European intelligence warns of growing risk of Russian tests of NATO

European intelligence officials are increasingly warning that Russia may seek to test NATO’s response to attacks or provocations on European territory in the coming months. The warnings come as European governments report a growing number of suspected sabotage operations, drone incidents and other forms of hybrid activity linked to Russia, raising concerns about how far Moscow may be prepared to push the alliance without triggering a direct military confrontation.

The latest concerns were raised by intelligence officials from the Czech Republic, Latvia and Sweden in conversations with the Guardian. One of the officials suggested that a potential Russian move could come within “months, not years”. The warnings followed comments by Polish Prime Minister Donald Tusk that Polish intelligence assessments indicated Russia could use drones or missiles against NATO territory in the coming months. French President Emmanuel Macron has also convened political leaders to discuss the deteriorating security environment.

A broader pattern of hybrid activity

The concern is not limited to the possibility of a conventional attack. European governments have been dealing with a growing number of incidents that fall below the traditional threshold of armed conflict, including suspected sabotage, arson, cyber operations, disinformation campaigns and violations of allied airspace.

Since the beginning of 2026, a series of unexplained fires has affected defence-related facilities in Italy, Bulgaria, Estonia and Slovakia. German authorities also discovered an explosives-laden drone near a Ukrainian cargo aircraft at Leipzig airport. Denmark has warned that Russian actors were attempting to recruit local citizens for sabotage operations against defence companies connected to Ukraine, while Lithuania and France have experienced incidents that authorities have linked to broader Russian influence or destabilisation efforts.

European authorities have become more willing to publicly attribute such incidents to Russia. Latvia, for example, formally protested to the Russian embassy in September over Germany's assessment that Moscow was responsible for an attempted drone attack at Leipzig airport. Riga described the incident as part of a wider Russian effort to undermine European resilience and support for Ukraine, while stressing that Latvia's assessment of the immediate military threat had not changed.

Poland has likewise warned of a more active Russian campaign. On 13 September, Tusk said that the coming weeks and months could bring intensified Russian activity and that escalation affecting Polish territory could not be excluded. Polish authorities said the country had strengthened its security posture following an incident near the Polish-Ukrainian border and were preparing for possible coordinated action with NATO allies.

NATO is already adapting its response

NATO has treated the increase in airspace violations and hybrid activity as part of a broader deterioration in Europe's security environment. The alliance says Russia has repeatedly tested allied resolve and that airspace violations, cyberattacks and sabotage have become more frequent.

NATO launched Eastern Sentry in September 2025 after Russian drones and aircraft violated the airspace of several allied countries. The activity strengthened surveillance and air-defence capabilities along the eastern flank and remains part of the alliance's wider deterrence posture. NATO now maintains multinational battlegroups in nine eastern-flank countries, including Poland, the Baltic states, Finland and Romania.

The alliance's military leadership reiterated this approach at its Military Committee Conference in Copenhagen on 18–19 September. NATO's Chair of the Military Committee, Admiral Giuseppe Cavo Dragone, said that recent Russian airspace violations, drone incidents and hybrid activities represented attempts to test allied resolve, while stressing that NATO remained ready to defend allied territory. The meeting focused on strengthening collective deterrence, accelerating military capabilities and improving the ability of allied forces to operate across multiple domains.

The Baltic states are urging resilience rather than panic

The security debate has become more complicated in the Baltic region, where governments have spent years warning about Russia's military and hybrid capabilities. Officials in Estonia, Latvia and Lithuania remain among the strongest advocates of strengthening NATO's eastern flank, but they have also warned against treating every incident as evidence that a conventional Russian attack is imminent.

Latvia's Security Service has previously assessed that Russian intelligence and security structures were developing sabotage capabilities in Europe, including the ability to target critical infrastructure. Its assessment was that such operations could be used to weaken European states' ability to respond to a future military confrontation with NATO.

At the same time, Latvia's current security assessment does not indicate an immediate change in the country's military threat level. Its authorities have stressed that the main challenge is the cumulative effect of Russia's war against Ukraine and its hybrid operations against European states.

This distinction is important for European governments. A campaign of sabotage and coercion can impose economic and political costs without necessarily crossing the threshold that would trigger NATO's collective-defence mechanisms. It also allows Moscow to exploit uncertainty over attribution and over how individual incidents should be answered.

The threshold for escalation remains the central issue

European governments therefore face a difficult balance. Stronger responses could increase the cost of Russian operations, but governments also want to avoid creating a chain of escalation that could lead to direct military confrontation.

Germany responded to the Leipzig airport incident by expelling more than 150 Russian diplomats and tightening measures affecting Russian travellers, according to the Guardian. European governments are also expanding sanctions and targeting networks that help Russia circumvent restrictions, while EU countries are increasing pressure on the Russian shadow fleet operating in European waters.

The problem is that diplomatic expulsions, sanctions and counter-intelligence measures do not necessarily deter operations that are deliberately designed to remain below the threshold of conventional warfare. European governments are therefore increasingly linking internal resilience, protection of critical infrastructure, counter-intelligence and military deterrence as parts of the same security response.

The Czech, Latvian and Swedish intelligence warnings should nevertheless be treated as assessments of risk rather than confirmation that Russia has decided to launch an attack on NATO. The Guardian's reporting notes that intelligence sources rarely make clear whether warnings are based on specific operational intelligence or broader assessments of Russian intentions. The current situation also differs substantially from early 2022, when Western intelligence agencies had extensive evidence of Russia's preparations for the invasion of Ukraine.