Two Italian Eurofighters, flying a peace keeping mission, for the North Atlantic Treaty Organization (NATO) shot down a drone over Lithuania after midnight on September 15. It crossed from Belarus and spent about 30 minutes in Lithuanian airspace. Lithuania's air force commander said the wreckage points to an explosive payload. The evening prior, a Russian frigate fired two flares at a Danish helicopter and Copenhagen summoned the ambassador.

This is the gray area which Russian warfare has called home since the end of the Soviet Union. Deniable attacks which raise the eyebrows of diplomats rather than armies. This tactic is all about resetting a baseline so no one realizes they're already on an escalation ladder.

Basically, Russia wants a stray drone or limited cyber attack to become "business as usual," to give it the decision advantage for a rapid advance.

Confusion is Russia's strongest weapon.

The Institute for the Study of War (ISW) has tracked what it calls Phase Zero since October 2025: drone incursions, sabotage, GPS jamming and claims from Russia's Foreign Intelligence Service (SVR) that someone else is about to stage an attack. Claims that NATO will attack itself as pretext for a wider war against Russia provides enough plausibility cover to puzzle the media and policymakers.

In July, ISW tied American and European warnings of a provocation against Poland or the Baltic states to the same campaign. There's a simple logic to this: Moscow will hold off on an open move until it believes NATO will fail to answer as one.

Imagine a boxer popping their jab to test distance or cut an angle rather than make direct impact. When their opponent begins to ignore it, they're open for a haymaker. That is, at least, if Russia has the ability to throw that shot.

Ukraine's bet is that by damaging oil infrastructure and imposing costs, on Putin's core supporters, he will have neither the will nor the fuel to continue fighting.

Rung two is pretext and infrastructure. On May 13 the State Duma passed a law letting Putin use the armed forces to protect Russian citizens arrested or prosecuted by foreign courts. Remember, around 2 percent of the population of the Baltic states is Russian citizens. Around 14 percent are ethnic Russians. Putin has a long history of annexing territory under the guise of "protecting Russians."

But pretext is one thing. Launching a large ground offensive Moscow requires boots and beds. It appears that this is currently in the build-out phase. A joint investigation by four Nordic and Baltic newsrooms using Planet Labs imagery found new barracks and ammunition depots along Russia's western border from Pechenga to Baltiysk in Kaliningrad, the Russian exclave sitting between Poland and Lithuania.

Rung three is massing forces. A February Belfer Center study says hybrid pressure plus massed forces would give a clear signal of invasion. This means keeping an eye out for new or renovated railheads since a significant amount of logistical support in Russia happens through trains. This lends more logic to Ukraine's attacks on diesel production since it fuels Russian trains.

But getting forces in means supporting them during a fight. Building this capacity means creating plausible deniability in a world where everything is visible from space. Before February 2022, Britain's defense intelligence chief pointed to a field hospital arriving at the Ukrainian border.

Russia hid that buildup inside exercises, and this is exactly what the Baltics are looking for. Fortunately for NATO, it appears that massing Russian forces constrained by fuel and manpower might be a bridge too far.

The Center for Strategic and International Studies (CSIS) reports Russian casualties outrunning recruitment this year. An army losing men faster than it replaces them cannot open a second front. However, this assumes the current rate of recruitment stays flat. It is possible that Russia is currently preparing for a mass mobilization after elections.

Until then Russia is stuck with pinprick attacks and level-setting. American intelligence expects a possible limited incursion this fall, and Central Intelligence Agency (CIA) Director John Ratcliffe flew to Moscow on August 25 to warn against it. Lithuanian President Gitanas Nausėda has named energy and transport infrastructure as the probable target.

Getting out of the gray zone. A limited strike would look like the September drone incursion with a target. It would likely cross the border from Belarus and hit a substation or a rail junction tied to the European grid. The airframe would be a captured Ukrainian model, so the wreckage points at Kyiv, and Moscow could blame Ukraine. At this point, no soldiers would run across the border or attempt to raise a flag, but it would knock the lights out. This would be enough to trigger an important test for Moscow.

Then the fight moves to Brussels, where the allies meet under Article 4 and argue over whose drone it was while Russia watches how Washington reacts. Even though the US has cooled on NATO, an incursion like this would demand a response. One airframe and one night buy Moscow a reading on if the alliance could answer as one, or if it has popped enough jabs to send a haymaker down the pipe.

60 percent chance that Estonia, Latvia, Lithuania or Poland attributes a kinetic attack on its energy or transport infrastructure to Russia or Belarus in the next 90 days.