Putin ordered intelligence services to destroy NATO and EU from within, NYT investigation reveals

Putin's December 2025 directive

In December 2025, Russian President Vladimir Putin convened a secret meeting in Moscow with military commanders and intelligence chiefs, setting a 2026 objective to "destroy NATO and the EU from within," according to a New York Times investigation published on August 14, 2026. The report cites officials from intelligence services of at least two countries familiar with the meeting. The directive is being pursued on at least two fronts: destabilizing Moldova as a bridgehead for operations against Ukraine and the West, and testing NATO's collective defense resolve through potential limited attacks on an eastern flank member state as early as autumn 2026.

Moldova as second strategic priority

Western intelligence officials told the NYT that subjugating Ukraine remains the Kremlin's first priority, followed by establishing control over Moldova. Putin reportedly still hopes to capture southern Ukraine to create a land corridor connecting Russia to Moldova, which borders both Ukraine and EU and NATO member Romania. Moldova would serve as an ideal staging ground for continued aggression against Ukraine and hybrid operations against the West. Russia already maintains an illegal military presence in the separatist region of Transnistria, providing a forward pressure platform close to Chișinău and NATO's eastern flank.

Interference in Moldova's 2025 elections

The NYT investigation describes the scale of Russian operations to influence Moldova's September 2025 parliamentary elections and prevent the pro-European government from retaining power. Actions included disinformation campaigns, cyberattacks, vote buying, funding of local networks, and training individuals to provoke unrest during the electoral period. The operation also involved recruiting influential local figures, including politicians, journalists, and opinion makers, to spread pro-Russian narratives. Moldovan Orthodox priests were brought to Russia and issued cards by Promsvyazbank. Some were to receive approximately $1,000 to convince parishioners to oppose EU integration and the country's pro-Western policies.

Paramilitary training and infrastructure attacks

The operation included a paramilitary component. In summer 2025, a training camp was organized in Serbia where participants, mostly Moldovan citizens, were trained in weapons use, breaking police cordons, and arson. Participants received $400 for three- to four-day courses, and instructors had links to Russia's military intelligence service, the GRU. Similar camps operated in Bosnia and near Moscow. Moldovan prosecutors stated that over 100 young people from Moldova participated in training in Russia, learning to manufacture incendiary materials and improvised explosive devices, and to operate drones adapted for carrying explosives or starting fires. Chișinău authorities responded with hundreds of raids before the elections.

Russia has also exploited Moldova's infrastructure vulnerabilities. In March 2026, an attack on a Ukrainian hydroelectric plant near the Moldova border contaminated water supplies across both countries. Russian drones subsequently struck a high-voltage power line in western Ukraine that supplies up to 70% of Moldova's electricity, causing widespread outages.

NATO's eastern flank under pressure

US intelligence assessed that Russia might test NATO's mutual defense commitment as early as autumn 2026. Scenarios range from cyberattacks and sabotage to operations involving unidentified armed groups or a limited incursion into an eastern flank NATO country, as reported by The Wall Street Journal. One possible scenario involves a false-flag attack blamed on Ukraine, or the occupation of a small territory segment by an unmarked military group, similar to the annexation of Crimea. German Armed Forces inspector general Carsten Breuer warned about the frequency of hybrid attacks on NATO's eastern flank. Russia increasingly operates in a "gray zone" to destabilize European governments and institutions, using drones systematically to identify vulnerabilities.

Hybrid attacks occur daily.