Denmark warns of rising risk of limited Russian military attacks on NATO border states

Threat assessment for NATO borders

The Danish Defence Intelligence Service (FE) released its updated annual security evaluation on Thursday, 24 September 2026, outlining shifting risks along the eastern frontier of the North Atlantic Treaty Organization. While Danish intelligence analysts judge that Moscow has little strategic interest in launching an invasion of an allied country, they concluded that a limited armed confrontation can no longer be completely dismissed. Speaking at a press conference in Copenhagen, FE Director Thomas Ahrenkiel presented the findings and explained that the Kremlin's willingness to take strategic risks has grown, even while Russian conventional forces remain heavily engaged in the ongoing war in Ukraine.

There is a low but growing risk that Russia will launch limited military attacks against a NATO country bordering Russia. We continue to consider it unlikely that Russia sees any interest in invading a NATO country, but we cannot rule it out.

Military mobilization and diversion tactics

The intelligence assessment categorizes any potential Russian military strike or escalation in hybrid operations as a desperate measure. The primary strategic goal of such an initiative in the coming months would be to divert European political attention and material resources away from supporting Ukraine. According to the FE analysis, executing a military operation of this scale would not happen immediately, because Russia would require at least six months to mobilize, assemble, and position the necessary combat formations along NATO borders. FE analysts emphasize that Russia's ongoing military commitments in Ukraine limit its immediate capacity for large-scale operations elsewhere, establishing the six-month mobilization threshold as a vital early-warning window for NATO intelligence agencies.

Operational scenarios and false-flag risks

The FE document outlines several specific operational contingencies that Western defence planners must monitor. Among the primary scenarios considered by Danish intelligence are limited kinetic attacks on critical transport routes and logistics infrastructure dedicated to sustaining Ukrainian defence forces. The service also warned that Russian security services could orchestrate false-flag operations, including the potential deployment of Ukrainian-made drones against European targets to disguise the source of aggression and provoke political fractures among alliance members. By using untraceable or deceptively attributed weapon systems, Moscow could attempt to test NATO's collective defence commitments without openly declaring war, according to Danish intelligence assessments.

Domestic sabotage and espionage in Denmark

The intelligence briefing connects these regional border concerns directly to subversive activities occurring across Western Europe. In early September 2026, Danish counter-espionage authorities warned that Russian intelligence agencies were actively preparing sabotage plots against Denmark, focusing specifically on domestic defence contractors involved in supplying military aid to Kyiv. Moscow's operatives have attempted to recruit Danish citizens to perform on-the-ground reconnaissance, instructing them to map physical layouts, document security arrangements, and record transport access routes around designated industrial facilities. Danish authorities emphasized that the recruited informants were asked to provide detailed operational intelligence regarding security vulnerabilities around defence manufacturing plants, reflecting Moscow's broader objective of disrupting European weapons shipments before they reach the Ukrainian battlefield. Ahrenkiel pointed out that while Russia's appetite for risk creates tangible security challenges through hybrid tactics, it does not point toward direct conventional military action against Danish territory.

We do not expect a conventional military attack by Russia against Denmark.