Russian Hybrid Threat to Persist in the Baltic States Over the Coming Months

Russia will continue expanding hybrid operations into kinetic sabotage and targeted attacks in Latvia, Lithuania, and Estonia through late 2026. There are strong indications that Moscow-engineered hybrid activity in the Baltic states has escalated from cyber and influence operations to kinetic sabotage and targeted assassinations, reflecting the development of structured, locally embedded networks. In recent months, Russia has increasingly leveraged proxy operatives, criminal intermediaries, and regional enablers to execute sabotage, intimidation, and influence operations.

This shift was emphasized on April 27 when Lithuanian authorities charged a network of 13 individuals linked to Russia’s military intelligence agency, known as the GRU. They were reportedly engaged in a range of hybrid and sabotage activities, including surveillance, harassment, planned assassinations, arson, and financial support. Moscow is increasingly using these networks to generate a sustained climate of fear among pro-Ukraine actors, civil society figures, and Russian dissidents. The Baltic states' expanding role as a logistical and forward-defense hub for NATO has accelerated Russian sabotage operations in the region. Targeted harassment, intimidation, and proxy violence are being used to increase perceived personal risk for politically active individuals. 

Moscow is sharpening its information operations to shape contested identity narratives in the Baltics and deepen distrust of Baltic governments and the EU. These campaigns rely on Russian-language media, social media amplification, and local proxy voices to exploit ethnic and linguistic grievances, particularly around identity, discrimination, and NATO’s regional presence. This strategy is particularly visible in Narva, Estonia, where pro-Russia elements are flooding online forums with information about pro-Russia separatist sentiment in the largely-Russian-speaking region.

While the majority of Baltic populations continue to support NATO and Ukraine, these narratives are likely resonating among segments of Russian-speaking communities that already distrust central authorities as opposed to a wider audience across all three Baltic countries.

At current levels, the Russian-engineered information operations are unlikely to generate large-scale separatist sentiment or destabilize Baltic governments. However, similar campaigns will likely deepen social fragmentation and distrust of state institutions, while creating a persistent low-level climate of tension that Russia can continue to exploit over the long term. 

Russia will likely intensify hybrid and signaling activities, including increased naval and air activity intended to demonstrate military presence, in response to ongoing NATO exercises in the Baltic region and key pro-Ukraine political developments in the coming months. Moscow’s move toward a heightened level of hybrid activities during these periods will increase the risk of localized security incidents such as airspace violations, GPS disruption, or cyberattacks.

Moscow will almost certainly raise its military posture in Kaliningrad and the Baltic Sea via parallel naval and air drills. Concurrently, Russia will likely conduct coordinated information campaigns to frame NATO's footprint as escalatory, exploit existing societal divisions, and undermine public support for the alliance. Additionally, Russia will also likely continue GPS jamming and spoofing activity in the Baltic Sea, primarily as a defensive electronic warfare measure, but one that can be calibrated as a hybrid tool with disruptive spillover effects on civilian aviation and maritime operations.

However, the overall risk of direct military confrontation remains low, primarily because Moscow will almost certainly aim to calibrate its actions below the threshold of conventional conflict to avoid triggering a unified NATO response. Moscow has the ability to expand targeting of critical regional infrastructure, including energy networks, telecommunications assets, and rail lines, in an attempt to degrade regional resilience, create economic pressure, and disrupt military mobility.

To the benefit of Moscow, Western countermeasures in the Baltic region remain fragmented and largely reactive, limiting their effectiveness against coordinated hybrid activity. 

While the overall security environment for the Baltic states will remain stable through much of 2026, Russia’s pursuit of hybrid activity will continue to generate localized disruptions and operational risks for businesses and personnel.

• Increased exposure to infrastructure disruption: Energy, telecommunications, and transport sectors face elevated risk of localized sabotage and cyber incidents, potentially resulting in temporary service outages and operational delays.

• Heighten personnel security risks: Pro-Ukraine activists, Russian dissidents, and politically exposed individuals face an increased risk of harassment, intimidation, or proxy violence, requiring enhanced security awareness and access controls.

• Intensified information and cyber threats: Disinformation campaigns and cyber activity, including DDoS attacks, will likely increase during NATO exercises and periods of heightened tension, potentially affecting corporate reputation and operations.

• Sustained climate of uncertainty for business operations: The normalization of hybrid activity will create a persistent low-level threat environment, complicating planning, increasing compliance risks, and requiring continuous monitoring of the local security landscape.

• Transport disruptions and logistics operations: Increased security measures and intermittent border controls will cause delays at key transit hubs. GPS jamming and spoofing in the Baltic Sea will continue to disrupt commercial aviation and maritime navigation.

Learn more about leveraging our industry-leading regional and subject matter experts for intelligence that helps your organization stay ahead of risks to your people and operations.