When in August 2025 I wrote “Trojan Horse in the Baltics: How Russia Will Launch a Stealth Attack” for Kyiv Post, I argued that Russia’s next move against the Baltic states might not begin with tanks crossing the border. The reasoning was straightforward: Moscow’s most effective opportunity would be to create disruption from within, exploit local vulnerabilities, activate disposable proxies and force NATO governments to debate whether an attack had even taken place.
Less than a year later, this is no longer merely a theoretical scenario.
JOIN US ON TELEGRAM
Follow our coverage of the war on the @Kyivpost_official.
In late June 2026, Latvian intelligence warned that it was seeing indications that Russia could be preparing military provocations against the Baltic states or Poland. A senior source from another NATO country reported similar intelligence. Polish Prime Minister Donald Tusk subsequently warned that the regional security situation was highly unstable and that different forms of escalation could be expected in the coming weeks and months.
Polish security authorities have also warned that Russian services are seeking to exploit tensions between Poles and Ukrainians, while showing interest in military facilities, critical infrastructure, aid organizations and other locations connected with support for Ukraine.
The significance of these warnings lies not only in their urgency. They point toward a model of confrontation that is fundamentally different from the invasion scenario around which much of Europe’s defense debate is still organized.
12 Injured in Zaporizhzhia After Russian Airstrikes
The question is not simply whether Russia will invade a NATO country.
The more immediate question is whether Russia can create a crisis inside NATO territory that remains ambiguous long enough to divide political leaders, delay decision-making and test the credibility of collective defense.
The Wrong Question: When Will Russia Invade?
The European debate continues to focus heavily on timelines. Will Russia be ready to attack NATO in two years, five years or eight years?
This may be the wrong framework.
Russia does not need to launch a full-scale invasion to challenge NATO. It needs to find the threshold below which the Alliance hesitates and above which fear, disruption and political division begin to spread.
A limited drone or missile incident, sabotage against energy or transport infrastructure, an armed maritime confrontation, coordinated cyber disruption, an engineered border incident or violence disguised as local unrest could all serve the same strategic purpose.
The objective would not necessarily be territorial conquest.
The objective could be to test the political nervous system of NATO.
Would governments agree on attribution? Would they agree that Article 5 was relevant? Would the United States support an immediate response? Would European governments act before investigators had established a complete chain of evidence? Could Russia create disagreement between those demanding restraint and those demanding retaliation?
These questions are precisely why the language we use matters. The term “hybrid warfare” has become so broad that it sometimes conceals more than it explains. Sabotage is sabotage. Espionage is espionage. An armed provocation is an armed provocation. A state-directed attack carried out through a proxy does not become less serious merely because the perpetrator is not wearing a uniform.
The West should call actions by their proper names.
The Baltic vulnerability is societal as well as military
Estonia, Latvia and Lithuania are among NATO’s most committed members. Their defense spending, military modernization and awareness of the Russian threat are considerably stronger than they were a decade ago.
But military preparedness alone does not eliminate societal vulnerabilities.
Estonia and Latvia have substantial Russian-speaking populations, while Lithuania faces a somewhat different but equally complex environment of information influence, historical narratives and cross-border pressure.
This must be discussed carefully. Russian-speaking citizens and residents should never be treated collectively as a security threat. The overwhelming majority are not agents of Moscow.
But Russian intelligence services do not need a majority. They need networks, access, grievances, money, intimidation, criminal intermediaries and a relatively small number of individuals willing to carry out specific tasks.
Russia’s security services have repeatedly demonstrated a preference for recruiting disposable proxies: criminals, financially vulnerable individuals, extremists and other intermediaries who can be contacted through encrypted messaging services and paid to conduct surveillance, vandalism, arson or sabotage.
The strategic danger lies in combining these networks with genuine social grievances and political tensions.
A demonstration can be real and still be exploited. A local conflict can be genuine and still be amplified. A criminal act can be privately executed and still be state-directed.
This is the grey area in which democratic governments often lose valuable time.
From Resilience to Resistance
For years, European security policy has emphasized resilience. The concept remains important, but it is no longer sufficient.
Resilience is the capacity to absorb disruption and recover. Resistance is the capacity to prevent an adversary from achieving political control, operational paralysis or strategic advantage through that disruption. The Baltic states and other frontline countries now need to move from a predominantly resilience-based approach toward active societal resistance.
This means that local authorities, police, rescue services, border guards, defense forces, intelligence agencies and critical infrastructure operators must be prepared to operate together from the first minutes of a deliberately ambiguous crisis.
The first hours are decisive. A blockade of a logistics hub cannot be treated only as a public-order issue if it is simultaneously obstructing military mobility. A fire at an energy facility cannot be treated only as an industrial accident if it is part of a coordinated campaign. A protest at a border crossing cannot be understood solely through domestic politics if foreign intelligence services are financing organizers or manipulating communications. A cable break, drone incursion, cyberattack and street disturbance may appear unrelated when viewed through separate institutional channels. Seen together, they may constitute an operation.
The central weakness of European preparedness is still fragmentation.
Information remains divided between institutions. Legal mandates are separated. Civil and military situational awareness do not always meet quickly enough. Cross-border communication often depends on personal relationships rather than permanent operational structures.
Russia studies these seams.
The first battlefield may be administrative confusion
The most dangerous Russian operation against the Baltic region may not initially look like war. It may look like confusion.
Several simultaneous incidents could emerge: a transport disruption, a suspicious infrastructure failure, drone activity, cyber interference, a violent protest, a maritime confrontation and an information campaign blaming the government for the resulting instability.
Each incident would have an apparently separate explanation. Together, they could overwhelm decision-making.
This is where the original Trojan Horse problem becomes relevant. The threat is not that entire Russian-speaking communities suddenly rise against their states. Such a scenario is both unrealistic and politically dangerous.
The real risk is much narrower and therefore more plausible: small numbers of recruited or manipulated individuals operating inside a larger environment of genuine uncertainty.
Their purpose would be to create the appearance of spontaneous disorder while external information operations amplify the crisis and Russian political messaging presents Moscow as the defender of stability or of allegedly threatened Russian speakers.
The purpose is not necessarily to win militarily. It is to create a political situation in which NATO is uncertain about how to respond.
NATO must prepare for the test before it happens
The recent intelligence warnings should therefore not be treated as predictions of a traditional invasion. They should be understood as warnings of a possible test.
Russia may seek to discover how far it can go before NATO reacts collectively. That test could occur in the Baltic Sea, at a border crossing, around critical infrastructure, through an unmanned system, or inside a city.
The response cannot begin after the legal classification of the incident has been completed.
The Baltic states, Poland, Finland and the Nordic countries need permanent mechanisms for shared operational awareness and rapid cross-border crisis coordination. Civil security interoperability must be treated as seriously as military interoperability.
Europe must also reconsider the artificial distinction between peace and war. Russia has operated across this boundary for years. Western institutions continue to organize themselves as if the distinction were clear.
It is not.
The lesson from Ukraine is not only that warnings must be taken seriously. It is that the defender must recognize the nature of the confrontation before the aggressor defines the battlefield.
In August 2025, I argued that the enemy may already be inside the operational environment long before the first conventional shot is fired.
The warnings of summer 2026 make the conclusion more urgent.
Do not wait for Russian tanks at the border to decide that an attack has begun. By then, the real operation may already have been underway for days.
The views expressed in this opinion article are the author’s and not necessarily those of Kyiv Post.
You can also highlight the text and press Ctrl + Enter