Lithuania warns of Russian false-flag drone attacks on Baltic infrastructure

Lithuania has gone public with its most specific warning yet that Russia is preparing a false-flag operation in the Baltic region, using captured Ukrainian drones to strike critical infrastructure and make it appear that Kyiv was responsible. The assessment, released by the country's military intelligence service, comes as German investigators examine a drone armed with explosives found parked beside a Ukrainian Antonov transport aircraft at Leipzig/Halle airport, an incident that has not been attributed but fits the pattern of hybrid activity Western officials have tracked for months.

The Lithuanian assessment

Robertas Kaunas, Lithuania's defence minister, said the scenario involves a "fake Ukrainian drone" deployed against energy or transport targets in the Baltics. The objective, he argued, is to create a pretext for NATO to hesitate and scale back military support for Ukraine. Kaunas was direct about the alliance's likely response: "I can assure you that will not happen." The statement marks a shift from generalised warnings about hybrid warfare to a concrete operational hypothesis, complete with a proposed method, captured Ukrainian unmanned systems, and a strategic goal: fracturing allied unity.

Lithuania's State Security Department has been tracking Russian sabotage networks across the region for years. In 2023, the service expelled dozens of Russian diplomats identified as intelligence officers. The latest warning builds on that institutional memory. What distinguishes it is the specificity: not merely that Russia might attack, but that it intends to frame Ukraine for the attack, exploiting the very weapons systems the West has supplied to Kyiv.

Leipzig airport incident

One day before Kaunas went public, German federal police confirmed an investigation into a drone discovered at Leipzig/Halle airport on 8 August. The device, which contained explosives, was found near a Ukrainian Antonov An-124 cargo aircraft loaded with military ammunition. The aircraft had arrived from Leipzig's civilian freight terminal, where Ukrainian carriers regularly move Western-supplied materiel. No group has claimed responsibility. German authorities have not identified the operator, and the investigation remains open.

Michael Götschenberg, a security correspondent for ARD, described the pilot's identity as the single most important question. "As with every drone incident, the most important task here is to establish who its pilot was. Identifying the pilot is usually key to assigning responsibility, particularly if investigators are also examining a possible link to Russian hybrid warfare," he told Denník N. The proximity to a Ukrainian military flight raises the possibility of a staged provocation, though investigators have not stated a hypothesis publicly.

Recurring airspace violations

The Leipzig discovery does not sit in isolation. Since late 2023, Ukrainian long-range drones, launched against targets inside Russia, have repeatedly drifted into Lithuanian, Latvian and Estonian airspace after being disrupted by Russian electronic warfare. Kyiv has acknowledged the incursions, attributing them to GPS spoofing and jamming from Russian systems in Kaliningrad and the western military district. Each incursion forces NATO air policing missions to scramble, burning flight hours and creating diplomatic friction. The pattern serves a dual Russian purpose: it degrades Ukrainian strike accuracy and normalises unauthorised drone traffic over alliance territory.

Lithuanian air defence units have logged dozens of such events. In March, a Ukrainian drone crashed near Vilnius after losing navigation; in May, another was intercepted over the Curonian Spit. Neither carried explosives. But the frequency has accustomed civilian and military observers to the presence of Ukrainian-origin drones in Baltic skies, a familiarity that a false-flag operation would exploit.

Presidential warnings in July

The August intelligence release follows explicit warnings from both Baltic presidents in mid-July. Gitanas Nausėda told the BNS agency that Lithuania's intelligence services had received signals about planned attacks on critical infrastructure. "We have received such signals from our intelligence services. They do not specify a particular location or time, because the adversary has not yet completed its planning, and we know only about the plan or the target itself," he said. He listed "various means intended to physically damage critical infrastructure ... anything that disrupts the operation of these facilities."

At a joint press conference in Vilnius on 15 July, Latvian president Edgars Rinkēvičs reinforced the message. "The information we receive from Lithuania, Latvia and other NATO Member States points to various attempts at sabotage and efforts to weaken the security of our countries," he said. The coordination between the two presidents, both former foreign ministers with deep institutional knowledge, signalled a deliberate political decision to raise the threat profile before the summer recess.

Protective measures and alliance posture

In response to the July warnings, Lithuania ordered enhanced physical security at energy substations, gas interconnectors, rail junctions and port facilities. The measures include additional surveillance, barrier deployment and rapid-response team positioning. Latvia and Estonia have taken similar steps, though with less public detail. NATO's enhanced Forward Presence battlegroups in each country, led by Germany, Canada and the United Kingdom respectively, have integrated critical infrastructure protection into their exercise schedules.

The alliance's Brussels headquarters has not issued a public statement matching the Baltic specificity. NATO's standard position, reiterated at the Washington summit in July, is that hybrid operations below the Article 5 threshold will be met with "a coordinated response including attribution, diplomatic measures and enhanced resilience." Officials privately acknowledge that attribution remains the hardest link in the chain: a drone launched from Russian territory but programmed to mimic Ukrainian flight software, carrying a Ukrainian-made warhead, would challenge even sophisticated forensic analysis.

The strategic calculus

Why would Moscow risk a false-flag operation now? Three factors converge. First, Ukraine's long-range drone campaign has damaged Russian refineries, airfields and command nodes, imposing real economic and military costs. Second, Western ammunition deliveries, moved through Baltic ports and Polish rail hubs, have sustained Ukrainian artillery rates despite Russian production advantages. Third, the US presidential election in November introduces uncertainty about future American commitment. A provocation that forces NATO into a debate over whether Ukraine attacked alliance territory could paralyse decision-making at a moment when Moscow needs the coalition to fracture.

The Baltic states, with their short land borders with Russia and Belarus, their dependence on synchronised energy grids, and their role as logistical arteries for Ukraine, are the most exposed flank. They are also the most vocal. Lithuania's decision to publish the false-flag hypothesis, naming the method, the likely targets and the intended political effect, is itself a deterrent measure. By exposing the playbook before the play is run, Vilnius reduces its utility.