Russia may not wait for its war in Ukraine to end before testing NATO. Moscow could launch a limited attack on an allied country on its border within months, Danish intelligence warns. It might even make the strike look Ukrainian, betting that the allies would split over how to respond.
In an assessment released on Thursday, the Danish Defence Intelligence Service describes the risk as low but growing, with a country bordering Russia the likeliest target. It sees no indication that Moscow is preparing a full invasion of NATO territory and considers one highly unlikely. The concern is that Russia might attempt something smaller if it believes the allies would struggle to agree on a military response.
The warning goes beyond Denmark’s February 2025 assessment. That report set out when Russia could become ready for a local or wider war if the fighting in Ukraine ended or froze. Those timelines still stand, the agency says. But it now believes Moscow could attempt a limited attack sooner, even before assembling the forces required for a larger conflict.
A limited attack to test the alliance
The Danish report describes several ways Russia might make an attack difficult to judge or attribute. It could strike infrastructure vital to supporting Ukraine with a long-range weapon, then claim Ukrainian jamming caused it to hit NATO territory. It could use a Ukrainian-made drone to disguise responsibility, or send a small number of troops without national insignia into a neighbouring country.
“A limited military attack would be a desperate move on Russia’s part,” the agency says. It believes Moscow might nevertheless take that risk to divert European resources from Ukraine and create divisions within NATO. A ground incursion would probably require months of preparation near the border, making it difficult to conceal.
NATO Secretary General Mark Rutte responded on Thursday to the report’s finding that a full invasion remains highly unlikely. “They’d better not, because they know we are ready and they will not win that,” he said. Czech intelligence chief Michal Koudelka told the Guardian that a smaller incursion or provocation could occur in “months, not years”. Latvia’s security chief, however, said he saw no signs of an imminent attack.
Sabotage is the more immediate warning
Denmark’s military intelligence service expects Russia to intensify its campaign of sabotage and destructive cyberattacks against NATO countries in the coming months. It says Moscow is increasingly trying to interrupt aid to Ukraine, including by targeting defence companies and rail transport carrying military equipment. Earlier attacks mainly aimed to frighten the public and weaken support for Kyiv.
Denmark’s domestic Security and Intelligence Service (PET) says it has seen Russian preparations for sabotage in Denmark, particularly against businesses involved in military support for Ukraine. It has no information about an attack planned for a particular place or time. PET warned on Thursday that further escalation could also put critical infrastructure and essential services at risk.
They’d better not, because they know we are ready and they will not win that. — Mark Rutte, NATO Secretary General
Mr Rutte argued that NATO must avoid letting such attacks draw its focus away from Ukraine. His answer to further Russian pressure, he said, was to maintain the alliance’s defences and increase support for Kyiv.
A disputed CIA warning
The Danish assessment follows a report by Spanish newspaper El Mundo. It said US intelligence had warned European governments of a possible Russian drone operation against Spain, France, or Italy. According to the newspaper, Moscow could launch drones from ships at sea, allowing it to reach countries far from its borders. These are El Mundo’s reported findings; the alleged CIA assessment remains unpublished.
There is evidence of broader US concern. Polish Prime Minister Donald Tusk said earlier this month that he had received a CIA report about possible developments in the coming months. Reuters has also reported that CIA Director John Ratcliffe raised the possibility of a Russian operation against a NATO member during an August visit to Moscow. Neither account confirms the specific warning about attacks on southern Europe that El Mundo described.
France and Italy have disputed that part of the story. French President Emmanuel Macron said the CIA had not warned France of such an operation, while Italian Defence Minister Guido Crosetto said the reported alert lacked confirmation. The European Commission said it was aware of the media report, but not of a specific intelligence warning. Denmark’s published assessment, meanwhile, concerns possible military attacks on countries bordering Russia.
