Baltic security: Keeping an eye on the Kremlin
Russia looks to be preparing major NATO provocations, including hybrid attacks and military buildup near Nordic borders, and may test Article 5.

In a nutshell
- Russia’s military buildup near Finland is alarming NATO’s frontline states
- Hybrid operations, like undersea cable sabotage, are testing alliance resolve
- Scenarios range from unpredictable escalation to a firm, measured response
- For comprehensive insights, tune into our AI-powered podcast here
For some time after Russia’s full-scale invasion of Ukraine, the prevailing wisdom held that Moscow’s military entanglement in the conflict would preclude any serious threat to NATO. A sense of complacency settled over many member states, who felt themselves to be at little risk. Indeed, some even suggested that the prolonged war in Ukraine bought NATO more preparation time.
This understanding is now shifting dramatically. Recent intelligence suggests that Russia is preparing for an assault on NATO, even as its war in Ukraine continues. Several member states’ intelligence services warn of a potential Russian attack within three to five years, possibly even sooner. These predictions are underpinned by reports of booming Russian arms production, now seemingly destined for more than just the Ukrainian front – allegedly, they are being stockpiled for use against NATO.
Particularly ominous are claims from countries on NATO’s northern flank, which, just a couple of years ago, saw minimal Russian military presence along their borders, but now report a preparatory buildup. A recent report by the Finnish Broadcasting Company Yle offered a telling insight. Major Marko Eklund, a retired Finnish military intelligence expert with long-term experience of Russia, pointed at satellite imagery showing large-scale construction and excavation that had begun last winter at two strategically vital military garrisons.
Facts & figures
One, Lupche-Savino, near the northern city of Kandalaksha, is about 110 kilometers from the Finnish border and guards access to critically important military infrastructure on the Kola Peninsula. Satellite images suggest a military settlement is under construction there, likely to house an artillery brigade and an engineering brigade, totaling some 2,000 troops. Another, Sapyornoye, on the Karelian Isthmus, lies about 70 kilometers from the Finnish border. The location evokes memories of the 1939-1940 Winter War, where Finnish defenders, at immense cost, held the isthmus and saved their country from occupation. Equipment now being brought to Sapyornoye indicates it is being prepared to house engineering troops, complete with pontoon bridges. Images also show a cleared forest line, presumably for a gas pipeline.
More broadly, Russia is reportedly planning to create a new Army Corps in Karelia, which would add another 15,000 troops close to the Finnish border. A railway troops brigade has been established at Petrozavodsk, where a mixed aviation division headquarters is also located. Major Eklund concludes that this buildup must be taken seriously. Before the full-scale invasion of Ukraine, the Leningrad Military District, which still carries its old name, had only about 30,000 troops. Current plans suggest this number could soon reach 100,000, accompanied by several hundred main battle tanks. The Finnish government is clearly responding; Defense Minister Antti Hakkanen said, “We know very well what Russia is doing, and this is what we are preparing for in our own defense as well.”
At first glance, fears about an impending war might seem overstated. With its war against Ukraine appearing set to drag on for years, Russia might struggle to mobilize enough troops for a full-scale assault on Finland, which can itself mobilize 280,000 men and boasts Europe’s most powerful artillery force. Moreover, the ongoing military buildup among the “Nordic-Baltic Eight” countries and the formation of a joint Nordic Air Command make an attack even on a smaller Baltic NATO member seem unlikely. The collective determination for coordinated defense appears highly credible.
The fundamental issue is that traditional wargaming of attack scenarios offers insufficient grounds to conclude that Russia would not launch a war it could not win. While such wargames might predict a swift Russian defeat, the nature of warfare is transforming, making it exceedingly difficult to foresee when, if or how an armed standoff will erupt into a shooting war. In this new environment of smoke and mirrors, the Russian regime seemingly remains convinced it can prevail.
Hybrid operations
What is more likely to follow is an escalation of various hybrid operations designed to test the resolve of target countries and gauge how far provocations can go before eliciting serious countermeasures. The range of such activities is expanding at an alarming pace, from drone overflights to sabotage against underwater cables and vital land infrastructure. Although governments in targeted countries are often reluctant to share full information, it is clear that airports and communication towers are being probed, water supply and power transmission nodes are experiencing mysterious break-ins, and suspicious vehicles are loitering around military installations.
The obvious purpose is to map vulnerabilities, measure response times and chart modes of response. These provocations are sometimes deliberately overt, simply to inform the media and public. As this process unfolds, a comprehensive inventory of preprepared actions is being compiled and rehearsed. In a crisis, these could be launched in a combined operation against one or several target states.
While the degree of penetration varies, it is safe to assume all targeted countries have a substantial presence of Russia sympathizers and of clandestine sleeper agents who could be mobilized to support such actions. In some cases, Russian operatives have even enlisted the support of local organized crime figures, who are handsomely paid for undertaking provocative sabotage.
In Sweden, arguably the most vulnerable of the Nordic countries, recent police investigations have revealed the theft of expensive highway speed cameras, later discovered in Russian drones in Ukraine. It was also revealed that a recent concerted action cut the power supply to all communication towers along the country’s east coast, to the south of Stockholm. Norway reports increased hybrid activities both in its northern Svalbard archipelago and along its Finnmark border with Russia. Finland and the Baltics tend to be more taciturn, but it is safe to assume that the level of Russian probing is increasing across the board.
More by Stefan Hedlund
- The Nordic-Baltic Eight: A new security actor?
- Norway under pressure in the Arctic
- Greenland standing its ground
It can be concluded that Russia is not only preparing for a long war against Ukraine but is also developing various probing attack scenarios against NATO, with the ultimate aim of demonstrating that Article 5, the alliance’s mutual defense pact, does not hold. And even as target countries are building their own defense measures, they are hampered by an insistence on playing by rules that Russia openly disregards.
The case of Russian sabotage operations against critical underwater infrastructure illustrates a worrying disparity in countries’ readiness to confront Russian provocations. On December 25 last year, the Eagle S, a Russia-linked oil tanker flagged in the Cook Islands and under sanctions as part of the Russian “shadow fleet,” was observed dragging its anchor for 100 kilometers in the Gulf of Finland. This action severed underwater cables, including a communications link between Finland and Estonia. In a surprising move, Finnish special forces boarded the tanker from a helicopter and forced it into port, where it remains pending legal action.
A month later, on January 27, another Russia-linked vessel, the Maltese-flagged cargo ship Vezhen, was observed dragging its anchor for another stretch of 100 kilometers, this time in the central Baltic Sea. It severed a communications cable between Sweden and Latvia. Following the Finnish example, an elite Swedish police unit boarded the ship and forced it into port. The difference, however, was that merely a week later a Swedish prosecutor claimed to be “able to say with certainty that this was not a case of sabotage,” and the vessel was subsequently released.

In May, Estonian naval patrol boats were dispatched to intercept a third Russia-linked vessel, the unflagged but Gabon-listed Jaguar, en route to a Russian port, presumably to load oil in violation of sanctions. When directed to an anchorage for inspection, it refused. Soon after, a Russian Su-35 fighter jet arrived, violating Estonian airspace for about a minute, seemingly to warn the Estonians to desist. After lodging an official complaint, the Estonian government allowed the Jaguar to continue on its course.
Although none of this suggests an imminent war against any Baltic or Nordic country, it does indicate Russia is openly preparing for major provocations. These could include substantial actions against infrastructure, combined with cyber warfare, and potentially even “little green men” (Russian soldiers in unmarked uniforms, such as those participating in the Russian military operation to occupy Ukraine’s Crimean Peninsula) operating in conjunction with Russian sympathizers and sleeper agents. The strategy aims to push boundaries as far as possible in various directions, without provoking serious countermeasures.
The Finnish special force’s action was likely a surprise, implying Russia had pushed “a bit too close for comfort,” but it did not alter the Kremlin’s course. The Swedish case demonstrated the low credibility of threats of serious countermeasures, while the Estonian case showed that in a crisis, the threat of force will ultimately carry the day. The day NATO aviation shoots down a Russian fighter jet violating national airspace is probably not going to arrive any time soon. Turkey is the only NATO country to have done so, in November 2015, when a Turkish F-16 fighter jet shot down a Russian Su-24M ground attack aircraft operating over Syria that briefly strayed into Turkish airspace. Although Russia’s reaction was limited to bluster before backing off, it seems highly unlikely that any other NATO country will attempt the same.
Scenarios
As it rebuilds its military capabilities for a potential conflict with NATO, Russia is simultaneously counting on its ability to escalate hybrid operations, banking on target countries being poorly prepared for serious confrontations. Of three likely possible scenarios, two have the potential to prove messy.
Likely: Gradual escalation
The scenario clearly favored by Russia involves a steady escalation of provocations. As target countries become accustomed to a variety of incidents, each new provocation can be taken one step further. Russian troll farms and local sympathizers will, in the interim, use social media to argue that further “provocations” against Russia can only lead to disaster. The ultimate prize is to exert sufficient influence over the political sphere to achieve a more Russia-friendly policy environment.
Less likely: Overreach and retaliation
An alternative scenario entails Russia overreaching, taking a provocation to the point where retaliation becomes inevitable, and where Moscow would find it necessary to maintain momentum by escalating even further. Such provocations could range from ramming incidents at sea and midair collisions between fighter jets, to civilian airliners crashing at airports under cyberattacks and severe contamination of water supply, among others.
Most likely: Firm response
The most probable outcome is that while tensions will continue to rise, the targeted countries will manage to develop a policy of firm but measured responses that combine resolve with preventing escalation into a shooting war. However, accidents may still occur, and reactions may be driven by heightened emotions. If this happens, the security situation in the Baltic region will come under increasing stress, and a slide into war cannot be excluded.
Contact us today for tailored geopolitical insights and industry-specific advisory services.