Which NATO Country Would Russia Attack First?

On 18 October 2026, people in northern and central Lithuania took shelter for about an hour. A suspected drone had exploded over the north of the country, damaging a car but hurting no one. NATO jets scrambled but could not see it through cloud. Lithuania’s defence minister said it had probably come from Poland, which said it was checking. Ukraine expressed regret and suggested Russian jamming may have pushed a drone off course.

Nobody has yet shown who sent it. Whoever did, incidents like this keep one question alive: will Russia attack NATO, and if so, which country would come first? This analysis looks at the fears, the places named, Moscow’s view and the case against alarm.

Will Russia attack NATO? What intelligence services say they fear

US intelligence had long judged that Vladimir Putin would not attack a NATO country while his army was fighting in Ukraine. Earlier in 2026, that view changed, the Wall Street Journal and CNN reported in August.

CNN, citing three sources, reported that US intelligence now sees a limited Russian attack on a NATO member as possible. The Journal put the window between autumn 2026 and 2029. The options run from cyberattacks and sabotage to a small ground incursion, which officials saw as the least likely for now. The aim, they said, would be to test allied unity and America’s commitment, not to take land. One source quoted by CNN named the Baltic states or Poland as the likeliest targets.

On 17 September, Poland’s prime minister, Donald Tusk, told parliament that intelligence pointed to Russian plans for drone and missile strikes on countries that back Ukraine. Russia would call them accidents, he said, so that allies hesitate over Article 5. He also said “there is nothing to suggest an invasion”.

On 20 September, the head of Czech counter-intelligence, Michal Koudelka, told the Guardian that a Russian move could come within months, not years. Czech Prime Minister Andrej Babiš later said his government had received no such information. On 24 September, Denmark’s military intelligence service published its annual threat assessment. It rated the risk of a limited Russian attack on one or more NATO countries bordering Russia as “low but growing”.

When (2026)	Who	What they said
6 to 7 August	US intelligence, per the Wall Street Journal and CNN	A limited attack to test NATO is possible from autumn 2026 to 2029
17 September	Donald Tusk, Polish prime minister	Russia may stage “accidental” drone and missile strikes
20 September	Michal Koudelka, head of Czech counter-intelligence	A Russian move could come within months
24 September	Danish Defence Intelligence Service	A “low but growing” risk of a limited attack; an invasion highly unlikely
1 October	Vladimir Putin	Russia has “no intention of attacking anyone”
14 October	Mark Rutte, NATO secretary general	“No imminent threat” to NATO territory

Why would Russia test NATO instead of invading?

Under Article 5 of the North Atlantic Treaty, an armed attack on one member counts as an attack on all. Yet each ally then takes “such action as it deems necessary, including the use of armed force”. So every capital decides for itself how to respond.

That leaves room for doubt, and doubt is what a test would aim at. When his service published its report, Denmark’s intelligence chief put the point plainly:

The aim is not to take over the country, but to divide NATO.

Thomas Ahrenkiel, head of the Danish Defence Intelligence Service, 24 September 2026 (as reported in English)

The Danish report also sketched how such a move might look. Russia could strike infrastructure that helps Ukraine with drones or missiles. It could stage a false-flag attack with Ukrainian-made drones. Or it could send a small force into a border area, perhaps claiming to protect Russian minorities.

If the warnings are right, the first target would not be the place where Russia could take the most ground. It would be the place where a small, murky incident would most embarrass NATO. On that logic, three things would make a place attractive: a pretext Moscow could use, doubt over who is to blame, and distance from allied help.

Which country would Russia attack first? The places on the map

Published scenarios and official warnings keep returning to a few places, most of them around the Baltic Sea. None is a forecast. Each shows a different way a test could work.

Place	Country	Why it comes up	Latest sign (2026)
Narva	Estonia	Border city where most people speak Russian; ISW scenario	FSB night restrictions opposite the city, 16 to 26 September
Daugavpils and the eastern border	Latvia	Borders Belarus and Russia; large Russian-speaking population	Masked men cross from Belarus, 5 to 6 October
Suwałki Gap	Lithuania, Poland	The only land link to the Baltic states, about 65 km wide	Up to 100 Lithuanian soldiers ordered to the Kaliningrad border, 7 October
Small Baltic islands	Sweden, Denmark	Little military value, but a political effect	Warning by Sweden’s armed forces chief, April
Svalbard	Norway	Treaty limits on military use; a Russian mining town	A Norwegian court orders a Russian ship held, 31 August
Sulina, Black Sea	Romania	Suspected drone strikes on ships near the Danube’s mouth	F-16s shoot down two drones, 17 October

Narva, Estonia

Narva sits on the river that forms Estonia’s border with Russia, facing the Russian town of Ivangorod. At the 2021 census, it had about 53,900 people, and about 96% named Russian as their first language.

In September, the Institute for the Study of War (ISW), an American think tank, published a scenario for a limited incursion there. In it, Russian operatives inside the city seize public buildings and declare a “Narva People’s Republic”. Meanwhile, drone units fire from inside Russia to keep Estonian and allied forces away. ISW stressed that this is not a forecast, and it saw no large Russian build-up near the Baltic states.

From 16 to 26 September, Russia’s FSB security service barred people from moving at night outside towns and villages within 5 km of the border opposite Narva. The FSB cited border offences and fish stocks. Estonia said it saw no change in the threat. Some Estonian analysts doubt that a test could stay small. Merili Arjakas, of Tallinn’s International Centre for Defence and Security, argued that Moscow could not count on an operation in Estonia staying local.

Latvia’s eastern border

On the night of 5 to 6 October, masked men on the Belarusian side pushed about 20 migrants toward Latvia, and Latvian soldiers stopped them. Hours later, masked men crossed into Latvia, damaged an electrical panel and took two surveillance cameras. They went back to Belarus before border guards arrived. Latvia’s army told LETA, a news agency, that some escorts appeared to carry handguns.

Who sent them is disputed. Latvia’s border guard chief warned against blaming Belarus’s state bodies too soon and suggested organised smugglers. On 13 October, Belarus’s leader, Alexander Lukashenko, denied any Belarusian role and claimed the incident was staged to win EU money.

In Latvia’s south-east lies Daugavpils, the country’s second-largest city, close to the border with Belarus. Ethnic Russians made up more than 48% of its people in 2019, according to CEPA, a Washington think tank. However, CEPA argues that local protest votes reflect distance from the capital, not disloyalty.

Lithuania, Poland and the Suwałki Gap

The Suwałki Gap, about 65 km wide, is the only land route between the Baltic states and the rest of NATO. It runs between Belarus and Russia’s Kaliningrad exclave. On 7 October, Lithuania ordered up to 100 soldiers to help guard its border with Kaliningrad. It cited the Latvian incident and talk of Russian mobilisation, though the border itself stayed calm.

Poland, meanwhile, is building what its leaders call Europe’s biggest army: more than 220,000 soldiers by its own count.

The Baltic Sea islands

In April 2026, the head of Sweden’s armed forces, Michael Claesson, spoke to The Times about the islands. As Swiss media reported the interview, he warned that Russia might target small, uninhabited islands rather than Gotland or Denmark’s Bornholm. What would matter, he said, is the political effect, not their military value: a minimal provocation, then a wait to see what happens politically. Gotland, about 300 km from Kaliningrad, gives Sweden a central position in the Baltic, which is one reason Sweden’s NATO entry mattered.

Svalbard and the Black Sea

In the Arctic, Svalbard is Norwegian, but a 1920 treaty bans naval bases and fortifications there, and Russia runs a mining town at Barentsburg. Norway and Russia read the treaty’s limits differently. On the logic of a test, that legal grey zone matters more than the islands’ size.

In the Black Sea, attacks on shipping have come close to a NATO coast. On 14 October, a tanker caught fire inside Romanian waters off Sulina after a suspected drone strike. The next day, another tanker was hit just outside those waters. Seven of its 12 crew were still missing at the last count, and Romania said it was investigating. An unnamed NATO military source told Reuters the drones were “of Russian origin”, while Romania’s president declined to name Russia. On 17 October, Romanian F-16s shot down two drones over Romanian waters.

How does Moscow see the warnings?

Russia rejects the whole premise. At the Valdai Club on 1 October, Putin said Russia has “no intention of attacking anyone, not in 2029, not in 2030, not in 2050”. If Russia faces aggression, he added, it will respond. On 27 August, the Kremlin’s spokesman, Dmitry Peskov, called reports of a planned attack on NATO “scare stories” that “have nothing to do with reality”. Russia, he added, faces “a very aggressive policy” from European countries.

In Moscow’s view, NATO’s growth toward Russia’s borders is the real threat. Russia’s 2014 military doctrine lists that expansion first among the main external military risks. The roots of the quarrel run through Russia’s objection to Ukraine joining NATO.

On 30 September, Reuters reported a Russian note warning NATO that Moscow could use its full arsenal if the alliance tried to cut off Kaliningrad. Moscow says NATO is preparing a blockade of the region, and NATO denies any such plan.

In short, Moscow casts itself as the side under pressure, and NATO as the side that invents threats.

Is an attack imminent? The case against alarm

Even those who warn of a test do not expect an invasion soon. On 14 October, on a visit to Estonia, NATO’s secretary general, Mark Rutte, said the alliance sees “no imminent threat” to its territory. NATO would respond, he added, if it saw a Russian build-up.

Latvia’s security service agrees. Its director, Normunds Mežviets, told the Guardian his service sees no sign of an imminent attack. Russia’s resources, he said, remain limited by the war in Ukraine. Denmark’s report, for all its warnings, judged a full invasion highly unlikely and saw no sign that Russia is preparing one.

The ground tells a similar story. Finland’s army commander says Russia’s new bases near Finland’s border could hold about 80,000 troops. Yet he put the number there at about 20,000 in June. In March, Lithuania’s intelligence services judged that Russia could be ready for a limited conflict in the Baltic Sea region within 3 to 5 years after a temporary ceasefire in Ukraine. If the war goes on, they put it at 6 to 10 years.

Even so, Russia is not standing still. On 28 September, Putin raised the ceiling for his armed forces to 1,550,500 servicemen. Moreover, several of the starkest warnings reached the public as press reports of classified assessments, which outsiders cannot check. Both views can hold at once: officials see no invasion coming soon, yet several warn a smaller test is possible.

What to watch next

1. NATO’s Black Sea talks. Ambassadors are due to discuss the ship attacks on 20 October, at Romania’s request.
2. The Lithuanian drone inquiry. Lithuania’s defence minister has proposed a joint inquiry with Poland into where the 18 October drone came from.
3. America’s forces in Europe. Options for the Pentagon’s review of its troops in Europe are due on 6 November. America’s commitment is exactly what US intelligence says a test would probe.
4. The winter. Tusk called late autumn and winter the most critical moment of the war so far. Watch whether incidents on NATO’s border grow in number or in boldness.

If the warnings are right, a first test would aim less at NATO’s borders than at its nerve. Read more analysis on Europe.

Frequently asked questions

Will Russia attack NATO?

No one knows. US and European intelligence services say a limited, deniable Russian test of NATO is possible in the coming months or years, not a full invasion. NATO’s secretary general, Mark Rutte, said on 14 October 2026 that he sees no imminent threat to NATO territory. Russia says it has no intention of attacking anyone.

Which country will Russia attack next?

No government has named a single target. Published scenarios and warnings mention the Baltic states above all: Estonia’s border city of Narva, Latvia’s border with Belarus and the Suwałki Gap between Poland and Lithuania. One source quoted by CNN pointed to the Baltic states or Poland. These are fears that officials describe, not forecasts.

Will Russia attack Estonia?

Narva, an Estonian border city where most people speak Russian, features in a September 2026 scenario by the Institute for the Study of War. ISW stressed that it was not a forecast, and it saw no large Russian build-up near the Baltic states. In Tallinn on 14 October, NATO’s secretary general said he sees no imminent threat.

What happens if Russia attacks a NATO country?

Article 5 of the North Atlantic Treaty treats an armed attack on one member as an attack on all. Each ally then takes the action it deems necessary, which can include armed force. NATO has invoked Article 5 only once, after the attacks on the United States on 11 September 2001.

What if Russia attacked the Baltic states?

All three are NATO members, so Article 5 would apply. Much Western concern centres on the Suwałki Gap, the land link through which allied help would travel. RAND war games published in 2016 found Russian forces could reach the outskirts of Tallinn or Riga within 60 hours, against NATO’s forces of that time. NATO has added troops since.