Russia is trying to "scare Europe" through hybrid attacks so that it provides less support to Ukraine, but Moscow has neither an interest in nor the capability to escalate to a full-scale military confrontation with NATO, Finnish President Alexander Stubb told Politico on 21 September during an interview on the sidelines of the UN General Assembly—even as other European leaders warn that Russian strikes on NATO territory could come within months.

Ukraine critically needs Western support as Russia's full-scale invasion continues. NATO's PURL program has provided about 75% of all Patriot battery missiles and 90% of the missiles used in other air defense systems since its launch last summer, according to NATO Secretary General Mark Rutte on 3 February. Some countries are also hubs for defense companies that produce weapons for Ukraine. Russia is trying to pressure such countries, including through hybrid attacks. Polish Prime Minister Donald Tusk and the head of the Czech security service have warned that Russia could strike NATO territory within months. The Finnish president says his own intelligence sees activity but no imminent military threat, and calls it an "overreaction" when intelligence services tell their neighbors they are next for a Russian invasion.

Finnish intelligence sees Russian activity but no imminent military threat, Stubb says

Stubb calls claims by some intelligence services that Europe is next for a Russian invasion an "overreaction" and says he sees no evidence of this.

"We think we have to be vigilant and awake. But, you know, we have the longest border in NATO with Russia, it's half the border. In our intelligence we see that there is activity but no imminent military threat right now," Stubb added.

He says Russia will continue hybrid attacks, so Europe must be prepared and support Ukraine

Europe should prepare for Russia's "continued hybrid and sabotage attacks," but should not "overreact" to them, as Russia wants to scare its allies so that they slow down their support for Ukraine, the Finnish president said.

"And any time we overreact to a hybrid attack, they have actually won the battle in that particular way," Stubb told Politico.

Europe should remain "cool, calm and collected" during such Russian intimidation, the Finnish president said.

Germany's recent decision to officially hold Russia responsible for an attempted drone attack in Leipzig is "exactly what you need to do," Stubb said.

"You need to point the finger and say, we know what you're doing, and these are the consequences," he added.

A pro-Kremlin group, Global Citizens Against War 1984, issued an ultimatum to Latvia, Poland, and Portugal to stop supplying weapons to Ukraine by 7 October, threatening to disrupt defense companies in those countries.

Warnings from Warsaw and Prague paint a different picture

Russia could carry out "accidental" drone or missile strikes against NATO countries supporting Ukraine in an attempt to weaken the Alliance's integrity and persuade members that Article 5 is more theoretical than practical, Polish Prime Minister Donald Tusk said in parliament on 17 September, citing NATO, Ukrainian, and Polish intelligence assessments.

"There is a real risk that drones or other types of missiles could enter the territory of one or several NATO countries on the eastern flank," Tusk said.

The head of the Czech security service warned separately that Russia could undertake a limited incursion, false-flag provocations, and a massive influence campaign in a matter of months rather than years.

Illia Bilyk, a 21-year-old Ukrainian national, admitted five counts of racially and religiously aggravated criminal damage on 17 September over graffiti at five Muslim institutions in east London, the BBC reported.

The BBC and Hope Not Hate linked Bilyk’s attacks to the same Russian network behind arsons targeting properties connected to former UK Prime Minister Keir Starmer. The network operated Direct Action UK, a fake British far-right group that recruited people through Telegram and shared images of the resulting vandalism. Investigations have documented the same recruitment model across Europe for surveillance, sabotage, and other criminal assignments.

The Metropolitan Police said Bilyk sprayed offensive graffiti at three mosques, Noor Ul Islam Primary School, and the Islamic Shariah Council on 23 and 25 January 2025. Images then appeared in a Direct Action UK Telegram group. Russian operators created the group to pose as a British far-right movement, the BBC reported. Bilyk will be sentenced on 19 October.

The handler, known as EL or “El Money,” also recruited through Telegram groups used by Ukrainians seeking work, the BBC found. Ukrainian builder Roman Lavrynovych was paid in cryptocurrency and steered from posters and graffiti to arson.

In May 2025, Lavrynovych set fire to a car and properties connected to Starmer. Nobody was injured. Lavrynovych was jailed for seven years, while Ukrainian-born Romanian national Stanislav Carpiuc was also convicted.

The BBC identified EL as Yevgeny Lyukshin, a 23-year-old Russian diplomat and son of a senior Foreign Ministry official. It cited matching personal details, his presence in the Direct Action UK chat, family connections, and information-warfare training from Rybar, a sanctioned pro-Kremlin Telegram outlet.

However, the BBC could not conclusively establish that Lyukshin was EL, while British police said they had no evidence the attacks were state-sponsored. Lyukshin did not respond. The Russian Embassy denied any connection between Russia or its Foreign Ministry and unlawful activity.

Paid local recruits make Russia-linked attacks look homegrown

The London operation is one of several cases across Europe and other continents.

UK intelligence warned that Moscow increasingly relies on non-state actors, meaning hired civilians and criminals outside its formal services, for espionage, sabotage, assassination, and information operations.

This month, US prosecutors alleged that another Russian network recruited local residents for surveillance, sabotage, and murder-for-hire.

Belarus sent tank and mechanized battalions to training grounds near Poland and Lithuania for four-day drills that Minsk says focus on border security, counter-sabotage operations, and defense against drones and light aircraft, Militarnyi reported on 17 September, citing the Belarusian Defense Ministry.

The exercise includes tank and mechanized infantry battalions, units typically used in conventional ground warfare. Minsk says their tasks include guarding checkpoints and infrastructure and defending against drones. Some drills are taking place near the Suwałki Gap, the only land route connecting Lithuania, Latvia, and Estonia to the rest of NATO. The corridor lies between Belarus and Russia’s Kaliningrad region, which is separated from the rest of Russia. Belarus denies any offensive intent.

What Belarus says it is practicing

Belarus’s Western Operational Command is holding the exercises from 15 to 18 September under Chief of the General Staff Pavel Muraveyko, according to the ministry’s schedule outlined by Militarnyi.

The drills are taking place at the Gozha range near Lithuania and at the Brest and Ruzhany ranges near Poland. RBC-Ukraine wrote that mechanized and tank battalions are taking part and that the Brest and Ruzhany sites lie about 15 and 60 kilometers from the Polish border, respectively. Reservists have also been called up to local territorial-defense units, the ministry said.

Militarnyi cited the ministry as saying that one unit guarded a water intake, another directed traffic with police, and a mechanized brigade manned a checkpoint with border guards. The ministry also said truck-mounted fire teams were posted around the clock to defend against drones and practiced firing at targets imitating surveillance drones.

Muraveyko said the army was not considering offensive action and called allegations of preparations for an attack baseless, according to remarks quoted by Militarnyi. Belarus has not disclosed the total number of troops involved, and the exercise’s scale has not been independently verified.

The Moscow Times reported that the ministry also claimed the exercise remained below the notification thresholds set by the 2011 Vienna Document, an international agreement requiring advance notice of large military exercises.

How Russia could exploit the Suwałki Gap

In December 2025, security analyst Taras Zhovtenko warned that Russian propaganda had laid the groundwork to cite an alleged blockade of Kaliningrad to justify a limited incursion and the establishment of temporary checkpoints.

A German war game later modeled Russia staging border incidents before seizing key routes, although Baltic officials said the scenario severely underrated their armed forces.

Separately, French open-source analyst Clément Molin found that defenses along the Polish and Baltic borders with Russia and Belarus remained patchy and shallow, with Lithuania the most exposed. These assessments describe possible vulnerabilities, not evidence that an attack is planned.