Rutte says drone and hybrid attacks show evolving Russian threat; more support for Ukraine is NATO's answer
NATO Secretary General Mark Rutte said on September 29 that repeated drone incursions and other hybrid incidents on Allied territory demonstrate an evolution of the threat from Russia. He confirmed NATO has all necessary response options, public and non-public, symmetrical and asymmetrical, and argued that the core answer to Russian 'grey zone' actions is to sustain, not reduce, support for Ukraine.
Key points
- Rutte spoke on September 29 at a joint press conference with Lithuanian Prime Minister Mindaugas Sinkevičius.
- He said NATO is strengthening integrated air and missile defense and adapting its drone posture in response to repeated incursions along the eastern flank.
- Two weeks earlier, NATO fighter jets — identified as Italian — shot down a drone in Lithuanian airspace.
- On the night of September 28–29, Romania detected an aerial target near its airspace and later received reports of debris in Brăila county.
- Poland said a drone fell inside Ukrainian territory about 2 km from the Dorohusk border crossing without entering Polish airspace.
- Rutte cited Operation Baltic Sentry, launched after a Finland–Estonia undersea cable was cut at the end of 2025, as a symmetrical response, and measures by Sweden, the UK, Belgium and France against Russia's 'shadow fleet' as asymmetrical ones.
- Rutte endorsed Estonia's public attribution to Russia of the August 14–15 arson of defense company Milrem Robotics in Tallinn.
- He dismissed Russia's reported nuclear-threat letter to NATO over Kaliningrad as not credible, saying 'Putin knows he can never defeat NATO.'
- He framed the best response to Russian grey-zone actions as more, not less, support for Ukraine.
Why it matters
Rutte's remarks give NATO's most public framing of a string of recent incidents — drones downed over Lithuania, an aerial target near Romania, debris in Brăila county, a drone near Poland's border and an arson attack on an Estonian defense company — as a connected, evolving Russian campaign rather than isolated events. By tying the answer to those incidents directly to sustaining support for Ukraine, he elevates aid to Kyiv from a separate policy file into NATO's central strategic response to grey-zone pressure on the Alliance. At the same time, his acknowledgment that some response options will be non-public and not always symmetrical leaves deliberate ambiguity about how NATO will act.
What happened
Speaking on September 29 alongside Lithuanian Prime Minister Mindaugas Sinkevičius, NATO Secretary General Mark Rutte said repeated drone incursions along NATO's eastern flank demonstrate an evolution of the threat from Russia. He said NATO has all the response options it needs, but stressed that not all of them will be public and not all will be symmetrical, citing Operation Baltic Sentry, launched after a Finland–Estonia undersea cable was cut at the end of 2025, as an example of a symmetrical response, and measures by Sweden, the United Kingdom, Belgium and France against Russia's 'shadow fleet' as asymmetrical ones. He framed the best response to Russian grey-zone actions as more, not less, support for Ukraine, and said NATO has no immediate threat from Russia while dismissing Russia's reported nuclear-threat letter to NATO over Kaliningrad as not credible. He also endorsed Estonia's public attribution to Russia of the August 14–15 arson of defense company Milrem Robotics in Tallinn. The press conference came against a backdrop of recent incidents: NATO fighter jets, identified as Italian, had shot down a drone over Lithuania about two weeks earlier; Romania detected an aerial target near its airspace on the night of September 28–29 and later received reports of debris in Brăila county; and Poland reported a drone fell inside Ukrainian territory about 2 km from the Dorohusk border crossing without violating Polish airspace. NATO Supreme Allied Commander Europe Alexus Grinkevich separately said allies have stepped up intelligence sharing in response to a wave of sabotage and other incidents likely linked to Russia. Rutte also said Russia has sacrificed up to 1.2 million of its own personnel in what he called a 'completely unprovoked war' — a figure presented as an estimate.
How Ukrainian sources describe it
Ukrainian-language coverage leads with the concrete incidents affecting NATO members — the drone downed over Lithuania, the aerial target near Romania, debris in Brăila county and the drone near Poland's Dorohusk crossing — and reads them as a single Russian campaign against the Alliance. Ukrainian outlets prominently cite Rutte's line that NATO will do 'more, not less' for Ukraine and that sustained support for Kyiv is the answer to Russian grey-zone actions, presenting Estonia's attribution of the Milrem Robotics arson to Russia and Polish reporting of border-area drone strikes as evidence of that pattern. One headline gives particular weight to Rutte's dismissal of Russian nuclear threats against the Baltic states.
How international sources describe it
International coverage led by the Azerbaijani agency and Qatari outlet frames the episode around the political-strategic point that Russian attacks are failing to weaken NATO's support for Ukraine, foregrounding Allied resilience rather than the incidents themselves. International framing emphasizes Rutte's calls for restraint, the 'evolution of the threat,' and the mix of symmetrical and asymmetrical response options, presenting NATO's posture as calibrated rather than automatically escalatory. International reporting also gives weight to the public-attribution debate — Rutte's endorsement of Estonia's decision to name Russia — and to the broader question of when to expose Russian tactics, particularly with major European elections approaching.
Where reporting differs
Reporting disagrees on whether the September 29 press conference with Lithuanian Prime Minister Mindaugas Sinkevičius took place at NATO headquarters in Brussels or in Vilnius. Sources also differ on the framing of Rutte's threat assessment: he said repeated drone incursions show an 'evolution of the nature of the threat,' but elsewhere said NATO does not face an 'immediate threat' from Russia and does not consider Russian nuclear threats against the Baltics credible. On the Milrem Robotics arson, Kremlin spokesman Dmitry Peskov rejected Estonia's attribution of the attack to Russian intelligence services as 'unfounded' and lacking 'logic,' while Estonian Foreign Minister Margus Tsahkna and Rutte publicly endorsed Estonia's finding. One Ukrainian-language article confusingly describes the Polish defense minister as 'Russian Defense Minister Sergei Shoigu's successor,' which conflicts with other reporting that attributes the statement to Polish Defense Minister Władysław Kosiniak-Kamysz.
Background
The wave of incidents Rutte addressed includes the August 14–15 arson of Milrem Robotics in Tallinn, which Estonia has publicly attributed to Russian intelligence services and for which it summoned the Russian chargé d'affaires; the cutting of a Finland–Estonia undersea cable at the end of 2025, which prompted NATO to launch Operation Baltic Sentry; and the drone downed by NATO fighter jets over Lithuania about two weeks before Rutte's remarks. Sweden, the United Kingdom, Belgium and France have separately taken measures against Russia's 'shadow fleet' of oil tankers. On the EU side, EU High Representative for Foreign Affairs and Security Policy Kaja Kallas said on September 28 that the EU is preparing a mechanism to respond to hybrid attacks that do not meet the definition of armed aggression, and European Council President António Costa said at the end of August that the EU has a plan through 2030 for a joint response to hybrid threats. EU defense ministers discussed a new emergency security protocol against Russian hybrid threats in Brussels on September 28.