequently transported Belarusian personnel to the Telemba training range in Russia. No transfer of Russian combat equipment to Belarus has been recorded.

This is a critical detail: Belarusian military readiness is increasing, but there is currently no large-scale Russian combat deployment comparable to the beginning of 2022.

The military force component: cover and escalation threat

Instrument: deployment of expanded military infrastructure near the borders of Finland and the Baltic states.

Operators: the re-established Leningrad Military District and Russia’s newly formed 44th Army Corps.

Operational effect: creating a permanent conventional threat. Russian armed forces serve as a “final echelon,” forcing NATO to disperse its reserves even before the active phase of a hybrid operation begins.

This is where a potential operation against NATO’s eastern flank differs fundamentally from the 2022 scenario.

Before invading Ukraine, Russia spent months accumulating tens of thousands of troops, armored vehicles, artillery, aircraft and logistical infrastructure. There is no comparable concentration on the Baltic axis today.

That does not rule out a hybrid scenario. On the contrary, an operation below the threshold of conventional war could allow Moscow to create a crisis before NATO receives unambiguous military indicators of an invasion.

Sabotage and cyber architecture: specific units

Russian security services have developed clear specializations for operations against Europe.

1. Military Unit 29155, GRU, 161st Center, Special Activities Service / SSD

Specialization: physical sabotage, arson, assassination attempts and violent sabotage.

Operational effect: disruption of logistics and commercial facilities in Europe, including arson attacks on shopping centers in Warsaw and Vilnius and preparations for sabotage in Riga.

2. Military Unit 26165, GRU, 85th Center, APT28 / Fancy Bear

Specialization: cyber intelligence and covert access.

Operational effect: penetration of diplomatic, military and government networks of NATO countries to collect data and prepare cyberattacks.

3. Military Unit 74455, GRU, Center for Special Technologies, Sandworm / APT44

Specialization: destructive cyber operations.

Operational effect: disruption of critical and energy infrastructure following the model of NotPetya and attacks against power systems.

4. 16th FSB Center, Turla group

Specialization: electronic and signals intelligence and sophisticated cyber espionage.

Operational effect: long-term intelligence access to Western government and defense structures.

5. 390th Intelligence Point of the Baltic Fleet, Baltiysk

Specialization: naval special operations and sabotage in coastal areas.

Operational effect: reconnaissance and possible sabotage of coastal infrastructure, ports and NATO naval bases.

6. Main Directorate of Deep-Sea Research, Russian Ministry of Defense

Specialization: deep-sea research and specialized underwater operations.

Operational effect: reconnaissance and preparation for potential damage to undersea communications cables and energy networks in the Baltic Sea.

In spring 2026, the United Kingdom, Norway and the United States disrupted a covert Russian operation near Svalbard in which Russian forces were reportedly practicing activities near critical underwater fiber-optic cables.

According to information released in September, the operation involved technologies designed to disable subsea cables in a way that would complicate efforts to determine the cause of the damage. The cables were not damaged, and Russian vessels left the area following allied countermeasures.

Another revealing case is the Fitburg incident. According to the Finnish prosecution service, during the December 2025 damage to two telecommunications cables between Finland and Estonia, a vessel dragged its anchor for at least 130 kilometers. A technical inspection did not establish a mechanical failure that would explain the anchor’s position.

At the same time, Russian state involvement in this incident has not been officially established.

This uncertainty is characteristic of hybrid warfare: critical infrastructure may already be damaged, while the evidentiary threshold for a political and military NATO response has not yet been reached.

Europe as a sabotage testing ground

New cases in the United Kingdom and Romania indicate that Russian intelligence and sabotage activity extends beyond the Baltic region.

British prosecutors charged Joshua Cammidge with assisting a foreign intelligence service and preparing acts of sabotage.

According to the case materials, he conducted reconnaissance of four drone-manufacturing companies near Swindon, studied Wi-Fi jamming equipment and offered sabotage assistance to a contact linked to the GRU Volunteer Corps. The alleged activity continued from March until early September.

Romania’s intelligence service, SRI, reported disrupting Russian-coordinated reconnaissance of NATO military bases, communications centers, national security facilities and critical infrastructure.

Ukrainian Antonov transport aircraft were also among the surveillance targets. The suspect had been under Romanian counterintelligence control since February.

On September 9, Poland and Ukraine also prevented a direct threat to one of the Polish-Ukrainian border crossings. Polish Prime Minister Donald Tusk referred to a CIA warning about possible Russian attacks or provocations against Ukrainian crossings with European countries. The specific source of the threat has not been publicly established.

This creates a much broader picture: Russian structures are not targeting only NATO military bases, but the entire logistics system supporting Ukraine, including borders, transportation hubs, aviation, drone production, communications and critical infrastructure.

Proxy tactics: the European testing ground

Instrument: recruitment of one-time operatives through messaging platforms, cryptocurrency payments and the use of civilian drones.

Operators: Russian intelligence structures, including the GRU sabotage network, using remotely recruited proxies.

Operational effect: dozens of acts of sabotage, including arson attacks against OBI and IKEA facilities, intelligence gathering on NATO bases and weapons shipments in Romania and Poland, while making rapid attribution as difficult as possible.

This fundamentally changes the model of warfare.

An operation no longer requires Russia to send a professional special-forces team across the border. An operative can be recruited remotely, receive coordinates, cryptocurrency and a specific assignment.

The organizer can remain hundreds or thousands of kilometers away.

Information legitimization: preparing the pretext

Instrument: the Foundation for Support and Protection of the Rights of Compatriots Abroad, “Pravfond,” and influence networks.

Operators: Russian foreign intelligence structures and information-psychological operations operating under the cover of legal and human-rights organizations.

Operational effect: promoting narratives about “Russophobia,” “Nazism” and the “persecution of Russian speakers” in order to create international and domestic justification for military and hybrid intervention.

This information framework is familiar to Ukraine.

First, a narrative is created about alleged persecution of Russian-speaking populations. Then “self-organized” activists, symbols, pseudo-political structures and demands for autonomy emerge. At the same time, an information campaign is launched around the need to “protect compatriots.”

In such a scenario, Narva could become more than a border city for Moscow. It could serve as a testing ground for how quickly NATO can identify an external operation disguised as an internal crisis.

Four indicators from 2022 are already present

Comparing the current situation with the period before Russia’s invasion of Ukraine produces an ambiguous but concerning picture.

The first indicator is already present: Russia’s leadership is synchronizing rhetoric about direct war and retaliation.

The second: reassuring statements are being made alongside escalation. On September 8, Putin said Russia had no aggressive plans toward Europe. On September 11, he described the possible deployment of European troops to Ukraine as war with Russia.

The third: Belarus is conducting inspections of mobilization readiness and military command systems under wartime conditions.

The fourth, still partial: strategic and nuclear signaling is intensifying. At the same time, there is no equivalent to Russia’s strategic exercises of February 19, 2022, which included ballistic and cruise missile launches.

Another familiar element is also present: Russia is attempting to portray the potential adversary as the party provoking the war. This transfer of responsibility also accompanied the escalation in February 2022.

But there are important differences:

• No concentration of Russian ground forces comparable to 2022 has been detected on NATO’s borders.
• No large-scale Russian combat deployment in Belarus has been recorded.
• There is no evidence of major exercises continuing beyond their announced timeframe, as happened with “Allied Resolve” in February 2022.
• There have been no population evacuations under the pretext of an impending enemy attack, as occurred in the occupied areas of Donbas on February 18, 2022.
• There have been no formal legal steps comparable to the February 21, 2022, meeting of Russia’s Security Council and recognition of the so-called “DPR” and “LPR.”
• There has also been no confirmed deliberate Russian kinetic strike on NATO territory resulting in deaths or destruction.

These factors are important safeguards against excessive conclusions.

There is currently no basis to say that Russia has already begun direct preparations for a conventional invasion of the Baltic states on the February 2022 model.

But this may be precisely what distinguishes the new scenario.

A hybrid blitzkrieg without a tank column

Russia does not necessarily need to repeat 2022.

Instead of hundreds of tanks massing at the border, the first echelon could consist of cyberattacks, sabotage, navigation jamming, cable damage, migration provocations, information operations, proxy groups, drones and artificially created separatist movements.

Conventional forces would remain the second echelon, their very presence creating the possibility of further escalation and forcing NATO to consider the potential consequences.

This creates a problem for the Alliance that was practically absent in the Ukrainian case in 2022: when does a hybrid operation become an armed attack, and when should Article 5 be invoked?

This is precisely the gray zone Moscow could exploit.

The hybrid blitzkrieg scenario and its main objective

A synchronized Russian operation could involve:

• GNSS jamming from Kaliningrad;
• a destructive cyberattack by Military Unit 74455 against the Baltic energy grid;
• physical sabotage by the Military Unit 29155 network at warehouses and transport hubs;
• information destabilization in Narva;
• a border provocation originating from Belarus;
• a new wave of migration pressure;
• operations targeting undersea telecommunications and energy cables;
• sabotage against military logistics and defense-industry facilities;
• remotely recruited proxies;
• nuclear and missile signaling around Lithuania and the Suwałki Gap;
• demonstrative readiness measures by forces of the Leningrad Military District.

This could give the Kremlin its most valuable asset: time between the beginning of an operation, its identification and NATO’s response under Article 5.

That is why the absence of large Russian military columns on the border today should not necessarily be reassuring.

A new front may not begin with artillery preparation. It could begin with dozens of events, each of which individually would not appear sufficient to justify war: a damaged cable, a drone, an arson attack, a cyberattack, GPS disruption, unrest in a border city, migrants at a border crossing, or unidentified armed personnel without insignia.

And only afterward would the troops appear, already positioned nearby and supposedly uninvolved.

The main strategic vector: Ukraine

By creating a credible threat of direct war on NATO’s eastern flank, Moscow could seek to force European states to reduce or delay some deliveries of weapons, air defense systems and ammunition to Ukraine in order to replenish their own reserves.

In this context, even the allies’ response already requires resources. On September 9, Poland and the United States signed a $4 billion US Foreign Military Financing agreement. Warsaw said the funds would accelerate existing defense contracts, including the AH-64E Apache attack helicopter program.

Every new threat to Lithuania, Poland, Latvia, Estonia or Finland forces European capitals to confront an increasingly difficult question: how many air-defense systems, ammunition stocks, missiles and reserves can be transferred to Ukraine if they may be needed for their own defense tomorrow?

This is the dilemma on which Russia’s calculation is based.

NATO’s eastern flank could become the second front of Russia’s war against Ukraine even before the first conventional shot is fired there.