Allied Intelligence — 2026-09-26

Danish Intelligence Warns Russia Could Launch Limited Military Attack on NATO Before Ukraine War Ends

BLUFDenmark's expanded threat assessment signals that a limited Russian kinetic test of Article 5 is unlikely within six months but hybrid escalation against NATO logistics remains the more pressing near-term risk.

The Danish Defence Intelligence Service (DDIS) said on Thursday there is a "low but growing" risk that Russia could carry out a limited military attack on a NATO country bordering Russia even before the war in Ukraine ends 12. The agency assessed that Russia could strike critical infrastructure supporting Ukraine with long-range weapons, stage a false-flag operation using Ukrainian-made drones, or deploy troops without national insignia across a border; any buildup would take months to prepare and be hard to conceal 3. DDIS separately said it expects Russia to intensify hybrid warfare, including cyberattacks and sabotage with a high risk of casualties, against NATO and Western countries in coming months 13. NATO Secretary General Mark Rutte, responding to the assessment's finding that a full invasion remains highly unlikely, said "they'd better not, because they know we are ready and they will not win that" 4. Poland's government said a fire at a Starlink ground station on Thursday was sabotage, though it had not established responsibility 3.

Analysis
Denmark's assessment marks a genuine widening of Copenhagen's threat horizon, extending a February 2025 judgment that tied Russian confrontation-readiness to the war's end or a freeze: DDIS now judges Moscow could test Article 5 cohesion before Ukraine fighting stops. A limited, deniable strike is unlikely within the next six months, given Russia's continued main-effort commitment in Ukraine and the months-long, hard-to-conceal preparation any cross-border troop movement would require. Moderate confidence reflects convergent detail on attack vectors from a single primary source, DDIS's own published assessment, amplified but not independently confirmed by secondary outlets, with no corroborating indicators of force posturing near NATO's eastern flank. Hybrid escalation, cyberattacks and sabotage against defense and rail logistics, is the more immediate vector, as the Starlink fire allegation illustrates. Copenhagen may also be calibrating public warnings to sustain European defense spending. Any actual limited strike would force eastern-flank members to choose within days between invoking collective defense consultations or absorbing an ambiguous attack to preserve alliance cohesion.

4 sources

Vurdering af truslen fra Rusland - Forsvarets Efterretningstjeneste (Danish Defence Intelligence Service)
Denmark Warns of Rising Risk of Russian Attack on a NATO State - Bloomberg
Russia could attack a NATO country within months, Danish intelligence warns - CNBC
Russia could attack NATO before Ukraine war ends, Danish spies warn - EU Perspectives