Lithuania Warns: Russia Preparing False Flag Operation
Baltic intelligence services claim Moscow plans attacks on critical infrastructure using captured drones to blame Kyiv and weaken NATO support.
Baltic intelligence services claim Moscow plans attacks on critical infrastructure using captured drones to blame Kyiv and weaken NATO support.
Lithuania's military intelligence service has issued a warning that Russia is preparing a false flag operation, using captured Ukrainian drones to attack critical infrastructure in the Baltic region. The aim would be to create the impression that Ukraine is behind the attacks, which could shake allied confidence and weaken support for Kyiv.
"We are talking about a false flag operation that would involve a fake Ukrainian drone... One of the goals is for NATO to start hesitating and reduce support for Ukraine. I can assure you that this will not happen," said Lithuanian Defense Minister Robertas Kaunas.
The warning from Lithuania came a day after German authorities launched an investigation into an incident at Leipzig/Halle Airport. There, a drone with explosives was found near a Ukrainian Antonov cargo plane that was transporting military ammunition. The investigation is still ongoing, and German authorities have not disclosed who is behind the incident.
ARD journalist specializing in security, Michael Gechenberg, emphasized the importance of determining who operated the drone: "As with any drone incident, the most important task is to establish who was its pilot. Identifying the pilot is usually crucial for determining responsibility, especially if investigators are also examining possible links to Russian hybrid warfare."
Lithuanian President Gitanas Nauseda confirmed in mid-July 2026 that intelligence services had received information about planned attacks. "We have received such signals from our intelligence services. They do not specify a specific location or time, because the adversary has not yet finished planning, and we only know about the plan or target itself," Nauseda told the BNS agency.
According to him, the attacks could involve "various means intended for physical damage to critical infrastructure... anything that disrupts the operation of these facilities." He added that "this planning is taking place at the highest level, practically in Moscow." Lithuania has proactively strengthened the protection of energy and transport hubs.
At a joint press conference in Vilnius in July 2026, Latvian President Edgars Rinkevics warned allies of the same danger. "The information we are receiving from Lithuania, Latvia, and other NATO member states indicates various sabotage attempts and efforts to weaken the security of our countries," he said.
Rinkevics stated that "the coming months, perhaps even the entire next year, will be decisive for Baltic security" and that Russia is "testing our readiness and vigilance." He emphasized: "We must be prepared to respond to new threats."
Keir Giles, a British expert on Russian hybrid operations at the London-based Chatham House institute, believes that the way Lithuania publicly issued the warning indicates the existence of concrete intelligence. "The way this information is being released gradually suggests that intelligence services have specific knowledge of a new form of Russian attack, not just an assessment of a hypothetical scenario," he told Denník N.
Giles also explains why the public warning is crucial: "If this is a potential false flag operation, it is important to preempt disinformation and warn about it in advance. The media and decision-makers are then prepared for the spread of false information and are less likely to be deceived."
He also warned of long-term Russian goals: "Russia has repeatedly succeeded in creating uncertainty about responsibility for individual incidents, including attempts to attribute its own actions to Ukraine. Such confusion can delay decision-making, which could potentially give Russia a significant advantage in situations where time is crucial. It can also serve to undermine Ukraine's credibility and weaken support for Kyiv, which is a long-term Russian goal."
European security services are noting a change in the nature of Russian hybrid operations. In addition to cyberattacks and disinformation campaigns, cases of physical sabotage are becoming more frequent. One of the most serious investigations concerned packages with incendiary devices that ignited in 2024 at logistics centers in Leipzig, Birmingham, and Poland. There was suspicion that it was a trial run ahead of planned attacks on cargo planes flying to the United States and Canada. Polish authorities suspect that the operation was organized by Russia's military intelligence service, the GRU, which Moscow denies.
A series of incidents also includes damage to underwater power and telecommunications cables in the Baltic Sea. Although several cases remain unresolved, the repeated incidents prompted NATO to launch Operation "Baltic Sentry" in early 2026 to strengthen the protection of critical infrastructure and enhance surveillance of the region. NATO Secretary General Mark Rutte, during a visit to Lithuania in February 2026, stated: "NATO makes Lithuania safer, and Lithuania makes NATO stronger."
Giles concluded that many individual acts of sabotage "appear to be preparation or reconnaissance for major disruptions to logistics and communication networks that could support a broader Russian operation. The key task for intelligence services will be to recognize the moment when preparations turn into an actual attack."
