Russia may expand hybrid attacks against Poland and the Baltic states, including infrastructure sabotage or false-flag attacks, Bloomberg reported on 12 August, citing an unnamed European intelligence official. 

The warnings come amid concern that Moscow wants to intimidate Ukraine’s supporters. The CIA warning follows Russian threats, incursions, alleged sabotage plots, and disinformation against Poland and the Baltic states. Most Western military aid reaches Ukraine through Poland, while the Baltic states rank among Kyiv’s strongest supporters. Sabotage of transport, energy, or communications can slow aid delivery and test NATO while hiding Russia’s role.

Separately, a European government official told Bloomberg that the CIA had warned countries in the region of a possible future Russian attack. The CIA declined to comment.

The same official said Russia might instead be creating the impression of an impending attack to sow fear as part of an information operation. The official saw no signs that Moscow was preparing a conventional attack or invasion.

Moscow tests NATO’s eastern flank

Poland and Lithuania had already raised similar concerns. In July, Poland said it had credible intelligence that Russia was planning new provocations. Lithuania later warned that Moscow might rebuild captured Ukrainian drones for false-flag strikes on critical infrastructure.

In September 2025, between 19 and 23 Russian drones entered Polish airspace, shutting down airports and damaging buildings. Poland closed four airports as NATO aircraft responded.

Meanwhile, five people are on trial in Lithuania over attacks allegedly organized for Russian military intelligence in 2024, Bloomberg reported. Lithuania has reinforced infrastructure sites and deployed troops since June.

These warnings and incidents place the CIA alert within a wider pattern of pressure on NATO’s eastern flank and Ukraine’s supporters. 

How Russia strikes without starting a war

Bloomberg cited several recent unexplained drone incidents in Germany alongside the CIA warning. Citing Die Zeit, Euromaidan Press reported that an explosive-laden drone struck the wing of a parked Ukrainian An-124 at Leipzig-Halle airport and failed to detonate. A US Defense Department official in Europe told CNN that Washington assessed the drone belonged to Russian intelligence. 

Bloomberg also reported that a cargo plane hit an unidentified object and that drones appeared over a military base the following day. It did not connect either incident to Russia.

More broadly, Russian hybrid operations have grown sharply since the full-scale invasion. CSIS found that attacks in Europe tripled from 2023 to 2024, after quadrupling the previous year. Separately, the US Helsinki Commission mapped nearly 150 operations in NATO territory attributed to or suspected of Russia between February 2022 and November 2024.

Retired Lt. Gen. Ben Hodges told Euromaidan Press in February that attacks on ports, railways, and cables can probe routes needed for NATO reinforcements. Their deniability raises the political cost of responding.

By hiding its role, Moscow can disrupt support for Ukraine and test NATO without openly starting a war. 

Lithuania's military intelligence warned that Russia is considering using captured Ukrainian drones for false flag attacks on critical infrastructure in the Baltic region, LRT reported. Defense Minister Robertas Kaunas confirmed the assessment and called the scenario "probably the most realistic" form of Russian provocation against the region. Lithuania has reinforced security at key infrastructure sites and deployed military forces since June.

Russia's false flag playbook with captured drone parts

Moscow could reassemble crashed and intercepted Ukrainian drone wreckage into functioning devices and launch them at targets in the Baltic states, Kaunas told reporters on 6 August. The goal: create confusion about who launched the strike and avoid accountability for hitting NATO territory.

"We have data that Russia is considering conducting unconventional kinetic attacks against critical infrastructure in the Baltic region," Kaunas said. "It is likely that Russia could use Ukrainian-made drones for this purpose."

The Baltic region. Map: Euromaidan Press

The mechanism exploits a byproduct of Ukraine's drone war against Russia. As Ukrainian long-range drones hit oil infrastructure and military targets deep inside Russia, some are intercepted or crash. Russia collects the wreckage. 

"Russia possesses some of those parts and drone fragments and is capable of assembling them into a functioning device," Kaunas said. "The theoretical possibility that such drones could be used in a false flag operation exists."

Explore further

Lithuania moves to produce Ukrainian drones locally under bilateral defense pact

Kaunas emphasized no decision to launch such an operation had been detected. 

"We are talking about a false flag operation in which a fake Ukrainian drone could be used. At this point, that is probably the most realistic scenario."

The false flag warning follows a pattern of Ukrainian drones entering Baltic airspace after being diverted by Russian electronic warfare. NATO fighter jets shot down such drones over Latvia and Estonia this spring, and Lithuania shut Vilnius airport after detecting a drone crossing from Belarus.

Explore further

Baltic nation boosts security at dam, gas storage facility due to Russian threat

Multiple NATO allies see the same intelligence

Lithuanian President Gitanas Nausėda had earlier raised concerns about possible conventional and sabotage strikes targeting the country's transport and energy networks. Kaunas echoed that message and pointed to a broader pattern across the alliance's eastern flank.

"Other NATO countries have repeatedly made it very clear that they see it, hear it, know about it, and have warned Russia not to do it," Kaunas said. He did not identify specific targets or a timeline for any potential attack.

Russia claimed the Baltic states open air corridors for Ukrainian drone strikes—without producing evidence. Russia also threatened NATO member Latvia with retaliation over the accusations. Nausėda publicly rejected Moscow's claims.

NATO upgraded its Baltic Air Policing rules of engagement in July, giving fighter jets authority to shoot down objects that pose a threat. Russia's military aircraft probed NATO's eastern flank so aggressively in July that scrambles jumped more than 250%.

Read also

• Lithuania scrambles NATO jets and shuts Vilnius airport over drone from Belarus

• Baltic nation boosts security at dam, gas storage facility due to Russian threat

• Russian maps blurred 119 of Russia’s own military sites in the Nordics and Baltics—and gave away their locations