Russia Targets NATO Frontline States

On December 31, 2025, Finnish and Estonian authorities seized the Fitburg cargo ship in the Baltic Sea for attempting to damage an undersea telecoms cable running from Helsinki to Estonia. The Fitburg, which had departed from St. Petersburg, allegedly dragged its anchor along the Baltic seabed and damaged a cable located in Estonia’s exclusive economic zone (EEZ) (Finnish Customs, January 1; Police of Finland, January 12). It was sailing under the flag of St Vincent and Grenadines and captained by Russian citizen Andrei Maksimenko (Police of Finland, January 3; ERR, January 12). The authorities have since released the vessel and taken a crew member, an Azerbaijani citizen who boarded the vessel in St. Petersburg, into custody. They have also issued a travel ban for several other crew members (ERR, January 12). One former Estonian Navy commander said that “if data cables were fully severed, and ATMs and card payments stopped working, that impact would be huge” (ERR, January 12).

In Poland, Russian offensive tactics include sabotage, propaganda, and recruitment of refugees for espionage (see EDM, June 9, July 22, 2025). In response to these mounting threats, the Polish government has begun preparing for the possibility of direct military confrontation (see EDM, April 4, 2025). Between 2010 and 2025, 35 percent of Europe’s arrests for Russian-linked espionage and sabotage occurred in Poland (see EDM, May 8, 2025). Since Russia’s full-scale invasion of Ukraine in 2022, Russian activity inside Poland has targeted military bases, airfields, and adjacent transportation networks (see EDM, May 8, 2025). In September 2025, at least 19 decoy Gerbera drones entered Polish airspace during a large-scale Russian strike on Ukraine (see EDM, September 15, 2025). This was the first time NATO engaged Russian military assets over alliance territory.

Drones are not the only aircraft detected and intercepted by NATO frontline states. During the Christmas period, Polish air defense services intercepted and escorted a Russian reconnaissance plane away from international waters of the Baltic Sea (Polskie Radio, December 25, 2025). Polish Armed Forces Operational Command said that the aircraft was flying near Poland’s airspace borders. Around the same time, reports indicated that 59 weather balloons, likely carrying smuggled goods, had entered Polish airspace via Belarus (RMF24, December 29, 2025; RBC-Ukraine, December 30, 2025).

In the Baltic states, Russia uses numerous tactics. These include information warfare, propaganda, subversion, covert violent action, conventional aggression, targeting social groups, influencing elections via cyber and information operations, cyber-attacks, targeting energy infrastructure, and initiating mass illegal migration (see EDM, May 27, 2025). Russia’s Foreign Ministry is advancing the narrative that the West is using the Baltic states to threaten Russia and that the Baltic Sea is now “a potential theater of military operations” (see EDM, September 4, 2025). Estonia, Latvia, and Lithuania officially disconnected their power grids from Russia in February 2025 to reduce Moscow’s ability to manipulate their electricity supply (see EDM, February 20, 2025). The three states are in regular discussions with the United States to strengthen critical energy infrastructure security and reduce reliance on, or the threat from, Russia. The latest of these Baltic 3+1 Energy Dialogues emphasized the potential increase in U.S. liquefied natural gas (LNG) imports into the Baltics, as well as the development of nuclear technology (Lithuanian Ministry of Foreign Affairs; U.S. Department of Energy, November 7, 2025). The Baltics have been exploring alternative nuclear technologies in response to Russia’s threats to their energy security, including discussions to develop small modular reactors (SMRs) in collaboration with Sweden, Finland, and Poland (Government of Poland, September 10, 2025).

This potential military theater is already a site of regular Russian interference and offensive behavior, both above, on, and beneath the surface. Earlier in January, a Russian border guard vessel remained in Estonian territorial waters for roughly 35 minutes without permission (ERR, July 28, 2025). In December, Estonian Defense Forces detected three Russian MiG-31 fighter jets that remained in the country’s airspace without permission for nearly 12 minutes before being escorted by Italian Air Force F-35 fighter jets stationed as part of NATO’s Baltic Air Policing mission (ERR, September 19, 2025). Earlier in 2025, Lithuanian officials announced they found two kilograms of explosive material in a drone that had crashed in Lithuanian territory. The drone had entered Lithuania from Belarus after Ukrainian defense systems altered its flight path (LRT, August 5, September 17, 2025; Delfi, August 6, 2025).

Czech intelligence services recently reported that Russia is fostering an extensive espionage network operating under diplomatic cover inside the country, according to the Czech security services’ annual report for 2024, released in July 2025 (Security Information Service, July 10, 2025; see EDM, July 22, 2025). The report detailed that Russian operatives recruit individuals, including journalists, members of organized crime groups, and economically vulnerable migrants from non-EU countries, to carry out intelligence tasks. Recruits are often unaware they are working on behalf of Russia because intelligence officers rely on intermediaries. 

Hungary and Slovakia have also faced Russian-instigated cyberattacks and hybrid threats despite their energy dependence on Russia and closer relations with Moscow than other European states. In March 2022, Russian security services instigated a cyberattack that infiltrated the Hungarian Ministry of Foreign Affairs, including the ministry’s network and a secure network for transmitting classified information (Hungary Today, April 14, 2022). Hungarian officials publicly denied the attack had taken place, calling it “election lies” (444, May 16, 2024). Hungarian media later found that the Ministry of Foreign Affairs had known about the attack based on a letter by a Hungarian intelligence services head (UNN, May 16, 2024).

In May 2025, a report jointly released by the United States and several European states revealed that a Russian state-sponsored cyber campaign had been targeting surveillance cameras across Europe and the United States since 2022 (Joint Cybersecurity Advisory, May 2025). This campaign targeted approximately 170 cameras in Slovakia, 280 in Hungary, 200 in Poland, and 990 in Romania, with the remainder largely located in Ukraine. Slovakia had already been targeted in May 2024 by Russian hacker groups in a Central Europe-wide cyberattack, during which the groups issued bomb threats via email to Slovak schools, banks, and electronic retailers (TVP World, May 8, 2024).

Russia’s offensive behavior along NATO’s frontline is a sustained effort to exploit and manufacture vulnerabilities and to test NATO’s commitment to its own defense, as well as to Ukraine. Without its war against Ukraine, Moscow loses a substantial degree of its ability to deny, blame, or excuse breaches and threats toward NATO. A meaningful peace agreement would deprive Russia of the plausible deniability on which it has come to rely. For that reason, the Kremlin will continue delaying and derailing negotiations until compelled to do otherwise.

Anna J. Davis is Fellow of Eurasia Studies at the Jamestown Foundation and a contrinuting editor of Eurasia Daily Monitor. She is an expert on nuclear energy policy and international relations, with a focus on the Eurasia region and the Arctic.

This article appeared originally at The Jamestown Foundation's Eurasia Daily Monitor.