Will Russia Attack Lithuania
A scenario-based assessment of intent, capability, warning indicators and deterrence
Summary
An open-source assessment of Russian intent, capability, warning indicators and deterrence affecting Lithuania, Belarus, Kaliningrad and NATO's eastern flank.
Report details
Open-source intelligence assessment
22 September 2026
Russia, Lithuania, Belarus, Kaliningrad and NATO eastern flank
This is an independent open-source assessment. It does not claim access to classified intelligence and does not predict a fixed date. It tests several pathways and states what evidence would change the judgment.
Bottom line
A deliberate full-scale Russian attack on Lithuania is unlikely in the next 24 months while the war in Ukraine continues at high intensity. Lithuania nevertheless faces a high and persistent threat from sabotage, cyber operations, electronic warfare, disinformation and accidental or deliberately ambiguous incursions. The risk of a conventional attack would rise materially after a ceasefire or frozen conflict if Russia can move forces west, rebuild reserves and conclude that NATO's political response is uncertain.
Evidence as of: 2026-09-22 · Confidence: MEDIUM · Version: 2
Published: · Modified:
Time horizons
0–24 months
Near-term invasion: Unlikely.
Now
Hybrid/covert action: High and ongoing.
Now
Airspace/maritime incident: Elevated.
2–5 years
Post-ceasefire military risk: Rising if triggered.
Beyond five years
Longer-term conventional threat: Plausible.
Key judgments
Near-term invasion: Unlikely, 0–24 months.
Hybrid/covert action: High and ongoing now.
Airspace/maritime incident: Elevated now.
Post-ceasefire military risk: Rising if triggered, 2–5 years.
Longer-term conventional threat: Plausible beyond five years.
Escalation pathways
Existing hybrid pressure below clear Article 5 thresholds.
Elevated accidental or engineered airspace and maritime incidents.
A plausible limited, deniable strike against infrastructure.
A conventional attack remains unlikely in the near term but becomes more plausible after Russian reconstitution and perceived NATO hesitation.
Executive judgment
The public record does not show a Kremlin decision to invade Lithuania. The judgment separates what Russia may want from what it can do now and from what NATO can deter.
The war in Ukraine remains the strongest visible constraint on a deliberate conventional attack. It consumes personnel, equipment and operational attention, while Russia's formations near NATO are expanding but many remain understrength. That combination points to future capacity and continuing ambition, not demonstrated readiness for a near-term war with the Alliance. [S1] [S2]
The more immediate danger is pressure below the threshold of clearly armed conflict: sabotage using recruited intermediaries, attacks or preparations against infrastructure and public or transport targets, cyber and influence operations, electronic warfare, and ambiguous airspace or maritime incidents. The GRU's reported use of intermediaries makes attribution and escalation management harder. [S3] Kaliningrad jamming and spoofing can disrupt aviation and shipping without requiring a conventional attack. [S4] Drone incidents show how attacks directed at Ukraine can create risk in Lithuania even when Lithuania is not the intended target. [S5] [S11]
NATO deterrence is substantial. Article 5, eastern-flank plans, allied forces already in Lithuania, Lithuania's developing 1st Division and the announced United States rotation raise the cost and uncertainty of aggression. [S7] [S8] [S9] [S10] [S14] The central risk is a change after a ceasefire or frozen conflict: if Russia can rebuild, move forces west and judge that allied cohesion or reinforcement would be slow, the conventional assessment would rise. [S1]
What Russia can do now
Sustained pressure below armed conflict
Russia can maintain pressure without crossing a clearly attributable armed-conflict threshold. The relevant toolkit includes sabotage, cyber and influence operations, recruited intermediaries and pressure on infrastructure. The GRU reporting describes a shift toward intermediaries and a wider range of possible targets, including transport, public places and facilities supporting Ukraine. That makes the immediate problem persistent and deniable rather than a single dramatic attack. [S3] Lithuanian reporting of planning against infrastructure adds warning context, but does not identify a target, place or time and is not by itself proof of an imminent strike. [S6]
Ambiguous incidents
Electronic warfare and incidents involving drones or maritime activity can create effects without a declared attack. Kaliningrad-based jamming and spoofing affect navigation used by aviation and shipping. [S4] The two July 2025 Gerbera crashes were assessed as accidental, while the September 2026 drone shot down over Lithuania was assessed as likely diverted from Ukraine. [S5] [S11] Those cases raise readiness and attribution concerns, but they should not be converted into evidence of a settled decision to attack Lithuania. In the Baltic Sea, Russian protection of the shadow fleet raises the chance that enforcement, escorting or coercive manoeuvres generate an incident that escalates beyond its original purpose. [S12]
Full-scale conventional capability
Russia retains the ambition to rebuild military capacity and is expanding formations near NATO's eastern borders, but the public evidence also describes losses in Ukraine, understrength units and weakened Kaliningrad land forces. [S2] Expanding formations therefore demonstrate a potential future force, not current readiness for a rapid full-scale operation against Lithuania. Public reporting indicates adaptation to economic slowdown rather than abandonment of military ambitions. [S15] The distinction matters: capability is not binary, and a state can be capable of harassment or a limited deniable action while remaining constrained in its ability to sustain a major conventional campaign.
Why a ceasefire changes the assessment
A ceasefire or frozen conflict would not make an attack likely by itself. It would remove the strongest present constraint on Russian force availability and recovery. A halt could allow personnel, equipment, ammunition and command attention to be rebuilt and forces to move west. The question would be whether redeployment was transparent and defensive or persistent, concealed and paired with offensive logistics. [S1] Transparent demobilisation, stored equipment and verifiable risk reduction would reduce concern. Persistent mobilisation, westward deployments, expanded ammunition and fuel storage, new logistics nodes, or exercises rehearsing isolation of the Baltic region would raise it. A ceasefire changes the baseline; it does not prove intent.
What makes Lithuania difficult to attack
Collective defence is the central deterrent. Article 5 and NATO's eastern-flank plans make an attack on Lithuania a test of the Alliance rather than an isolated bilateral operation. Those plans communicate that reinforcement and defence are prepared in advance, even though the exact political and military response to a particular ambiguous incident would still depend on attribution and circumstances. [S7] [S9]
Forces already in Lithuania add political and operational tripwires. The German Brigade Litauen has been integrated with the multinational battlegroup, Lithuania is building its 1st Division and the United States rotation adds another allied presence. These arrangements do not make Lithuania invulnerable, but they reduce the prospect that Russia could create a quick fait accompli without immediately involving several allies. [S7] [S8] [S10] [S14]
Resilience also matters. Hardening planned for the Gizai substation illustrates how infrastructure protection can reduce the payoff from drone or sabotage attempts. Physical resilience, redundancy and the ability to restore services complicate coercion even when they cannot prevent every incident. [S13]
What could weaken deterrence
Deterrence could weaken without failing outright. Allied force reductions, delayed reinforcement, gaps in air and missile defence or logistics, and a crisis elsewhere could make a rapid response less credible. Deniable attacks could produce disputed attribution, giving Moscow an opportunity to test political resolve before allies agree on the facts. Russia might also believe that a short operation could create facts on the ground before NATO reaches a decision, particularly if it assessed the Alliance as divided or distracted. These are risk factors, not evidence that deterrence will fail. The relevant question is whether the Alliance can preserve cohesion, attribute coercion and move forces quickly enough to deny an apparent low-cost opportunity. [S7] [S9]
Indicators
| Indicator | Raises concern | Reduces concern |
|---|---|---|
| Forces | Equipped formations move west, remain at high readiness and are supported by reserve call-ups rather than merely appearing on an organisational chart. [S1] [S2] | Units demobilise, equipment returns to storage and force expansion pauses or is transparently explained as long-term replacement. |
| Logistics | Ammunition, fuel, bridging, medical and repair capacity expand near likely axes and remain in place after exercises. | Logistics activity is temporary, transparent and not accompanied by forward stockpiling or movement toward the Baltic region. |
| Exercises | No-notice exercises rehearse isolation of the Baltic states, rapid movement through Belarus or coercive use of the Baltic Sea. | Exercises are announced, limited, observed and followed by withdrawal rather than persistent readiness. |
| Belarus | Belarus provides deeper basing, command, logistics or access for offensive activity rather than routine political and military alignment. | There is no sustained new basing or movement that changes the military geography of the approach. |
| Hostile narratives | Narratives are paired with mobilisation, fabricated incidents or demands that establish a pretext for action. | Rhetoric remains general, inconsistent and unsupported by operational preparations. |
| Covert action | Sabotage, recruited intermediaries, cyber activity or infrastructure reconnaissance increase alongside military readiness. [S3] [S6] | Incidents decline, investigations produce ordinary explanations and there is no linked pattern of preparation. |
| NATO posture | Reinforcement is delayed, allied forces are reduced, air defence and logistics gaps persist or another crisis absorbs political attention. | Reinforcement plans are exercised, allied presence remains cohesive and infrastructure resilience improves. [S7] [S8] [S13] [S14] |
Alternative explanations and challenge tests
Russia is preparing sooner than public evidence indicates.
Test: This alternative would strengthen if concealed mobilisation, equipped formations, forward logistics and coordinated covert preparation appeared together. It would weaken if force growth remained understrength, logistical movements were temporary and the war in Ukraine continued to absorb the resources needed for a major operation. Public silence alone cannot disprove it; the test is whether observable preparations accumulate across independent indicators. [S1] [S2] [S3]
Russia is coercively bluffing to raise Western costs.
Test: This would fit rhetoric, shadow-fleet pressure, electronic interference and ambiguous incidents that remain below an attack threshold. It would weaken if Russia accepted costs without achieving political concessions or if covert activity was paired with unmistakable conventional readiness. The bluffing explanation is compatible with a real hybrid threat; it does not make the pressure harmless. [S4] [S12]
NATO deterrence makes attack irrational.
Test: This is strengthened by allied presence, Article 5 planning, German and multinational forces, Lithuania's division and the United States rotation. [S7] [S8] [S9] [S10] [S14] It would weaken if reinforcement were repeatedly delayed, attribution remained disputed after attacks, or Russia assessed that a short operation could divide allies before they acted. Deterrence lowers the likelihood; it does not remove the need to watch for changes in its credibility.
What changes the judgment
Raise risk when a durable halt in Ukraine combines with rapid westward redeployment, equipped formations, excess logistics, deeper Belarus integration, a manufactured crisis and evidence that Russia expects NATO division.
Raise concern when covert attacks or infrastructure reconnaissance occur in a coordinated pattern alongside mobilisation, forward storage or exercises that rehearse isolation of the Baltic states.
Lower risk with defence cuts, demobilisation, halted formation growth, verifiable risk reduction, fewer covert actions, tested NATO reinforcement and stronger allied cohesion.
No single indicator is normally decisive. A hostile narrative can be messaging, a drone can be diverted, and an exercise can be routine. The judgment should change when several indicators occur in combination, persist beyond the stated activity and fit a coherent operational pathway.
Confidence and limitations
High confidence: Russia presents a serious hybrid and covert threat to Lithuania now. This rests on the reported use of intermediaries, electronic warfare, infrastructure concerns, airspace incidents and Baltic pressure, while preserving uncertainty about attribution and intent. [S3] [S4] [S5] [S6] [S11] [S12]
Moderate confidence: a deliberate conventional attack is unlikely within 24 months while the war in Ukraine remains at high intensity. The judgment reflects current constraints, understrength formations and substantial deterrence, not a claim that Russia lacks long-term ambition. [S1] [S2] [S7] [S8] [S9] [S10] [S14]
Low confidence: the exact timing of a conventional risk beyond two years cannot be forecast responsibly from public evidence. A ceasefire, frozen conflict, force regeneration and changes in allied cohesion could alter the baseline quickly.
Limitations are material. Public reporting may omit classified warning, reflect strategic messaging or describe events through incomplete information. Reuters reporting based on unnamed sources is useful corroboration but is never treated as sole proof. The assessment therefore separates intent, capability, opportunity and deterrence and uses qualitative likelihoods rather than unsupported numerical probabilities.
Methodology
This is an independent open-source assessment. It separates intent, capability, opportunity and deterrence; compares official Lithuanian and NATO reporting with independently reported current events; and tests multiple pathways rather than treating any one incident as decisive. It does not claim access to classified intelligence and does not predict a fixed date. It covers Russia, Lithuania, Belarus, Kaliningrad and NATO's eastern flank as of 22 September 2026. It uses qualitative likelihoods because the evidence does not support defensible numerical probabilities. Reuters reporting based on unnamed sources is used as corroboration and never as sole proof.
Correction / update log
- — Version 2.0 expands the explanation of capabilities, deterrence, alternative explanations, warning indicators and confidence while retaining the v1.0 central judgment, time horizons and 15-source register. Version 1.0 remains available in the public version history.
Source register
- S1 — Reduced Western pressure on Moscow would accelerate Russia's preparations for conflict with NATO (Primary official source)
- S2 — Russia is expanding its military capabilities near NATO's eastern borders despite losses in the war (Primary official source)
- S3 — The GRU is changing the methods of conducting kinetic operations and expanding the range of targets (Primary official source)
- S4 — Russia actively uses electronic warfare capabilities in Kaliningrad (Primary official source)
- S5 — Intensified Russia's UAV attacks against Ukraine have led to an increase in violations of Lithuanian airspace (Primary official source)
- S6 — Lithuania says Russia is planning attacks on infrastructure (Trusted news source)
- S7 — Strengthening NATO's eastern flank (Primary official source)
- S8 — NATO Multinational Battlegroup has merged with the German Brigade Litauen stationed in Lithuania (Primary official source)
- S9 — The Ankara Summit Declaration (Primary official source)
- S10 — New group of US troops on its way to Lithuania, Lithuanian president says (Trusted news source)
- S11 — Drone shot down over Lithuania was likely aimed at Ukraine, Lithuanian president says (Trusted news source)
- S12 — It is highly likely that the situation in the Baltic Sea will remain tense (Primary official source)
- S13 — Lithuania plans key substation near Russia fortified against explosive drones (Trusted news source)
- S14 — Lithuania's 1st Division bestowed with unit colors and command of key Land Force units (Primary official source)
- S15 — Russia adapts to an economic slowdown rather than changing its military ambitions (Primary official source)