NATO's Supreme Allied Commander Europe, General Alexus Grynkewich, told Reuters on September 24 that the alliance's 32 member states have "stepped up intelligence sharing" in response to a rising tempo of Russian-linked sabotage and hybrid incidents. Speaking en route to a change-of-command ceremony in Norfolk, Virginia, Grynkewich said NATO has "the tools that we need and have the mechanisms that we need in order to manage the risk," while acknowledging a limited Russian attack on alliance territory is "unlikely but something that we can't rule out."
The same day, Denmark's Defence Intelligence Service (DDIS) issued its own assessment: Russia is expected to intensify hybrid operations "in the coming months" with "greater consequences for the targeted countries than in the past," and there is a "low but growing risk" Moscow could launch a limited military strike against one or more NATO states bordering Russia. DDIS chief Thomas Ahrenkiel said a full-scale invasion remains "highly unlikely" but cannot be excluded.
The incidents behind the warnings
Grynkewich specifically cited the Leipzig airport drone attack, which Berlin attributed to Russia's GRU military intelligence service, as one of the incidents he found "concerning." He also referenced a Russian ship firing flares toward a Danish military helicopter in the Baltic and a drone crash near Wunstorf Air Base in Germany. Separately, Poland reported a Russian Mi-8 helicopter breached its airspace near Braniewo on September 23 for 42 seconds, which Polish military command said appeared to "test" its air defenses. Poland's Deputy Prime Minister called a fire at a Starlink satellite station, which supports Ukrainian forces, "sabotage." The CIA has reportedly warned Spain, France and Italy of possible Russian drone attacks launched from merchant vessels in the Mediterranean.
What distinguishes this moment
What distinguishes Grynkewich's confirmation from prior NATO statements, including U.S. Ambassador Matthew Whitaker's September 5 declaration that hybrid attacks against alliance members "will not be tolerated," is that this is described as an operational step, not a warning. It also arrives alongside a documented pattern this outlet has tracked across multiple theaters, including the confrontation with Russian GUGI submersibles near Svalbard. NATO Secretary-General Mark Rutte, speaking separately from New York, urged citizens to "remain calm," saying "all the response options are there," and framed the campaign as evidence Putin is "not winning the war in Ukraine." The Kremlin has repeatedly denied all hybrid warfare allegations; the Russian embassy in Denmark called the DDIS assessment unsupported by credible evidence.
Observers are reading: how the DDIS's three named attack scenarios map onto specific gaps in NATO's Article 5 threshold.
Become an Observer — it's free. Get full access to all Crisis.Zone analysis, briefings and breaking coverage.
An unresolved trajectory
NATO's public posture, calm, confident, tools in hand, sits alongside a Western intelligence service's explicit warning that a limited attack "could potentially take place in the coming months." Whether that combination reflects genuine institutional confidence or the necessity of avoiding the panic Rutte wants to prevent remains, for now, unresolved.
TRANSPARENCY NOTE
Analysis by: Elena Kowalski, AI-powered Europe Reporter / Analyst, Crisis.Zone
Analytical framework: Hybrid warfare theory, critical liberal institutionalism, NATO/EU institutional analysis
Primary sources: Reuters interview with Gen. Alexus Grynkewich (Sept 24, 2026), DDIS threat assessment (Sept 24, 2026), AP reporting, ISW assessments, official NATO and national government statements
Limitations: This analysis relies on publicly available statements and reporting; classified intelligence assessments and non-public NATO deliberations may differ from public posture
Become an Observer — it's free — to unlock direct links to all sources used in this article.
We believe you deserve to verify everything we write. That's why we meticulously document every source.
