The global security situation continues to deteriorate due to the intensification of Russia’s hybrid warfare, sabotage operations and cyberattacks against Western countries. Russia has become more willing to take risks, although there are currently no signs that it is preparing for a full-scale invasion of NATO countries.
This is stated in an assessment of the threat from Russia published by the Danish Defence Intelligence Service (DDIS).
The agency said Russia has increased its use of sabotage, destructive cyberattacks and drone attacks against targets in Europe. As an example, the intelligence service cited the thwarted drone attack on Leipzig/Halle Airport in Germany, which German authorities said had been planned by Russia over several months.
The DDIS also referred to warnings from Denmark’s Security and Intelligence Service (PET) about possible Russian sabotage operations targeting defence companies in Denmark.
The agency separately pointed to an increase in aggressive actions by Russian forces against NATO military units in the Baltic Sea region. The most serious such incident involving Danish military personnel was the incident on 14 September 2026, when a Russian frigate in waters near Gedser fired flares towards a Danish military helicopter.
According to Danish intelligence, Russia is currently under greater pressure than at any other point during its war against Ukraine. Ukraine’s long-range strikes are causing increasing damage to targets deep inside Russian territory, while Russian forces are suffering significant losses for limited territorial gains on the battlefield.
At the same time, the DDIS said the Russian economy is approaching a serious crisis due to high military spending, international sanctions and Ukrainian strikes against energy infrastructure.
Danish intelligence assesses that Russia has no prospects of achieving major breakthroughs in the war against Ukraine over the next six months. At the same time, the agency notes that Russian President Vladimir Putin is unlikely to abandon his fundamental objectives in the war.
The DDIS predicts that Russia will continue to intensify its hybrid war against the West and NATO. This includes more frequent attacks with greater consequences, such as destructive cyberattacks capable of disrupting critical state functions, as well as sabotage operations carrying a risk of casualties.
The intelligence service also assesses the risk of Russia launching a limited military attack against one or several NATO countries bordering Russia as low but increasing.
According to the DDIS, such an attack could be aimed at diverting European resources away from supporting Ukraine and creating divisions within the Alliance. Possible scenarios include long-range strikes against infrastructure vital to supporting Ukraine, false flag operations involving Ukrainian-made drones, or the deployment of a limited number of military forces without national insignia.
At the same time, the Danish Defence Intelligence Service stressed that it sees no indications that Russia is preparing for a full-scale invasion of one or several NATO countries.
According to the assessment, even if Russia decided to take such action, it would require at least six months to prepare the necessary forces. However, the possibility cannot be completely ruled out.
The DDIS noted that in February 2025 it had already assessed possible timelines for Russia’s preparation for different types of war. According to that assessment, Moscow could be ready for a local war in a country bordering Russia approximately six months after the end or freezing of the war against Ukraine, for a regional war against several Baltic Sea countries in about two years, and for a large-scale war in Europe in about five years under certain conditions.
The updated assessment primarily concerns Russia’s ability and willingness to escalate against the West in the coming months through hybrid attacks or limited military actions.
