Russia’s Hybrid War Is Exploiting the Threshold NATO Refuses to Define: Russia says hundreds of Ukrainian drones targeted Moscow and the surrounding region earlier this week, wounding ten people. Kyiv said an oil depot and logistics facilities were among the targets. Zelensky has described the strikes as a way of putting greater pressure on Russia to end the war. The point is to make it harder for the Kremlin to treat that war as something happening somewhere else.
The question many are asking after these strikes is whether Putin will now escalate the conflict by retaliating against NATO. That is the wrong way to frame it. Russian pressure on NATO is not the next rung on the escalation ladder. Moscow has been applying such pressure for two years now, through sabotage, infrastructure disruption, and cyber intrusions built to stay under whatever line would force the alliance to respond as one.
F-15 Elephant Walk in 2022. Image Credit: Creative Commons.
Lt. Col. Richard Turner, 40th Flight Test Squadron commander, pilots the F-15EX, the Air Force’s newest fighter aircraft, to its new home at Eglin Air Force Base, Florida March 11. The aircraft will be the first Air Force aircraft to be tested and fielded from beginning to end through combined developmental and operational tests. The 40th FLTS and the 85th Test and Evaluation Squadron personnel are responsible for testing the aircraft. (U.S. Air Force photo/Samuel King Jr.)
A direct attack on NATO would mean opening a second front against a stronger alliance, a risk Moscow has avoided throughout the war. What it has not avoided is a deniable campaign against NATO states themselves.
NATO tracks this activity. The Joint Intelligence and Security Division runs a Hybrid Analysis Branch built for exactly this kind of cross-border pattern spotting, and the alliance has said a sufficiently serious hybrid campaign could meet the threshold of an armed attack under Article 5. The awareness is there. What isn’t is an agreed answer to the harder question: how much ambiguous activity, stacked up over time, counts as one campaign, and what happens once it does.
Cables, Courts, and What Actually Gets Proven
Start with the Baltic seabed, since it’s the case people misread most.
By January 2025, at least eleven cables and pipelines in the Baltic had been damaged since October 2023, several involving ships carrying Russian cargo or sailing from Russian ports. More incidents followed after that count was taken. NATO stood up Baltic Sentry after several incidents involving critical undersea infrastructure, with the aim of deterring further damage.
Almost none of it has produced proof that Moscow ordered a specific act. A Finnish court threw out the case against the crew of the Eagle S, the tanker Finland had already flagged as part of its shadow fleet, after prosecutors couldn’t show the anchor-dragging off Estonia was intentional; the court treated it as a navigational matter outside its jurisdiction.
Swedish investigators found no conclusive evidence the Yi Peng 3 deliberately cut cables, though a prosecutorial inquiry stayed open. The captain of the NewNew Polar Bear, tied to Balticconnector pipeline damage from 2023, pleaded not guilty in a Hong Kong courtroom this past February, in a case working through a legal system with no connection to how NATO makes decisions.
What happened physically in most of these cases isn’t really in dispute. Ships dragged anchors. Cables snapped. Intent is the open question, along with whether any of it traces to a Russian order. GUGI, Russia’s deep-sea unit, operates specialized underwater systems tied to espionage and, credibly, sabotage. Having the capability says nothing about whether it was used on any of these three ships.
Poland gives the argument sturdier ground. A Warsaw court convicted three men this past October of belonging to a group organized for sabotage and terrorism across Poland and the Baltic states. Polish and Lithuanian officials have separately tied a 2024 shopping-center fire in Warsaw and an IKEA arson in Vilnius to Russian direction. The Warsaw case carries weight the cable cases don’t. It ended in a verdict.
The Alliance Isn’t Blind. It Just Hasn’t Decided
NATO is not failing to notice its own front yard. Intelligence-sharing across the alliance is constant.
What’s missing is a declared standard, something closer to policy than intelligence, for what the aggregated picture should cost Russia. Attribution stays largely national, and any government that wants to avoid a confrontation can point to a single case file and note, correctly, that it doesn’t clear a criminal bar. Who decides isn’t really the mystery. The North Atlantic Council decides, by consensus, the same as it does everything else. What pattern of activity should force that conversation, and what the alliance is willing to do once it’s had it, is the part NATO has never publicly written down.
Copenhagen Airport makes the point concretely. It shut down for hours last September, widely suspected at the time of being connected to Russian activity. Danish police closed the investigation this past June without confirming the objects were even drones, let alone naming a suspect, though Denmark’s military separately confirmed drone activity over its own installations around that period. Set against confirmed Russian military incursions into the airspace of several NATO members, and against cyberattacks European governments have formally pinned on Russian intelligence, Copenhagen sits in a large middle category: incidents allied governments regard as potentially hostile, never resolved as anything more specific.
Vilnius adds a different piece. Latvian President Edgars Rinkēvičs said July 15 that intelligence shared among Latvia, Lithuania, and other NATO states pointed to various Russian attempts at sabotage. Lithuanian President Gitanas Nausėda said separately that Lithuania had intelligence pointing to planned Russian attacks on infrastructure. That’s a public attribution from a sitting head of state, and real evidence that allies are comparing notes. Attributing an act to Russia and deciding what the alliance does about it are different steps, though, and only the first one happened in public in Vilnius.
There’s a reason NATO hasn’t published a formula for any of this. A declared cumulative threshold could turn into an instruction manual, telling Moscow exactly how far it can go before crossing a line. The ambiguity has its own price, though: it lets any government argue that the newest incident, taken on its own, doesn’t justify anything more than another investigation.
What Comes After the Headlines Fade
The Moscow strikes will drop out of the news within a week or two. The question of whether Putin will suddenly escalate into an overt attack on NATO was never really the one that mattered.
An overt Russian strike on NATO soil would force an urgent conversation among allies, even if Article 5 still leaves each government to judge what response it considers necessary. More likely, and harder to counter, is more of what’s already underway: another damaged cable, another unresolved intrusion, each one investigated, each one closed, none of it clearing a cumulative cross-domain threshold the alliance has never publicly defined.
NATO can already see enough of the pattern to know it’s a pattern. What it hasn’t decided is what that pattern should cost Russia.
About the Author: Dr. Andrew Latham
Andrew Latham is a professor of international relations and political theory at Macalester College in Saint Paul, MN. You can follow him on X: @aakatham.
