Estonia is automatically diverting emails using Russia’s .ru internet domain into quarantine for additional security checks before they reach state institutions connected to the country’s secure government network, Justice and Digital Affairs Minister Liisa Pakosta told Estonia's public broadcaster ERR.

The measure is intended to protect Estonian government computer systems amid a post-2022 surge in cyberattacks that officials link to Russia. It applies only to institutions operating inside the secure state network, leaving local governments and some state bodies outside.

Many Estonian residents, particularly Russian speakers, still use .ru email services, ERR noted. Because the filter is triggered solely by the address ending, legitimate messages will be screened alongside potentially malicious ones and may take longer to arrive.

Pakosta said the safeguard was necessary because cyberattacks against Estonia had increased “exponentially” since 2022 and that many were linked to Russia. She said such attacks had not succeeded against Estonia, while major public-sector cyberattacks had succeeded in both Latvia and Lithuania.

The rerouting is automatic and handled centrally, so agencies do not need to take any action, Pakosta said. A large proportion of state institutions have already moved behind the government’s unified cyber shield, while the transition continues.

Pakosta described the quarantine as one small measure within Estonia’s wider cybersecurity work. Estonia’s courts have gone further, saying they will ask parties in legal proceedings to stop using .ru addresses for official communication, according to ERR.

How the Baltic states are hardening against Russia

Estonia's email quarantine forms part of a broader Baltic effort to limit Russian influence and strengthen defenses against military, cyber, and covert threats.

Estonia, Latvia, and Lithuania are constructing a Baltic Defense Line, a planned network of bunkers, anti-tank ditches, and other barriers, along their borders with Russia and Belarus. Latvia has also banned imports of Russian and Belarusian books, clothing, toys, and other goods.

The threat extends beyond cyberattacks: an Estonian court found that Russia’s military intelligence agency, the GRU, ordered the 2024 firebombing of a Ukrainian restaurant in Tallinn, part of a wider Russian sabotage campaign targeting European supporters of Ukraine.

NATO said on 30 August 2026 it sees no imminent threat of attack from Russia, Reuters reported. Russia is stepping up covert operations across Europe alongside its war on Ukraine, a NATO official said. The statement followed a week of warnings from Western capitals.

Russia's sabotage campaign in Europe has grown steeply since the full-scale invasion, reaching from Molotov cocktails thrown at a French drone plant to severed undersea cables and attacks on railways. Recorded attacks in Europe hit 34 in 2024, nearly triple the 12 counted a year earlier by the Center for Strategic and International Studies, which says Western states have yet to build an effective answer to a campaign pitched below the threshold that would trigger a military response.

Attacks on Ukraine and covert acts in Europe are both rising

Russia is attacking Ukraine harder and running more covert operations in Europe at the same time, the official said.

"Even as the Russians are facing very substantial resistance from Ukraine, they are stepping up attacks on Ukraine as well as hybrid acts in Europe," the official said, adding: "As always, NATO remains vigilant and alert to the variety of threats we face. At this time, we see no imminent threat of attack."

Hybrid acts mean covert moves—sabotage, arson, drone flights—that stop short of open war.

A week of alarms

Three developments that week bore on the same question—whether Russia would strike a NATO country, not only Ukraine. Polish Prime Minister Donald Tusk warned on 28 August that Russia is preparing to escalate both in Ukraine and across the region, putting the critical window at seven or eight months.

Days earlier, CIA Director John Ratcliffe flew to Moscow to meet intelligence counterparts. Two people familiar with the meeting told Reuters that Ratcliffe did raise the prospect of Russia acting against a NATO state, though whether the trip had any other aim stayed unclear. One source said several topics came up, including Russia's support for Iran. US President Donald Trump dismissed that reading two days later, saying Russian President Vladimir Putin will not attack NATO territory and that Ratcliffe carried no message.

Explore further

650 participants from 24 countries: Ukraine brings its battle-tested drone-defense experience to NATO’s Baltic Trust 2026 exercise

On 25 August, German Chancellor Friedrich Merz said at a coalition summit that his government will soon name who was behind the 4 August drone attack attempt at Leipzig/Halle airport. Russia denies any role in sabotage on European soil and dismisses such accusations as Western scaremongering.

Poland's prime minister says the next seven or eight months could decide the region's security. Donald Tusk said there are signs of serious Russian preparations to escalate tensions, both in the war against Ukraine and across the region, according to Ukrinform.

Tusk's warning follows weeks of similar alarms from the countries on NATO's eastern edge. Lithuanian President Gitanas Nausėda said on 15 July that intelligence pointed to possible Russian strikes on critical infrastructure in the Baltic states or Poland, according to Defense News.

Poland is the main transit route for Western military aid to Ukraine, which makes its security inseparable from Ukraine's. Tusk himself said in July that Russia could be ready for a confrontation with Europe as early as 2027.

The CIA visit was not the whole of it

At the meeting, reporters asked Tusk about the recent visit of CIA Director John Ratcliffe to Moscow. Poland is in constant contact with the agency's leadership and was not caught off guard by news of Ratcliffe's activity, he said.

Some security information must stay confidential, Tusk added, but that does not mean the public should be deprived of information about the most important threats.

The signals go beyond one trip

The matter is no longer only the CIA director's visit to Moscow, Tusk said. Over recent weeks, numerous public signals have pointed to Russian preparation for escalation.

Russia is very seriously preparing to escalate tensions, both in the war with Ukraine and across the whole region, and that for Russia this fall and winter are meant to be key, he claimed.

Moscow states its aims openly

Some Russian figures have described the war's purpose in plain terms. This week, State Duma vice-speaker Pyotr Tolstoy said Russia views Ukraine as a "territory" that would allow Moscow to export its energy to Europe via a short route, not as a sovereign country.

Tolstoy, whom the EU sanctioned in 2022 as a central figure in Russian state propaganda, also called for massed bombing of Ukrainian cities to break the population into surrender. His remarks are one more public signal of the kind Tusk pointed to.

Russia may expand hybrid attacks against Poland and the Baltic states, including infrastructure sabotage or false-flag attacks, Bloomberg reported on 12 August, citing an unnamed European intelligence official. 

The warnings come amid concern that Moscow wants to intimidate Ukraine’s supporters. The CIA warning follows Russian threats, incursions, alleged sabotage plots, and disinformation against Poland and the Baltic states. Most Western military aid reaches Ukraine through Poland, while the Baltic states rank among Kyiv’s strongest supporters. Sabotage of transport, energy, or communications can slow aid delivery and test NATO while hiding Russia’s role.

Separately, a European government official told Bloomberg that the CIA had warned countries in the region of a possible future Russian attack. The CIA declined to comment.

The same official said Russia might instead be creating the impression of an impending attack to sow fear as part of an information operation. The official saw no signs that Moscow was preparing a conventional attack or invasion.

Moscow tests NATO’s eastern flank

Poland and Lithuania had already raised similar concerns. In July, Poland said it had credible intelligence that Russia was planning new provocations. Lithuania later warned that Moscow might rebuild captured Ukrainian drones for false-flag strikes on critical infrastructure.

In September 2025, between 19 and 23 Russian drones entered Polish airspace, shutting down airports and damaging buildings. Poland closed four airports as NATO aircraft responded.

Meanwhile, five people are on trial in Lithuania over attacks allegedly organized for Russian military intelligence in 2024, Bloomberg reported. Lithuania has reinforced infrastructure sites and deployed troops since June.

These warnings and incidents place the CIA alert within a wider pattern of pressure on NATO’s eastern flank and Ukraine’s supporters. 

How Russia strikes without starting a war

Bloomberg cited several recent unexplained drone incidents in Germany alongside the CIA warning. Citing Die Zeit, Euromaidan Press reported that an explosive-laden drone struck the wing of a parked Ukrainian An-124 at Leipzig-Halle airport and failed to detonate. A US Defense Department official in Europe told CNN that Washington assessed the drone belonged to Russian intelligence. 

Bloomberg also reported that a cargo plane hit an unidentified object and that drones appeared over a military base the following day. It did not connect either incident to Russia.

More broadly, Russian hybrid operations have grown sharply since the full-scale invasion. CSIS found that attacks in Europe tripled from 2023 to 2024, after quadrupling the previous year. Separately, the US Helsinki Commission mapped nearly 150 operations in NATO territory attributed to or suspected of Russia between February 2022 and November 2024.

Retired Lt. Gen. Ben Hodges told Euromaidan Press in February that attacks on ports, railways, and cables can probe routes needed for NATO reinforcements. Their deniability raises the political cost of responding.

By hiding its role, Moscow can disrupt support for Ukraine and test NATO without openly starting a war. 

Lithuania's military intelligence warned that Russia is considering using captured Ukrainian drones for false flag attacks on critical infrastructure in the Baltic region, LRT reported. Defense Minister Robertas Kaunas confirmed the assessment and called the scenario "probably the most realistic" form of Russian provocation against the region. Lithuania has reinforced security at key infrastructure sites and deployed military forces since June.

Russia's false flag playbook with captured drone parts

Moscow could reassemble crashed and intercepted Ukrainian drone wreckage into functioning devices and launch them at targets in the Baltic states, Kaunas told reporters on 6 August. The goal: create confusion about who launched the strike and avoid accountability for hitting NATO territory.

"We have data that Russia is considering conducting unconventional kinetic attacks against critical infrastructure in the Baltic region," Kaunas said. "It is likely that Russia could use Ukrainian-made drones for this purpose."

The Baltic region. Map: Euromaidan Press

The mechanism exploits a byproduct of Ukraine's drone war against Russia. As Ukrainian long-range drones hit oil infrastructure and military targets deep inside Russia, some are intercepted or crash. Russia collects the wreckage. 

"Russia possesses some of those parts and drone fragments and is capable of assembling them into a functioning device," Kaunas said. "The theoretical possibility that such drones could be used in a false flag operation exists."

Explore further

Lithuania moves to produce Ukrainian drones locally under bilateral defense pact

Kaunas emphasized no decision to launch such an operation had been detected. 

"We are talking about a false flag operation in which a fake Ukrainian drone could be used. At this point, that is probably the most realistic scenario."

The false flag warning follows a pattern of Ukrainian drones entering Baltic airspace after being diverted by Russian electronic warfare. NATO fighter jets shot down such drones over Latvia and Estonia this spring, and Lithuania shut Vilnius airport after detecting a drone crossing from Belarus.

Explore further

Baltic nation boosts security at dam, gas storage facility due to Russian threat

Multiple NATO allies see the same intelligence

Lithuanian President Gitanas Nausėda had earlier raised concerns about possible conventional and sabotage strikes targeting the country's transport and energy networks. Kaunas echoed that message and pointed to a broader pattern across the alliance's eastern flank.

"Other NATO countries have repeatedly made it very clear that they see it, hear it, know about it, and have warned Russia not to do it," Kaunas said. He did not identify specific targets or a timeline for any potential attack.

Russia claimed the Baltic states open air corridors for Ukrainian drone strikes—without producing evidence. Russia also threatened NATO member Latvia with retaliation over the accusations. Nausėda publicly rejected Moscow's claims.

NATO upgraded its Baltic Air Policing rules of engagement in July, giving fighter jets authority to shoot down objects that pose a threat. Russia's military aircraft probed NATO's eastern flank so aggressively in July that scrambles jumped more than 250%.

Read also

• Lithuania scrambles NATO jets and shuts Vilnius airport over drone from Belarus

• Baltic nation boosts security at dam, gas storage facility due to Russian threat

• Russian maps blurred 119 of Russia’s own military sites in the Nordics and Baltics—and gave away their locations

Estonia will use part of a new European Union loan to arm Ukraine with drones, drawing on a loan worth up to €2.34 billion, according to ERR. The loan will also rebuild its own air defense and ammunition stocks, and all of it must be spent by 2030.

As Moscow continues its all-out war in Ukraine, the EU's northeast is rearming fast, bracing for a Russia that regional military chiefs expect to be combat-ready again within two years.

What the loan buys

Estonia signed the financing deal with the European Commission under SAFE (Security Action for Europe), a €150 billion EU program that raises money jointly on the markets and lends it to member states on cheap terms to fast-track defense spending, its finance ministry said.

A share of Estonia's up-to-€2.34 billion will go to Ukraine as drones. The rest strengthens air defense, buys military vehicles, and refills artillery shells and other ammunition. The credit runs 45 years, and every purchase and delivery must be finished by 2030. Estonia filed its final application in November 2025.

Why the loan helps

Borrowing through SAFE lets Estonia raise money on better terms than it could alone, because the EU issues debt at lower rates. The bloc raises the money jointly and splits it among members. Estonia will hold defense spending above 5% of GDP, and the loan eases the strain that puts on its budget.

Explore further

“Ukraine is becoming a security provider for Europe”: Ukraine signs Drone Deals with Estonia, the Netherlands, and Denmark as Europe taps Kyiv’s battlefield-tested weapons technology

Estonia, a NATO and EU state of about 1.3 million people, shares a 294-kilometer border with Russia and treats Moscow's war on Ukraine as a direct threat to its own security. It has studied that war closely for years and is now racing to rebuild its air defenses and ammunition stocks.

Kadri Peters, a deputy secretary general at Estonia's Defense Ministry, said the fast-changing security situation in Europe demands stronger, quicker defense from the whole alliance. She said large-scale purchases ahead will directly affect Estonia's security and the wider region.

Explore further

US soldiers left for a “summer rotation.” Estonia doesn’t know how many are coming back—or when

In July, Estonia and the United States agreed to resume weapons deliveries in the coming months, after a pause tied to the war in Iran, with long-range ATACMS ballistic missiles the exception. In May, Washington had warned European allies of long delays as it drained its own stocks, mainly of HIMARS rocket ammunition and NASAMS air-defense missiles. The same shortages hit Ukraine the hardest: it currently struggles to shoot down Russian ballistic missiles for lack of US-made PAC-3 interceptors.

Estonia has been backing Kyiv since the beginning of Russia's full-scale invasion in 2022. It co-leads an IT coalition that has funneled over €1.4 billion into Ukraine's drone programs, and has moved to tap Kyiv's battlefield-tested drone technology for its own forces.