Where and how Putin could expand his war in Europe beyond Ukraine

A plane landed, and an alarming rumor took off. On August 25, Central Intelligence Agency (CIA) Director John Ratcliffe flew to Moscow for an unannounced visit. One reported reason for the trip was to warn Russian leaders against attacking NATO allies. Russia has long carried out hybrid warfare across Europe in the form of sabotage, misinformation, and cyberattacks. It is also continuing its war on Ukraine, a conflict that has already spilled over into other countries in the form of drones and missiles. Yet Ratcliffe’s unexpected visit has raised new concerns and drawn comparisons to then CIA chief Bill Burns’s trip to Moscow shortly before Russia launched its full-scale invasion of Ukraine. Below, Atlantic Council experts go point-by-point across the map to assess where and how Russian President Vladimir Putin might escalate next. Justina Budginaite-Froehly, PhD, is a nonresident senior fellow with the Atlantic Council’s Europe Center and Transatlantic Security Initiative within the Scowcroft Center for Strategy and Security. The Baltic states Russia is consistently testing the boundaries of what it can do against the Baltic states and their allies without provoking a decisive response. The pattern of actions linked to Russia ranges from drone incursions and sabotage of critical infrastructure to arson, assassination plots, cyber operations, and GPS jamming and spoofing. Moscow is likely to keep pushing until it faces credible costs. While Russia remains materially consumed by its war against Ukraine, that does not necessarily make it less dangerous. It makes Russia more willing to bring the war closer to Ukraine’s staunchest supporters in an effort to reduce their backing. If Putin grows desperate about his stalled war effort while perceiving political uncertainty within NATO, he could conclude that escalation offers a way to alter the strategic trajectory of the war in Ukraine. That is why the Baltic states are preparing across the spectrum of conflict. They are aware that the boundary between a “hybrid” operation and conventional aggression can be extremely thin: sabotage, cyberattacks, electronic warfare, and disinformation can be ends in themselves, but they can also serve as shaping operations for subsequent military action. Whether escalation proceeds largely depends on what Moscow learns from the initial NATO response. Lithuania, Latvia, and Estonia are therefore strengthening national defenses and improving interoperability with reinforcing allies. They are also pressing NATO to treat repeated sub-threshold attacks as elements of a coherent Russian strategy to identify and exploit seams in national and allied defenses. Ultimately, the target of any Russian escalation in the Baltics would be NATO itself. Moscow has long sought to weaken the Alliance and undermine confidence that collective defense will work when tested. Deterrence must therefore leave no ambiguity that even a geographically limited attack would bring the full weight of the Alliance into play. NATO’s recent Kaliningrad-focused maneuver was useful signaling in this respect, demonstrating allied readiness close to one of Russia’s most militarized outposts. But ad hoc signaling needs to be backed by everyday allied consistency. A strong allied forward presence, underpinned by the return of urgently needed US military deployments, is therefore central to deterring Russia. Stability in the Baltics is a strategic interest for the United States: a successful Russian test of NATO would cripple the credibility of US-led alliances far beyond Europe. Aaron Korewa is the director of the Atlantic Council’s Warsaw Office, which is part of the Atlantic Council’s Europe Center. Poland In Poland, the possibility of Russia expanding the war beyond Ukraine is treated seriously, simply because the Poles cannot afford not to do so. Russia has already conducted hostile operations here. The most serious case was in September 2025, when nineteen Russian-made drones penetrated Polish airspace in what most believe to have been a deliberate test of Poland’s defensive capabilities. Add to that the Russian armed cruise missile that crashed in eastern Poland in June this year, the 2024 arson attack on a shopping mall in Warsaw, which Polish prosecutors concluded was commissioned by Russian intelligence, and the November 2025 sabotage of the Warsaw–Lublin railway. Poland is preparing for all kinds of threats. Recently, Minister of National Defence Władysław Kosiniak-Kamysz warned that, as Polish–Ukrainian relations deteriorate, Russia could use captured Ukrainian drones in false-flag operations. One also cannot rule out a larger conventional attack from Kaliningrad and/or Belarus (effectively a Russian satrapy). This explains Poland’s Eastern Shield border defense concept and the enormous modernization of its armed forces, with defense spending at 4.8 percent of gross domestic product (GDP), the highest in NATO. Poland is no longer a lightly armed eastern frontline state waiting for NATO to rescue it. Rather, it possesses significant national capabilities for the opening phase of a conflict, including Abrams and K2 tanks, HIMARS and Chunmoo rocket artillery, Apache attack helicopters coming into the force, large artillery formations, F-16 and F-35 aircraft, and rapidly expanding drone capabilities. Impressive as this is, the Polish armed forces are still a work in progress. They are also not battle-tested. Poland aims to provide the first line of defense itself, but a sustained conflict would require NATO reinforcement in critical areas, particularly air defense. NATO maintains forward forces in Poland, and the multinational battlegroup can expand by thousands of troops to brigade strength. The approximately ten thousand American soldiers stationed in Poland are particularly important. The bottom line is that the Poles can handle themselves, but their strategy ultimately depends on making sure that any Russian attack on Poland immediately becomes a war with NATO. Anna Wieslander serves as director for Northern Europe at the Atlantic Council and head of the Atlantic Council office in Stockholm. The Nordic states For the Nordic states, Russia is the most significant, direct, and long-term threat to Euro-Atlantic security. As all Nordic and Baltic states underlined at an NB8 meeting in Estonia in April, this requires “urgent, determined and coordinated action.” For more than a decade, Russia has targeted the Nordics with hybrid tactics—from cyberespionage targeting Norway’s parliament to instrumentalized migration that prompted Finland to close its eastern border and GPS jamming that disrupted ambulance navigation in Kalmar County and Gotland. Russia’s near-constant hybrid warfare has prompted the Nordic countries to develop their Cold War-era total defense structures and put societies on alert through information campaigns and resilience measures. In parallel, the Nordics are investing in both their defense industrial bases and overall militaries, with defense spending ranging from 2.5 percent to 3.34 percent of their respective GDPs in 2025 (excluding Iceland, which does not maintain a standing army). They also lead in support to Ukraine as a share of GDP, which they see as an investment in regional security. With all five Nordic countries now NATO allies, their defense is firmly embedded in NATO’s operational planning, as the recent large-scale allied air exercise near Kaliningrad illustrated. NATO’s newly established Combined Air Operation Centre in Bodø is designed to enable the Nordic air forces to operate seamlessly across borders while remaining fully integrated into NATO. Led by Sweden as the framework nation and hosted by Finland, Forward Land Forces (FLF) Finland is designed to safeguard the North Calotte, which spans northern parts of Sweden, Finland, and Norway, and whose proximity to Russia’s Kola base makes it strategically exposed. In an early phase of a war, Russia would have an interest in expanding its anti-access/area-denial capacity there. Other potential Russian targets include the islands of Gotland, Åland, and Bornholm in the Baltic Sea, and Svalbard in the Barents Sea. Controlling any of the Baltic islands could allow Russia to extend its air-defense reach, constrain allied movement, and deny NATO platforms from which to defend the region. Svalbard presents a different challenge: its remoteness, proximity to Russia’s Kola base, and special treaty regime, combined with its growing military-strategic value to Russia, could make it vulnerable to coercive pressure on Norwegian sovereignty and allied resolve. Norway and Sweden serve as reception, host, and transit nations for NATO reinforcements, with Norwegian ports serving as gateways to the Nordic and Baltic region and Sweden providing basing and transit alongside host-nation support. Shelby Magid is the deputy director of the Atlantic Council’s Eurasia Center. Moldova Moldova is no stranger to Russian aggression, nor to the threat of the Kremlin expanding its war. While leaders in Chișinău rightly distinguish the scale of the tragedy and injustice Russia inflicts on neighboring Ukraine from the threat facing Moldovan citizens, there has long been a recognition that Moldova is also in Moscow’s crosshairs. Russia has sought to undermine Moldova’s European path through large hybrid warfare campaigns, while also using the war in Ukraine to increase pressure on Moldova and test its vulnerabilities. This is increasingly evident in repeated violations of Moldovan airspace by Russian drones and escalating Russian strikes against Ukrainian-Moldovan border infrastructure. Moldova has faced years of pressure from Moscow through a range of tools: Russia’s military presence in breakaway Transnistria, massive Russian funding behind interference in Moldovan elections, disinformation and political financing aimed at derailing the country’s EU path, energy pressure, and now increasingly direct spillover from the war in Ukraine. Yet Moldova has proved more resilient than both Moscow and many in the West expected. Despite Russia devoting significant resources to these efforts, Moldovans continued to support a pro-European trajectory in the country’s past two elections and backed the EU referendum. Russian aggression is already being felt in Moldova and is cause for increasing concern about kinetic spillover from the war in Ukraine. Russian drones have repeatedly violated Moldovan airspace, prompting Chișinău to focus on strengthening its ability to monitor and defend its skies. In August, Moldovan Defense Minister Anatolie Nosatîi emphasized the need to equip the national army with high-performance systems to detect and protect against these incursions. Moldova is not a member of NATO or the EU, although it continues along with Ukraine in the EU accession process. The Moldovan military remains limited, making it vulnerable to a conventional attack. But Chișinău has learned an important lesson from Ukraine and knows it must work to strengthen its own defenses while building strong regional partnerships. This is increasingly visible in Moldova’s relationships with Ukraine and Romania. Moldova and Ukraine have deepened security cooperation, including through recent trilateral cooperation with Romania, as their interests are seen as critically intertwined. This is especially in relation to drone threats, energy, transport infrastructure, and regional security. Alex Șerban is the director of the Atlantic Council’s Romania Office. Romania BUCHAREST—For Romania, Russian aggression is no longer hypothetical. Since Russia’s invasion of Ukraine, drones have repeatedly crossed into Romanian airspace or fallen on Romanian territory, including near populated areas, while the wider Black Sea war has brought naval mines, attacks on civilian shipping, and growing risks to maritime and energy infrastructure close to home. In August, Romania destroyed an explosive-laden maritime drone near the Neptun Deep offshore gas project operated by OMV Petrom/Romgaz. President Nicușor Dan has warned that Romanian airspace has been violated “dozens of times” and that “deterrence is tested first at the perimeter of the Alliance.” The most plausible Russian escalation would not begin with an armored invasion. Moscow could intensify attacks below the threshold of open war: repeated airspace incursions; maritime drones or mines threatening Constanța and Black Sea shipping; sabotage of critical infrastructure in the continental shelf zone (outside Romanian/NATO territory); cyber operations; and information operations designed to undermine confidence in NATO. Attacks against Moldova could also create a further dilemma, given its proximity and Bucharest’s vital interest in its stability. The Black Sea is therefore becoming a critical battlespace. George Scutaru, CEO of the New Strategy Center, argues that Russia is escalating against Romania while seeking to “test NATO’s speed of response” on the eastern flank. Romania is preparing accordingly. Bucharest is expanding Mihail Kogălniceanu Air Base and connecting Câmpia Turzii, Cincu, Smârdan, Babadag, Constanța, and the Danube through a military logistics network. Its forces are anchored in US systems including Patriot air defense, HIMARS rockets, F-16s, and Abrams, as well as planned F-35s. Romanis is also expanding air-defense, counter-drone, and maritime capabilities. Romania could initially respond with national capabilities supported by US and NATO assets already present. But a sustained attack would require reinforcement. Can Moscow create a limited crisis faster than NATO could mobilize? As Romanian analyst Armand Goșu puts it, the recent drone incursions are “tests of Russia, trying to understand Romania’s military capabilities in combating drones.” For Moscow, the ultimate test would be whether such a crisis could expose a gap between NATO’s political commitment and its ability to respond quickly and collectively in a border area. Phyllis Berry is a nonresident senior fellow with the Atlantic Council’s Europe Center and the Transatlantic Security Initiative within the Scowcroft Center for Strategy and Security. Germany Germany has long been a major target of Russian disinformation, but since 2022 Russian-sponsored hybrid actions have increased in number and severity. In early August, a drone loaded with explosives was discovered near a Ukrainian cargo airplane at a Leipzig airport; another drone later collided with a plane that had been diverted from the airport, and a third was found nearby. Drone overflights are common; federal authorities registered over one thousand suspicious overflights of military installations in 2025. Germany officially blamed Russia for a 2024 cyberattack on the German air traffic control system and later summoned the Russian ambassador over the incident. German authorities have also held Russia responsible for assassination plots against German arms executives and in late 2025 uncovered a buried depot of weapons and munitions thought to be meant for another such assassination attempt. Attacks on underwater infrastructure have also risen across the Baltic Sea. Germany sees these hybrid actions as a significant threat to its security; German Chancellor Friedrich Merz said in September 2025 that “we are not at war, but we are also no longer at peace.” Berlin has been increasingly willing to call out bad actors and is seeking to better coordinate between federal and state authorities. The government has proposed legislation to give intelligence authorities the operative authority to act against hybrid attacks. However, German security policy experts criticize the government as slow and timid in its responses. On Tuesday, September 1, the government declared that Russia is responsible for the Leipzig incidents and announced punitive measures, including the closing later this month of Russia’s consulate in Bonn and its cultural house in Berlin. The government also has plans for more aggressive action against the Russian shadow fleet and a push for additional EU sanctions. Germany is advancing these efforts at the NATO level, too, including by partnering with Norway to lead an effort to better monitor and protect underwater infrastructure. The country also participates in Baltic Sentry and, in late 2025, sent a frigate to the waters around Denmark after drone incidents shut down nearby airports. John Sipher is a nonresident senior fellow at the Atlantic Council’s Eurasia Center. He previously worked for the CIA’s National Clandestine Service for twenty-eight years. Western Europe, the US, and beyond Russian hybrid warfare is not new. Since Bolshevik times, Moscow has used asymmetric means to weaken stronger adversaries via subversion, sabotage, propaganda, disinformation, and political influence. What has changed since 2014 is the Kremlin’s appetite for risk. Since 2014, Putin has steadily turned up the heat. Assassinations, bombings, sabotage, cyberattacks, and other covert operations have become more frequent and, increasingly, more brazen. As others have noted, that activity will remain concentrated around Russia’s periphery. But over the coming year, I would expect Moscow to put increasing emphasis on a battlefield where conditions are particularly favorable—Western politics itself. Russian “active measures” have always been most effective when they persuade an adversary to do Moscow’s work for it. Today, political polarization in the US and Europe, the rise of populist parties, declining trust in institutions, and growing tensions across the Atlantic provide an extraordinary opportunity. The Kremlin has long sought to separate the US from Europe. President Donald Trump’s recent disparaging comments and actions toward allies, including Canada, Denmark, and South Korea, as well as NATO and Europe more broadly, likely signal to the Kremlin that the time is ripe to widen that divide. Expect Russian information operations to amplify arguments that NATO is obsolete, Europe is freeloading, Ukraine is corrupt and doomed, democratic governments are illegitimate, and alliances constrain rather than strengthen the United States. Moscow will simultaneously encourage European narratives portraying Washington as unreliable, predatory, and no longer worth following. These messages and activities may contradict one another. That is beside the point. The objective is division. Attempts to promote Western right-wing and radical groups will continue. For Putin, the present turmoil is an opportunity that may not last. Russia remains weaker than the combined West and has repeatedly suffered from its own aggression. Its best strategy, therefore, is not defeating the West but encouraging the West to defeat itself. From Moscow’s perspective, if your adversary is stumbling toward the precipice, this is precisely the moment to give him a push.