Denmark warns Russia could escalate hybrid attacks against NATO in coming months

Russia is likely to intensify its hybrid campaign against NATO and Western countries in the coming months, carrying out more frequent attacks with potentially greater consequences, Denmark's military intelligence service warned on Sept. 24.

The Danish Defence Intelligence Service (DDIS) said Russia had become increasingly willing to take risks as the security situation in Europe deteriorates.

"Russia will intensify its hybrid war by carrying out more frequent attacks against the West and NATO, with greater consequences for the targeted countries than in the past," the agency said in its latest threat assessment.

The attacks could include destructive cyber operations targeting critical infrastructure as well as sabotage carrying a significant risk of casualties, according to the assessment.

DDIS also warned of a "low but growing risk" that Russia could carry out a limited military attack against one or more NATO countries bordering Russia, even while the war in Ukraine continues.

"A limited military attack would be a desperate move on Russia's part" and could take place "in the coming months," the agency said.

Such an attack could involve isolated drone or missile strikes against infrastructure supporting Ukraine, with Russia potentially claiming that the weapons crossed into NATO territory because of Ukrainian electronic warfare, according to the assessment.

DDIS also said Russia could stage a false-flag attack using Ukrainian-made drones or deploy a limited number of troops, potentially without national insignia, into a NATO country bordering Russia.

The purpose would be to divert European resources away from Ukraine and test whether NATO members could agree on a collective response, according to the agency.

The warning comes amid a rise in suspected sabotage and other hostile activity across Europe. DDIS cited an attempted drone attack on Germany's Leipzig/Halle Airport, which German authorities have attributed to Russia, as well as warnings from Denmark's domestic intelligence service that Russia is preparing sabotage against Danish defence companies.

It also pointed to increasingly aggressive encounters between Russian and NATO forces in the Baltic Sea region. On Sept. 14, a Russian frigate off the Danish coast fired flares toward a Danish military helicopter sent to photograph the vessel, an incident DDIS described as the most serious involving Danish forces to date.

The assessment said Russia is currently under greater pressure than at any previous point in its war against Ukraine, citing heavy battlefield losses, Ukrainian long-range strikes and mounting strain on the Russian economy.

At the same time, DDIS assessed that Russian President Vladimir Putin remains unlikely to compromise on Moscow's core war aims and may see the next several years as a "window of opportunity" before European military capabilities grow significantly stronger.

Despite the increased risk of escalation, DDIS said it saw no indication that Russia was preparing a full-scale invasion of a NATO country. Such an invasion remains "highly unlikely," according to the assessment, although the agency said it could not be ruled out entirely.

The intelligence service estimated that Russia would need at least six months to prepare the forces required for an invasion.

Its previous assessment, published in February 2025, estimated that under certain conditions Russia could become capable of fighting a local war against a neighboring country within about six months, a regional war involving several Baltic-area states within roughly two years, and a large-scale European war within around five years.