Russia Intensifies Hybrid War Against NATO in 2026 — Limited Attack Becomes a Tool of Pressure

Denmark's Warning Indicates a Change in Risk Threshold

The most important figure in the new report from the Danish Military Intelligence Service is not the likelihood of a large war, but the phrasing "low, but growing risk" of a limited Russian attack on NATO countries in the coming months. The document dated September 24, 2026, discusses not an invasion by an army group, but isolated strikes with long-range weapons on infrastructure critical for supporting Ukraine. This distinction is fundamental. Moscow is likely not seeking a frontal confrontation with the Alliance, but is gradually testing how far it can push the practical limits of Article 5.

According to Denmark's assessment, the goal of such a strike would not be territorial capture. The Kremlin would aim to divert European resources from Ukraine, provoke a debate over the cost of supporting Kyiv, and force allies to choose between responding and managing escalation. In this sense, a limited attack would not be a military operation in the classical sense, but a political tool designed to elicit uneven reactions from twenty-nine European capitals.

From Sabotage to Forceful Signal

Danish intelligence simultaneously predicts an increase in Russian hybrid actions — major cyberattacks, sabotage with the risk of casualties, and operations against critical infrastructure. Almost immediately after the assessment was published, Polish authorities reported a fire at a Starlink ground station, which Deputy Prime Minister Krzysztof Gawkowski described as possible sabotage. Officials emphasized that final conclusions have not yet been made; however, Reuters noted that the Polish government is considering the incident in the context of a more aggressive Russian model of attacks.

It is important not to confuse accusation with proven fact. Russia's involvement in the fire has not been confirmed at the time of writing. But the sequence of events itself shows how the security environment has changed. An incident involving communication infrastructure, a cyberattack, or a drone near the border is now assessed not in isolation, but as elements of a unified coercion campaign. Moscow gains space for denial, while NATO faces a problem of collective attribution. This is the classic asymmetry of hybrid warfare: the initiator only needs to create doubt, while the defending side requires evidence and a coordinated response.

Military Logic of Moscow

Russian military thought traditionally views pressure below the threshold of a large war as a way to achieve operational advantage without formally declaring conflict. Soviet experience in political warfare, followed by practices after 2014, shows that military force is used alongside disinformation, energy blackmail, and demonstrative exercises. The novelty of 2026 lies in the scale of the risk. After four and a half years of war against Ukraine, Russian leadership, according to Denmark's assessment, has become more inclined to take dangerous steps. This may not be a sign of confidence, but rather a consequence of the depletion of conventional levers.

The Institute for the Study of War noted in its assessment dated September 20 that Ukrainian strikes on targets in the Moscow region have become the largest combined package of attacks on strategic objectives ahead of the last day of elections to the State Duma. The same material recorded Russia's continued use of long-range means and attempts to maintain the initiative at multiple levels. For Moscow, this creates an uncomfortable dilemma. On one hand, it is necessary to demonstrate to the population the ability to control the war space. On the other hand, strikes on Russian territory make vulnerability visible and push leadership to expand the geography of retaliatory actions.

However, a "limited attack" is not equivalent to a prepared invasion. Danish intelligence has explicitly stated that it does not see signs of a full-scale attack on a NATO country. The deployment of even a small number of unmarked soldiers at the border would require months and would be difficult to conceal. Therefore, the most likely scenario is a combination of sabotage, cyber operations, drone provocations, and a single forceful episode that the Kremlin could present as an accident or a response to Western actions.

The Belarusian Factor and Limits of Escalation

Belarus remains a convenient platform for such a strategy. It allows Russia to change the military geography of pressure without deploying all resources directly on its own territory. In October, joint CSTO exercises "Indestructible Brotherhood — 2026" and "Barrier — 2026" are scheduled in Belarus, along with other multilateral events throughout the year. Formally, these are collective security exercises. Practically, they provide Moscow with the opportunity to practice command, force movement, and crisis response scenarios in close proximity to NATO's eastern flank. This does not prove intentions to attack, but reduces warning time and increases the cost of error.

This is the main strategic effect of the Russian hybrid campaign. Even without territorial capture, it forces NATO to spend resources on securing infrastructure, enhancing air defense, protecting cables and satellite stations, and coordinating a political response to events that may individually appear criminal or accidental. The Russian system benefits from the very overload of the Western decision-making process.

Forecast

In the coming months, the most likely scenarios are not tank columns, but a series of checks — sabotage incidents, cyberattacks, dangerous drone flights, and strikes on logistics-related facilities aiding Ukraine. Their task will be to measure the response, rather than to immediately initiate war with NATO. But deterrence only works when red lines are clearly understood in advance. If allies argue over each episode separately, Moscow will continue to raise the price of risk in small steps. The Russian hybrid war will survive and strengthen not because Russia is boundlessly strong, but because the institutional indecision of the opponent remains a resource for it.

Sources: Danish Defence Intelligence Service, Assessment of the Threat from Russia, September 24, 2026; CNBC, September 25, 2026; Reuters, September 24, 2026; Institute for the Study of War, Russian Offensive Campaign Assessment, September 20, 2026; News.by, September 3, 2026.