Baltics Brace for Russian False Flag

Lithuanian intelligence services have warned of a possible Russian false flag operation in which Moscow could use captured Ukrainian drones to attack critical infrastructure in the Baltic region. The goal of such an operation would be to create the impression that Kyiv is behind the attack, Lithuanian Defense Minister Robertas Kaunas said on Monday, August 10, 2026.

"We are talking about a false flag operation involving a fake Ukrainian drone... One of the goals is for NATO to hesitate and reduce support for Ukraine. I assure you that this will not happen," Kaunas told EUobserver. The warning comes as European intelligence services record an intensification of Russian hybrid operations aimed at intimidating allies and undermining security.

Germany Investigates Drone with Explosives

Just a day before the warning was made public, German authorities launched an investigation into an incident at Leipzig/Halle Airport. There, a drone with explosives was found near a Ukrainian Antonov cargo aircraft transporting military ammunition. ARD security journalist Michael Götschenberg highlighted a key question for Denník N: "As with any drone incident, the most important task here is to determine who was its pilot. Identifying the pilot is usually crucial for attributing responsibility, especially if investigators are also examining a possible connection to Russian hybrid warfare."

Lithuanian President Gitanas Nausėda already confirmed in mid-July 2026 that intelligence services had received signals about planned attacks on critical infrastructure. "We have received such signals from our intelligence services. They do not specify a particular place or time, because the adversary has not yet completed its planning, and we only know about the plan or the target itself," he told the BNS agency. Nausėda added that the attacks could involve "various means intended to physically damage critical infrastructure... anything that disrupts the operation of these facilities."

Expert Warning: 'This Is Not Just a Hypothetical Scenario'

Keir Giles, a British expert on Russian hybrid operations at the London-based think tank Chatham House, believes that the way Lithuania is releasing information suggests the existence of concrete intelligence. "The way this information is being released gradually suggests that intelligence services have specific knowledge of a new form of Russian attack, not just an assessment of a hypothetical scenario," he told Denník N.

Giles also explains why Lithuania is speaking publicly about a possible operation before it happens: "If this is a potential false flag operation, it is important to preempt disinformation and warn about it in advance. The media and decision-makers are then prepared for the spread of false information and are less likely to be misled by it."

"Russia has repeatedly succeeded in creating uncertainty about responsibility for individual incidents, including attempts to attribute its own actions to Ukraine. Such confusion can delay decision-making, potentially giving Russia a significant advantage in a time-sensitive situation."

Attack Scenario and Information Warfare

According to security analysts at the International Institute for Strategic Studies (IISS), in modern hybrid operations, the informational effect is as important as the attack itself. If the scenario warned about by Lithuania and Giles were to materialize, the operation could unfold in several phases. The target could be a substation, a railway hub, a port, or a logistics center, and the attack would be carried out with a modified drone that would look like a Ukrainian unmanned aerial vehicle.

Lithuanian officials see the greatest risk precisely in the period between initial claims on social media and the confirmation of evidence. If the impression were created in the meantime that Ukraine was behind the attack, the goal of the operation would not be limited to material damage but would also include undermining trust among allies. Nausėda warned that intelligence indicates that "this planning is taking place at the highest level, effectively in Moscow."

The Baltics on the Front Line of Hybrid Warfare

Latvian President Edgars Rinkēvičs, at a joint press conference in Vilnius in July 2026, warned allies of the same threats. "The information we receive from Lithuania, Latvia, and other NATO members points to various sabotage attempts and efforts to weaken the security of our countries," he said. Rinkēvičs added that "the coming months, perhaps even the entire next year, will be crucial for Baltic security" and that Russia is already "testing our preparedness and vigilance."

European security services warn that the nature of Russian hybrid operations has changed in recent years. While cyberattacks and disinformation campaigns initially dominated, cases of physical sabotage are becoming more frequent. One of the most serious investigations concerned packages with incendiary devices that ignited in 2024 at logistics centers in Leipzig, Birmingham, and Poland. European services suspect that Russia's military intelligence agency GRU organized the operation, which Moscow denies.

Giles warns that many isolated acts of sabotage look like "preparation or reconnaissance for major disruptions to logistics and communication networks that could support a larger Russian operation." The key task for intelligence services, he says, will be "to recognize the moment when preparations escalate into an actual attack."

NATO Strengthens the Eastern Flank

During a visit to Lithuania in February 2026, NATO Secretary General Mark Rutte stated that the Alliance is responding to the changing nature of threats. "NATO makes Lithuania safer, and Lithuania makes NATO stronger," Rutte said. At the same time, NATO confirmed on Sunday that Italian Eurofighters had completed an Air Policing mission in Romania, helping to monitor airspace and strengthen air defense across southeastern Europe.