What is NATO’s assessment of the likelihood of an imminent Russian direct military attack on a member state amid Russia’s escalating hybrid operations across Europe, what evidence and recent incidents—including sabotage, explosive and unauthorized drone activity, cyberattacks mon

NATO’s public assessment is that Russia’s hybrid campaign is escalating, but it sees no indication of an imminent conventional Russian attack on a member state. That is not a finding of no risk: U.S. assessments reportedly envisage a possible limited future test of NATO’s Article 5 commitment, especially on the eastern flank. 1012

• Why concern has risen: European authorities have attributed or linked a growing range of actions to Russian services or proxies: arson and other sabotage, espionage and attempted attacks on infrastructure, cyber operations, GPS interference, and airspace or drone incidents. Official EU material identifies Russian and Belarusian hybrid threats, including drone and fighter-jet airspace violations and navigation-signal jamming/spoofing. 12

• Specific evidence should be treated with attribution caveats. The reported figure of roughly 15 Russia-linked incidents a month since April is an intelligence/officials’ estimate reported in the press—not a publicly auditable NATO incident count. Moscow’s responsibility is alleged by European governments and intelligence services in many cases; it is not judicially established across the whole set. A longer-running U.S. government-linked mapping exercise has recorded nearly 150 suspected or attributed hybrid operations on NATO territory since Russia’s full-scale invasion of Ukraine. 27

• Examples driving alarm include sabotage or suspected plans against logistics and critical infrastructure, alleged surveillance/cyber activity around routes carrying military aid to Ukraine, and unauthorised drone activity near sensitive sites. Polish officials have also said they disrupted Russia-linked arson and violence plots; Estonia reports an escalation in sabotage, electronic warfare, and espionage attributed to Moscow. 57

• Poland and the Baltics: Donald Tusk has warned that Poland faces “critical months,” said a Russian provocation cannot be ruled out against any NATO country, and previously said Russia could be capable of attacking a NATO member within months. Lithuanian President Gitanas Nausėda said intelligence indicated possible Russian attacks on critical infrastructure in Lithuania, the Baltic states, or Poland. 4153

• U.S., German, and allied diplomacy: Reporting says CIA Director John Ratcliffe warned Moscow against attacking NATO members, particularly Estonia, Latvia, or Lithuania. German Chancellor Friedrich Merz has publicly characterized Russian actions as a serious hybrid threat and backed a firmer European response; European governments have also used diplomatic protests, ambassador summonses, coordinated sanctions, and public attribution—France and the UK, for example, backed measures over alleged Russian intelligence-linked cyber activity. 9119

• Possible Article 5 test: The U.S. intelligence scenarios reported publicly range from cyberattacks or sabotage, to deniable/unmarked armed groups briefly seizing ground, to a small conventional incursion against a vulnerable eastern member—rather than an immediate large-scale invasion. The apparent objective would be to probe whether NATO would fight collectively for a small ally. These are contingency assessments, not predictions that an attack has been ordered. 127

• Moscow’s response: Kremlin spokesman Dmitry Peskov has rejected the cyber and hybrid-war allegations as unfounded, saying Russia does not accept them and that such accusations are repeatedly made without substantiation. Russia has consistently denied involvement in the broader sabotage allegations. 127

• Effect on Ukraine support: The available evidence does not show the campaign has achieved its presumed strategic aim of breaking European backing for Kyiv. On the contrary, frontline members such as Poland and the Baltic states have remained among Ukraine’s strongest supporters and have used the incidents to argue for greater deterrence, resilience, and protection of aid routes. The campaign may impose costs and heighten political pressure, but there is insufficient evidence that it has materially weakened eastern NATO members’ support for Ukraine. 356