For some time after Russia's full invasion of Ukraine, there was a belief that Moscow's military involvement in this conflict excludes any serious threat to the alliance. In many Member States there was an atmosphere of complacency because it was believed that the risk was small. Some even suggested that the prolonged war with Kiev gives NATO more time to prepare.
Currently, these views change radically. The latest intelligence data indicate that Russia is preparing to attack NATO, even despite the ongoing war in Ukraine. Intelligence services of several Member States warn against the potential attack of Russia within three to five years and even earlier. These forecasts are supported by reports of the dynamic increase in Russian weapon production, which currently seems to be intended not only for the Ukrainian front – it is allegedly collected for use against NATO.
Particularly disturbing are reports from countries located on the northern NATO flank, which just a few years ago recorded the minimum presence of Russian troops along their borders, and now inform about preparations to strengthen the armed forces. The recent report of the Finnish YLE television station contains a lot of interesting information. Major Marko Eklund, a retired Finnish military intelligence expert with many years of experience in Russia, drew attention to satellite photos showing construction works started in winter last year and excavations on a large scale in two strategically important military garrisons.
One of them, Lupche-Savino, located near the northern city of Kandalaksza, is located about 110 km from the Finnish border and guards access to extremely important military infrastructure on the Kolski Peninsula. Satellite photos suggest that a military settlement is being built there, which will probably accommodate the artillery brigade and an engineering brigade, with a total of about 2,000 soldiers. The second, sapernoje, on the Karelian isthmus, is about 70 km from the border with Finland. This place recalls the memories of the Winter War of 1939-1940, when Finnish defenders, suffering huge losses, maintained the isthmus and saved their country from occupation. Equipment currently delivered to Sapernoje indicates that this place is prepared to accept engineering troops with pontoon bridges. Photos also show the grubbed forest line, probably under the gas pipeline.
In general, Russia is reportedly planning to create a new corps of the army in Karelia, which would increase the number of soldiers near the border with Finland by another 15,000. In Pietrozawodsk, where there is also a staff of a mixed aviation division, a brigade of railway soldiers was created. Major Eklund states that these activities should be taken seriously. Before the full invasion of Ukraine in the Leningrad Military District, which still bears its former name, only about 30,000 were stationed. soldiers. Current plans suggest that this number may soon reach 100,000, and several hundred basic tanks will join. The Finnish government clearly responds to these activities. Defense Minister Antti Hakkanen said: “We know very well what Russia is doing, and we are preparing for this as part of our own defense.”
At first glance, the fears of the upcoming war may seem exaggerated. Since the war with Ukraine will most likely last for many years, Russia may have difficulty mobilizing enough soldiers for full invasion of Finland, which can mobilize 280,000. soldiers and has the most powerful artillery forces in Europe. In addition, ongoing reinforcements in the countries of “Nordic-Baltic Eight” (“Northern Baltic Eight”) and the creation of a joint aviation command of Nordic countries mean that an attack on a smaller Baltic State belonging to NATO seems unlikely. Common determination in the field of coordinated defense seems very credible.
Minister of Foreign Affairs Radosław Sikorski and Denmark Minister Lars Loekke Rasmussen during a press conference after the meeting of foreign ministers of member states of eight Nordic and Baltic countries (NB8) on the island of Bornholm in Denmark, 29 April 2025.
Hybrid operations
The escalation of various hybrid operations aimed at checking the determination of target countries and assessing how far you can go in provocations is more likely before they cause serious remedies. The scope of such activities is expanding at a alarming pace, from drones flights to sabotage of underwater cables and key land infrastructure. Although the governments of the target countries are often reluctant to share full information, it is clear that airports and communication towers are examined, mysterious burglaries and energy transmission in the supply nodes occur, and suspicious vehicles revolve around the military installations.
The obvious goal is to identify weak points, measure reaction time and develop action schemes. Sometimes these provocations are deliberately open to inform the media and public opinion. As this process develops, a comprehensive list of previously prepared activities is created, which are then practiced. In a crisis situation, they may be launched as part of a combined operation against one or several target countries.
Although the degree of penetration is different, it can be safely assumed that in all target countries there are a significant number of supporters of Russia and secret agents who can be mobilized to support such activities. In some cases, Russian agents even obtained the support of local organized crime members who receive a high remuneration for conducting provocative sabotages.
In Sweden, probably the most vulnerable from the Scandinavian countries, the last police investigations revealed the theft of expensive speed cameras, which were later found in Russian drones in Ukraine. It was also revealed that the recently coordinated action caused the power supply to all communication towers along the east coast of the country, south of Stockholm. Norway reports the severity of hybrid activities both on the northern Svalbard archipelago and along the border with Russia in the Finnmark region. Finland and the Baltic States are more restrained, but it can be safely assumed that the level of Russian reconnaissance increases in all areas.
The case of Russian sabotage operations against critical underwater infrastructure illustrates the disturbing disproportion in the readiness of individual countries to oppose Russian provocations. On December 25 last year, the Eagle S tanker was observed in the Gulf, associated with Russia, floating under the flag of the Cook Islands and covered by sanctions as part of the Russian “shadow fleet”, which pulled the anchor for 100 km. This action caused the interruption of submarines, including a communication connection between Finland and Estonia. In a surprising move, the Finnish special forces entered the helicopter tanker and forced him to wrap him into the port, where he remains in anticipation of court proceedings.
The ship of the Finnish coastal guard (P) and tanker Eagle S anchored near the Port of Kilpilahti in Porvoo, in the Gulf of Finnish, December 30, 2024.
A month later, on January 27, another ship associated with Russia was observed, the Maltese freighter “vezhen”, which pulled the anchor for another 100 km, this time in the Central Baltic Sea. He interrupted the communication cable between Sweden and Latvia. Following the example of Finland, the elite unit of the Swedish police entered the ship and forced him to wrap it to the port. The difference, however, was that just a week later the Swedish prosecutor stated that “it could certainly be said that this was not a case of sabotage” and the ship was released.
In May, Estonian patrols were sent to capture Jaguar – a third ship associated with Russia, without flags, but registered in Gabon – who sailed to the Russian port, probably in order to load oil in violation of sanction. When he was ordered to stop at the anchor to carry out an inspection, he refused. Shortly afterwards, the Russian Su-35 fighter appeared, which violated the Estonian airspace for about a minute, apparently to warn Estonians to give up. After submitting an official complaint, the Estonian government allowed Jaguar to continue the course.
Although no of this indicates the upcoming war with any Baltic or Scandinavian country, it indicates that Russia is openly preparing for serious provocations. They may include significant actions against infrastructure, be combined with cyberwar, and even the participation of “small green people” (Russian soldiers in unmarked uniforms, such as those participating in the Russian military operation aimed at taking the Crimean Peninsula in Ukraine) acting in consultation with Russian sympathizers and sleeping agents. This strategy aims to move the boundaries as far as possible, in different directions, without causing serious retaliation.
The actions of the Finnish special forces were probably a surprise, which suggests that Russia went “a bit too far”, but this did not change the Kremlin course. The case of Sweden showed the low credibility of the threats of serious counter -medium, while the case of Estonia showed that in a crisis situation the threat of using force will eventually prevail. The day when NATO aviation shot down the Russian fighter violating the airspace of the country will probably not come in the near future. The only country of NATO that did this is Türkiye, which in November 2015 shot down the Russian SU-24M assault aircraft operating over Syria, which briefly entered the Turkish airspace. Although Russia's reaction was limited to threats, which she withdrew, it seems very unlikely that any other NATO country would make a similar attempt.
Scenarios
Rebuilding its military abilities in the event of a potential conflict with NATO, Russia at the same time counts on the possibility of escalation of hybrid operations, assuming that target countries are poorly prepared for serious confrontations. Of the three likely scenarios, two can be very unfavorable.
Probable: gradual escalation
The scenario clearly preferred by Russia assumes a gradual escalation of provocation. As the target countries get used to different incidents, every new provocation can go a step further. In the meantime, Russian trolls and local supporters will use social media to convince that further “provocations” towards Russia can only lead to a disaster. The ultimate goal is to put out a sufficient impact on the political sphere to achieve a more friendly political environment.
Less likely: exaggerated reaction and retaliation
An alternative scenario assumes that Russia will go too far, leading provocations to the point where retaliation will become inevitable, and Moscow considers it necessary to maintain the pace by further escalation. Such provocations may include, among others, ramming ships at sea and collision in the air of fighters, disasters of civil passenger aircraft at airports as a result of cyber attacks and serious contamination of water resources.
The most likely scenario: a definite reaction
The most likely scenario is the further increase in tension, but the countries they relate will manage to develop a policy of resolute but balanced reactions, combining determination with preventing escalation of armed conflict. Nevertheless, accidents can still occur, and reactions can be dictated by strong emotions. In this case, the security situation in the Baltic Sea region will be further tense and the outbreak of war cannot be ruled out.
