Danish Intelligence Sees 'Low but Growing Risk' of a Limited Russian Attack on a NATO Neighbor in Coming Months
Denmark's Defence Intelligence Service said on Sept. 24 that Russia will step up sabotage and cyberattacks and could make a small military move against a NATO country on its border. The agency also said a full invasion remains highly unlikely, and Moscow rejected the assessment.
A Warning With Two Halves
Denmark's military spy agency stood up in Copenhagen on Thursday and said something that sounds like two different stories at once. Russia is unlikely to invade a NATO country. And Russia might attack one anyway.
Both of those sentences came from the same report [5][2]. The Danish Defence Intelligence Service, known by its Danish initials FE, briefed reporters at Kastellet, a historic fortress in the capital. Defence Minister Jeppe Bruus, FE chief Thomas Ahrenkiel, and Defence Chief Michael Hyldgaard laid out the findings together [5][7]. The headline finding was careful, almost deliberately so: a "low, but increasing risk" that Russia could carry out a limited military attack on a NATO country that borders it. A full-scale invasion, the agency said, remains "highly unlikely" — but it can't be ruled out [5][2][6].
That combination is exactly why the story split in two directions once it hit the news. Outlets had to pick which half to put first. Which half you saw depended a lot on which paper you read.
What a "Limited Attack" Actually Means
Before getting into who said what, it helps to know what the agency is actually picturing. This isn't a tank column crossing a border. FE described two scenarios: long-range strikes on NATO sites that help supply Ukraine, or a small incursion by troops possibly wearing no insignia [1][22]. Ahrenkiel said Russia might use "protecting Russian minorities" as a public justification if it did act [18].
The goal in that scenario wouldn't be to seize territory. It would be to split NATO apart. Ahrenkiel put it directly: the aim would be "not to take over the country, but to divide NATO" [18]. That's the whole point of the report, and it's also the point of the mechanism at its center: NATO's Article 5.
Article 5 says an attack on one NATO member is treated as an attack on all of them. But it doesn't force any single country into a specific response. Each government decides for itself what action counts as "necessary" [22][1]. That flexibility is a feature when a full invasion is obvious and unified action is easy. It becomes a weakness when the attack is small, deniable, or ambiguous — a flare fired at a helicopter, an unmarked raid, a cyberattack nobody can trace with certainty. FE's argument is that Moscow might deliberately choose that kind of attack precisely because it's built to create disagreement among allies about whether it counts as an attack at all [22].
That's a serious strategic bet for Russia to make, and it explains why Denmark is sounding an alarm about something it also calls unlikely: the low odds are the point, not a contradiction. A gray-zone attack is designed to look small enough that some allies shrug it off.
The Danish Case, and Why the U.S. Matters to It
Denmark's argument rests on watching Russia struggle in Ukraine. Bruus said Russia is "under pressure and failing to meet its objectives," and that's exactly why it's "targeting the support being given to Ukraine" [18]. In other words, if Moscow can't win outright, cutting the flow of Western weapons and money to Kyiv becomes the next best option.
Denmark isn't a neutral observer here. It's one of the bigger suppliers of aid and weapons production for Ukraine, and Russia's ambassador has called Danish territory a "rear base" for Ukraine's military [15]. Danish security services said in early September that Russia was recruiting Danes to help plan sabotage [15]. About a week before the Sept. 24 report, a Russian frigate fired two flares toward a Danish military helicopter over international waters [8]. Denmark, in short, says it's already being tested.
The report names one more factor that could tempt Moscow: doubt about Washington. FE warned of "a risk that Russia assesses that the Nato countries will not respond collectively," especially "if Moscow believes the US is unable or unwilling" to back Europe [22]. That line ties the whole Danish warning to a question this report can't answer on its own — what the Trump administration would actually do.
Moscow's Answer, and a White House Sending Mixed Signals
Russia's embassy in Denmark rejected the assessment outright, saying it isn't backed by credible evidence and that Denmark and the West are the ones driving up tensions [8]. The embassy added: "Our persistent warnings about the destructiveness of such an approach are being ignored" [8]. A month earlier, Kremlin spokesman Dmitry Peskov had dismissed similar U.S. intelligence reports about a possible Russian attack on NATO as "scare stories," saying "they have nothing to do with reality" [11][12]. Moscow also points to a detail buried inside FE's own report: the agency said it sees no concrete Russian plans for a war against a NATO country [19][9].
Washington's public position leans toward Moscow's read, at least in tone. On Aug. 27, President Trump told reporters that Putin is "not going to attack a NATO territory," and he waved off CIA Director John Ratcliffe's Moscow trip that same week as "standard business" [13]. But other reporting complicates that picture. CNN reported that during that same Moscow visit, Ratcliffe actually warned Russian intelligence officials against attacking NATO [14]. Axios separately reported he floated the idea of a three-way summit with Trump, Putin, and Ukrainian President Zelensky [21]. And the Wall Street Journal has reported that U.S. intelligence assessments see Putin as capable of testing NATO with a "limited assault" — though on a longer timeline, within the next few years rather than Denmark's "coming months" [12].
So the U.S. position isn't really one position. It's public reassurance from the president, paired with a private warning from his own intelligence chief, paired with a longer-range intelligence estimate that partly agrees with Denmark's concern. That's the ambiguity Denmark's report is worried allies might read as weakness.
One Report, Read Two Ways
The clearest sign that this story has two honest readings is what happened when it hit headlines. U.S. outlets like CNBC and the Guardian led with the timeline: "Russia could attack a NATO country within months" [3][22]. European outlets like Euronews led with the reassurance: an invasion is "highly unlikely" [2]. Both are accurate quotes from the same report. Neither is the whole report.
Reuters came closest to the agency's own emphasis, leading with the finding FE itself rated most likely — an escalation of hybrid warfare, meaning sabotage, cyberattacks, and deniable incidents rather than open combat — while including both Russia's rebuttal and the flare incident [8]. The Epoch Times matched the report's own word choice, calling an escalation "likely" without headlining the low-probability attack scenario [10]. At the far edge, a repost on the Zambian Observer, an aggregator-style outlet, went further than any primary source did, saying Russia is "reportedly preparing" a strike — even though FE explicitly said it has no evidence of concrete war plans [17][19].
Ukrainian coverage, meanwhile, treated the report as confirmation that Russia's war was never confined to Ukraine's borders in the first place. The Kyiv Independent framed hybrid attacks on NATO countries as part of the same campaign Russia is already running against Ukraine [9], and the report itself says any such strike would aim to "redirect European resources away from supporting Ukraine" [19] — an outcome that would obviously hurt Kyiv's position.
What's Actually Being Tested
Strip away the competing headlines and the underlying disagreement isn't really about whether Russia will invade a NATO country. Almost nobody, including Russia's critics, is claiming that. The real question is narrower and harder to settle: is a small, deniable Russian move a near-term danger NATO needs to prepare for now, or is that a low-odds scenario being inflated into an alarm?
Denmark and its allies are choosing to treat the possibility as real enough to prepare for, even while agreeing the odds are low. Moscow is choosing to treat the warning itself as the provocation. Trump's public comments lean toward Moscow's framing, even as his own CIA director appears to be taking the scenario seriously enough to warn against it directly [13][14].
None of that resolves anything. FE's report doesn't predict an attack — it estimates a probability, and calls it both low and rising [5][2][19]. What happens between now and whenever "the coming months" runs out will depend on decisions in Moscow, Washington, and Brussels that haven't been made yet.
Summary
Denmark's military intelligence service warned on Thursday, Sept. 24, 2026, that Russia is growing more willing to take risks. It said Moscow will step up its 'hybrid war' against NATO in the coming months [5][8]. Hybrid war means hostile acts short of open war, like sabotage and cyberattacks, that are hard to pin on a state. The agency said future attacks could include cyberattacks that knock out key public services, and sabotage with a high risk of deaths [7][8].
The biggest headlines came from one line. The agency said there is a 'low but growing risk' that Russia could launch a limited military attack on one or more NATO countries that border it [5][8]. It said this 'could potentially take place in the coming months' and called it 'a desperate move' [19][9]. The scenarios it named were long-range strikes on NATO sites that support Ukraine, or a small incursion by troops possibly wearing no insignia [1][22]. The agency said the goal would be to divide NATO, not to take a country [18]. It also said a full invasion remains highly unlikely, and that it sees no concrete Russian plans for war with a NATO country [2][19].
Russia's embassy in Copenhagen rejected the report as lacking credible evidence. It blamed Denmark and the West for raising tensions [8]. The warning also lands in a U.S. debate. A month earlier, CIA Director John Ratcliffe met Russian intelligence chiefs in Moscow. CNN reported that he warned them against attacking NATO [14]. President Trump said Putin is 'not going to attack a NATO territory' [13].
The core dispute is not whether Russia will invade Europe. Almost no one claims that. The dispute is whether a small, deniable Russian move is a real near-term danger that NATO must prepare for now, or alarm that inflates a low-odds scenario. Denmark and its allies take the first view. Moscow takes the second, and Trump's public comments lean toward it [2][8][13].
The Event
On Sept. 24, 2026, Denmark's Defence Intelligence Service (FE) released a new threat assessment of Russia at a press conference at Kastellet in Copenhagen. Defence Minister Jeppe Bruus, FE chief Thomas Ahrenkiel and Defence Chief Michael Hyldgaard presented it [5][7]. The assessment said Russia will intensify hybrid attacks on NATO. It said there is a 'low, but increasing risk' of a limited Russian military attack on a NATO country bordering Russia [5][8]. Russia's embassy in Denmark rejected the assessment [8].
Undisputed Facts
- Denmark's Defence Intelligence Service published a Russia threat assessment on Sept. 24, 2026, and presented it at a press conference in Copenhagen [5][7].
- The assessment described a 'low but growing risk' of a limited Russian military attack on one or more NATO countries that border Russia [5][8].
- The same assessment said a full-scale Russian invasion of a NATO member is highly unlikely but cannot be ruled out [2][6].
- The agency said it does not see concrete Russian plans for a war against a NATO country [19][9].
- Russia's embassy in Denmark rejected the assessment as not backed by credible evidence [8].
- In August 2026, Kremlin spokesman Dmitry Peskov called U.S. media reports about a possible Russian attack on NATO 'scare stories' [11][12].
- On Aug. 27, 2026, President Trump told reporters that Putin is 'not going to attack a NATO territory' [13].
- The Danish report came about a week after a Russian frigate fired two flares toward a Danish military helicopter in international waters off Denmark [8].
The Pressure
Strip away the moralizing and blame. What structural realities persist regardless of which narrative wins?
- Article 5's gray zone
- NATO's pledge treats an attack on one as an attack on all, but each member chooses its own response. That leaves room for disagreement over small or deniable attacks. The Danish report says Moscow may try to exploit this [22][1].
- Russia's war aims in Ukraine
- Denmark argues that Russia, falling short in Ukraine, wants to cut the flow of European support to Kyiv. It says hybrid and limited attacks on NATO serve that goal [18][19].
- U.S. strategic ambiguity
- Washington's public signals are mixed. The president says Putin won't attack. Yet the CIA director reportedly warned Moscow not to. European allies read deterrence partly through that mix [13][14].
- Denmark's exposure
- Denmark hosts production and logistics for Ukraine's military. Moscow cites that as a reason Denmark faces risk, and Danish authorities report active Russian recruitment for sabotage [15].
Material realityThis is an intelligence judgment about probabilities, not a report of an attack. The agency rated the chance of a limited military attack 'low but growing.' It rated a full invasion highly unlikely and said it saw no concrete war plans [5][2][19]. What it treated as likely is more hybrid activity: sabotage, cyberattacks and incidents at sea. Those are already happening in some form. One example is the Russian frigate firing flares toward a Danish helicopter [8]. Other examples are the recruitment of Danes for sabotage planning [15]. U.S. intelligence has separately judged that Putin could test NATO with a 'limited assault' within the next few years. That is a longer timeline than Denmark's 'coming months' [12].
Narrative as a weaponThree sets of actors are shaping how this is read. Denmark and allied governments want the public, and especially Washington, to see a small attack as a real, near-term test of NATO. That view supports spending, unity and aid to Ukraine. Moscow wants the warning seen as 'scare stories' and Western provocation, so the blame for tension falls on NATO [11][8]. The Trump White House has played down the risk in public while keeping diplomacy with Moscow open [13][21]. News headlines then pick a side of a two-sided finding. U.S. outlets led with 'within months.' European outlets led with 'highly unlikely.' A few reposts upgraded 'could' to 'preparing' [3][2][17]. Readers should keep both halves: a low-odds risk that the agency says is rising.
How Each Side Sees It
Each major actor’s view — how it frames things, its underlying incentive, and how it’s materially affected. Tap a side to read it.
Frames it asTheir strongest case is that intelligence services exist to warn early. The goal is to name a danger while there is still time to deter it. Russia is 'under pressure and failing to meet its objectives,' Defence Minister Bruus said, 'That is why they are targeting the support being given to Ukraine' [18]. The report's central concern is how NATO's mutual-defense pledge works. Article 5 of the NATO treaty says an armed attack on one member counts as an attack on all. But each member decides for itself what response is 'necessary.' So the pledge works best against a clear, large invasion. A small raid by troops without insignia, or a strike on one depot, is built to fall in a gray zone. Some allies may call it war. Others may call it an incident. That gap is what Denmark says Moscow could test. It warned of 'a risk that Russia assesses that the Nato countries will not respond collectively,' especially if Moscow thinks the U.S. won't back Europe [22]. Ahrenkiel said Russia could use 'protecting Russian minorities' as a pretext. He said the aim would be 'not to take over the country, but to divide NATO' [18].
WhyDenmark is a major supplier of aid and weapons production for Ukraine. Russia's ambassador has called Danish territory a 'rear base' for Ukraine's forces [15]. Copenhagen wants allies, above all the U.S., to treat a small attack as seriously as a large one. That makes deterrence credible and keeps support for Ukraine going [22][15].
Impact on themDenmark says it is already a target. In early September its security service said Russia was recruiting Danes for sabotage planning [15]. Its helicopter was fired on with flares [8]. A public warning helps the government justify defense spending at home. It also exposes Copenhagen to Russian charges of stoking tension [8].
Frames it asMoscow's strongest case is that it has no plan or reason to attack NATO. It says Western intelligence warnings are meant to scare the public. Peskov said of such reports: 'A lot of such scare stories are being published right now. Of course, they have nothing to do with reality' [11][12]. Russia's embassy said the Danish report lacks credible evidence and that the West, led by Denmark, is raising tensions. It said, 'Our persistent warnings about the destructiveness of such an approach are being ignored' [8]. In Moscow's view, the real driver of danger is Denmark's deep role in arming Ukraine. Its ambassador said that role 'poses security risks to Denmark and its citizens' [15]. Moscow notes the Danish agency itself found no concrete war plans [19].
WhyRussia wants Western aid to Ukraine reduced and NATO unity weakened. It also wants to avoid being blamed for sabotage or incidents it denies [18][8].
Impact on themWestern warnings like this one can lead to more NATO forces near Russia's borders and more support for Ukraine. Both work against Moscow's goals [3][22].
Frames it asThe White House's public line is that Russia will not attack NATO. Trump said Putin is 'not going to attack a NATO territory.' He called Ratcliffe's Moscow trip 'standard business' [13]. The strongest form of this view is that talking up war odds can backfire. It can harden positions and cut off diplomacy. Axios reported that during the trip Ratcliffe floated a summit of Trump, Putin and Zelensky [21]. At the same time, CNN reported that Ratcliffe did warn Russia against attacking NATO [14]. And the Wall Street Journal reported U.S. assessments that Putin could test NATO with a 'limited assault' within the next few years [12].
WhyThe administration wants room to negotiate an end to the Ukraine war with Moscow. It also wants Europe to carry more of its own defense [13][21].
Impact on themThe Danish report names doubt about U.S. support as a factor that could embolden Russia [22]. That puts Washington's commitments at the center of the European debate. Any small attack on a NATO border state would force a U.S. decision under Article 5 [22][1].
Frames it asKyiv's view, reflected in Ukrainian outlets, is that the report confirms Russia's war is not confined to Ukraine. Hybrid attacks on NATO countries are part of the same campaign [9]. The Danish report says any Russian strike would aim to 'redirect European resources away from supporting Ukraine' [19]. Kyiv reads that as an argument for more Western support, not less.
WhyKeeping European aid and weapons flowing, and keeping NATO united [9][19].
Impact on themIf Russia succeeded in splitting NATO or diverting European resources, Ukraine would lose support. That is the outcome the report says Moscow is aiming for [19][22].
Like this article?
The Bias Ledger average rating 3.9
The same story, as framed by outlets across the spectrum, ordered least to most biased. The bias score (1 = straight, 10 = heavily spun) is an AI assessment of that framing — click an outlet to see its track record. The tell is the word choice or omission that reveals the angle.
| Outlet | Vantage | Bias | How they frame it | The tell |
|---|---|---|---|---|
| Reuters | International wire, center | 2 | Denmark Expects Russia to Escalate Hybrid Warfare in Coming Months, Intelligence Service Says | It leads with the finding the agency rated most likely, hybrid war. It includes Russia's rebuttal and the frigate flare incident. Its emphasis is closest to the report's own. |
| Euronews | European center | 3 | Denmark says Russian invasion of NATO country 'highly unlikely' but cannot be ruled out | It leads with the reassuring half of the finding. That is the reverse of U.S. headlines, and it underplays the limited-attack scenario that drove the news. |
| The Epoch Times | U.S. right | 3 | Russia Likely to Escalate Hybrid Warfare Against NATO Countries: Danish Intelligence | This is sober framing that matches the report's 'likely' finding. It does not headline the low-probability attack. |
| Kyiv Independent | Ukrainian, pro-Kyiv | 3 | Denmark warns Russia could escalate hybrid attacks against NATO in coming months | The headline is measured. The coverage presents Russian hybrid war on NATO as one campaign with the war in Ukraine. |
| CNBC | U.S. center (business) | 4 | Russia could attack a NATO country within months, Danish intelligence warns | 'Within months' is in the headline, but the report's word 'low' is not. The timeline is accurate, but the odds are left out of the most-read line. |
| The Guardian | U.K. center-left | 4 | Russia could attack a Nato country within months, Danish intelligence says | It calls this 'one of the starkest warnings yet' and puts U.S. reliability under Trump up front. The body keeps the 'low but growing' qualifier. |
| Zambian Observer | Zambian, aggregator-style | 8 | Russia Reportedly Preparing Limited Strike on NATO to Disrupt Ukraine Support | 'Preparing' goes beyond the source. The Danish agency said it sees no concrete Russian plans and rated the risk 'low.' |
References
- Russia could attack a Nato country within months, Danish intelligence says — Irish Examiner · Irish commercial daily, center
- Denmark says Russian invasion of NATO country 'highly unlikely' but cannot be ruled out — Euronews · European broadcaster, partly EU-funded, center
- Russia could attack a NATO country within months, Danish intelligence warns — CNBC · U.S. business network (Comcast/NBCUniversal), center
- Denmark Warns of Rising Risk of Russian Attack on a NATO State — Bloomberg · U.S. financial news, center
- Danish intelligence service warns Russia may intensify hybrid attacks against West and NATO — The Copenhagen Post · Danish English-language weekly, center
- Danish spy agency: Russian invasion of Nato country 'highly unlikely' but cannot be ruled out — The Local Denmark · English-language news for expats in Denmark, center
- FE: Rusland vil intensivere hybridkrig med hyppigere angreb — DR · Danish public broadcaster, state-funded, center
- Denmark Expects Russia to Escalate Hybrid Warfare in Coming Months, Intelligence Service Says — Reuters (via U.S. News & World Report) · International wire service, center
- Denmark warns Russia could escalate hybrid attacks against NATO in coming months — Kyiv Independent · Ukrainian independent outlet, pro-Kyiv
- Russia Likely to Escalate Hybrid Warfare Against NATO Countries: Danish Intelligence — The Epoch Times · U.S. right; linked to the Falun Gong movement
- Kremlin labels possible attack on NATO as 'scare stories' — RTÉ · Irish public broadcaster, state-funded, center
- Russia dismisses as 'scare stories' US reports about attacking NATO — Courthouse News Service (AFP wire) · U.S. legal news outlet carrying French wire service copy, center
- Trump Says Putin Will Not Attack NATO Territory, Downplays Ratcliffe Trip — Reuters (via U.S. News & World Report) · International wire service, center
- CIA Director John Ratcliffe was in Moscow to warn Russia against attacking NATO and encourage cutting off Iran — CNN · U.S. center-left
- Russia Recruits Danes for Sabotage Planning, Denmark Says — Reuters (via U.S. News & World Report) · International wire service, center
- Russia looking to escalate hybrid war, Denmark warns — Semafor · U.S. digital outlet, center
- Russia Reportedly Preparing Limited Strike on NATO to Disrupt Ukraine Support — Zambian Observer · Zambian online aggregator, tabloid-style
- Russia may strike NATO nation to disrupt Ukraine support, intel report claims — and it could come soon — NewsBeep (repost) · Aggregator repost of U.S. tabloid-style coverage
- Danish intelligence warns Russia could attack NATO — UK Defence Journal · U.K. defense-industry-focused outlet, pro-NATO
- Danish intelligence sees rising risk of limited Russian attack on NATO — Nordic Defence Sector · Nordic defense-industry trade outlet
- CIA director Ratcliffe floated Trump-Putin-Zelensky summit during Moscow visit, sources say — Axios · U.S. digital outlet, center
- Russia could attack a Nato country within months, Danish intelligence says — The Guardian (via inkl) · U.K. center-left, trust-owned