Danish intelligence warns Russia likely to step up hybrid attacks on NATO, sees risk of false-flag strike on eastern flank
Denmark's Defence Intelligence Service released a threat assessment on September 24 warning that Russia is likely to intensify hybrid operations against NATO and the West in the coming months, with a small but growing risk of a limited military strike on a NATO state on the eastern flank, possibly carried out under a false flag. The assessment focuses on Russian targeting of defence industry, aid supply chains to Ukraine, and transport to and from Ukraine. Denmark's Civil Security Agency raised the cyber threat level in response.
Key points
- Danish Defence Intelligence released its threat assessment publicly on September 24.
- The agency assessed Russia will intensify hybrid attacks against the West and NATO in the coming months, with more frequent incidents and more serious consequences.
- It said there is a "small but growing" risk of a limited military strike on a NATO state on the eastern flank bordering Russia, potentially under a false flag.
- Targets cited include the defence industry, enterprises supporting Ukraine, aid supply to Kyiv, and vehicles traveling to or from Ukraine; possible strikes include drones, missiles, or Ukrainian-made drones used under a foreign flag.
- The specific potential target was not named, but officials specified it is not Denmark.
- Denmark's Civil Security Agency raised the threat level for destructive cyberattacks from medium to high and said it has intelligence on specific planned sabotage actions against Denmark.
- Danish Defence Minister Jeppe Bruus stated Denmark has no intention of ending its support for Ukraine.
Why it matters
A NATO member's intelligence service has publicly warned that Russian hybrid operations against the alliance are set to intensify, and has flagged a concrete, though still small, risk of a limited military strike on another NATO state — potentially disguised as an attack by another country. Because the assessment singles out defence industry, aid logistics, and transport routes serving Ukraine, it signals that Western support for Kyiv may itself become a target of Russian action on NATO territory. Denmark's accompanying cyber-threat upgrade and reported intelligence on specific sabotage plans give the warning operational weight.
What happened
On September 24, the Danish Ministry of Defence Intelligence publicly released its latest threat assessment. The report concluded that in the coming months Russia will intensify its hybrid campaign against the West and NATO, with attacks becoming more frequent and more consequential. It assessed a "small but growing" risk of a limited military attack against a NATO country on the eastern flank bordering Russia, and said such an operation could be carried out "under a foreign flag." Officials did not identify the specific country but stated it is not Denmark.
Thomas Arenkiel, head of Danish Defence Intelligence, said possible strikes could involve single long-range weapons such as drones or missiles aimed at infrastructure that supports Ukraine, and that operations could also use Ukrainian-produced drones deployed under a foreign flag. The assessment identified Russian focus areas as the defence industry, enterprises supporting Ukraine, disruption of aid to Kyiv, and vehicles traveling to or from Ukraine. Arenkiel described a limited Russian military advance as a "desperate move" that, like the hybrid intensification, could occur in the coming months.
Danish Defence Minister Jeppe Bruus said the security situation is more serious than before and that Denmark has no intention of ending its support for Ukraine. In parallel, Denmark's Civil Security Agency raised the threat level for "destructive cyberattacks" from medium to high, said it considers it likely that Russia will attempt destructive cyberattacks against Denmark, and stated it has intelligence on specific planned sabotage actions against Danish territory, with particular risk from malware aimed at destroying data or disrupting operational technologies.
How Ukrainian sources describe it
The Ukrainian-language coverage frames the Danish assessment primarily as a warning about Russian threats directed at NATO and at Western support for Ukraine. Both reports foreground the risk to NATO's eastern flank and to the logistics and defence-industry backbone backing Kyiv — attacks on facilities supporting Ukraine, vehicles moving to or from Ukraine, and disruption of aid supplies — rather than the domestic Danish cyber-threat dimension of the warning.