Denmark's defence intelligence service has issued its bluntest warning yet about Russian escalation: there is a "low but growing risk" that Moscow launches a limited military attack against a NATO country in the coming months — not to seize territory, but to fracture the alliance that keeps Ukraine armed. The warning, delivered at a press conference in Copenhagen on September 24, landed in the same week that Poland declared a fire at a Starlink ground station serving Ukraine an act of sabotage.
For Kyiv, the message is double-edged. It confirms what Ukraine has long argued — that the war does not stop at its borders — and it raises the stakes of every European decision about weapons, money and air defence for the months ahead.
What the Danish assessment actually says
The updated threat assessment was presented by Thomas Ahrenkiel, chief of the Danish Defence Intelligence Service (DDIS, known domestically as the FE), alongside Defence Minister Jeppe Bruus. The agency says it can no longer rule out a limited Russian military operation against one or several NATO countries bordering Russia.
The scenarios it sketches are deliberately deniable. They include isolated long-range strikes with missiles or drones on NATO infrastructure that supports Ukraine; the deployment of a small number of soldiers into a NATO border area under the pretext of protecting Russian minorities, possibly operating without insignia; and even false-flag operations in which Russian personnel use Ukrainian-made drones to attack a NATO member. In one scenario, Moscow would simply claim that weapons landing on NATO territory had been jammed by Ukraine and diverted off course.
"The aim is not to take over the country, but to divide NATO," Ahrenkiel said. The agency assesses that such an attack would be a desperate attempt to redirect European resources away from Ukraine — and that it would only work if Russia calculates, correctly or not, that NATO will fail to respond collectively, "especially if Russia assesses that the United States cannot or will not support the European NATO countries in a potential war against Russia."
A full-scale invasion of a NATO country remains "highly unlikely," the agency stressed — but it can no longer be ruled out.
Hybrid war is already escalating
Alongside the military warning, the Danish assessment says Russia is likely to intensify its hybrid campaign against the West in the coming months: sabotage against defence companies and railway transports carrying military equipment, and destructive cyber attacks capable of crippling critical societal functions.
There is a telling shift in the assessment of what those hybrid attacks are for. Earlier operations, the agency notes, were mainly aimed at creating fear and weakening public support for aid to Ukraine. The new phase is aimed at physically stopping support from reaching Ukraine — cutting the arteries of the Western supply effort rather than merely its morale.
The Polish Starlink fire: a case study in real time
Warsaw provided this week's most concrete illustration. Shortly after 9 p.m. on September 23, firefighters from the Grójec district were called to a Starlink ground station in Wola Krobowska, about 40 kilometres south of Warsaw and operated by the state-owned telecom company Exatel. They found flames engulfing the housing of a power distribution box connected to the station's antennas, along with a damaged backup generator. The fire, covering about three square metres, was out by 3:19 a.m. Unofficial reports say a bottle containing a flammable substance was found near the damaged equipment; investigators have not ruled out an electrical short circuit, but lightning was ruled out.
Deputy Prime Minister Krzysztof Gawkowski minced no words: "The fire engulfed the power station and the generator; it is clear that this act of sabotage was deliberately designed to disable the station — effectively cutting off the internet connection... and disrupting internet access for various institutions, including the Ukrainian military." He said the station was operating normally again, that responsibility had not been established, but that "many signs suggest this aligns with Russia's new doctrine of attack."
Prime Minister Donald Tusk was more cautious, saying he disliked labelling an incident sabotage without 100 percent certainty — though he conceded it "looks bad." Russia has repeatedly denied involvement in sabotage incidents across Europe.
The target matters. Elon Musk activated Starlink over Ukraine in 2022 after Kyiv pleaded for help, and Poland has been paying for Ukraine's Starlink subscription ever since. Ukraine's military relies on tens of thousands of terminals for battlefield communications and some drone operations — and this year Musk agreed to switch off thousands of Russian "grey-market" Starlinks, a move that caused real problems for Russian forces. A ground station feeding that network is not a random target; it is a node in Ukraine's nervous system.
A regime under pressure — and a closing window
The Danish assessment does not portray a confident Kremlin. It judges that Russia is "under more pressure than at any other point during the war against Ukraine": sustained Ukrainian long-range strikes are causing extensive damage inside Russia, Moscow is paying heavy losses for marginal territorial gains, and the economy is nearing crisis under the weight of military spending, international sanctions and Ukrainian strikes on Russian energy infrastructure.
Nor does the agency see a Russian breakthrough coming: there is "no prospect of Russia achieving any major breakthrough in the war against Ukraine over the next six months," and Vladimir Putin remains "highly unlikely" to compromise on his fundamental war aims. Instead, the assessment suggests Moscow sees a closing window — Russia believes Europe will gradually develop an autonomous military capability that, by 2030, will pose an increasing threat to Russia, making the coming years the moment when "it is worth the risk attempting to drastically change the security order in Europe."
NATO's top commander in Europe appears to share the unease. Supreme Allied Commander Europe General Alexus Grynkewich called a string of recent incidents "concerning" — including an attempted drone strike at Germany's Leipzig/Halle airport and a Russian ship firing flares in the direction of a Danish military helicopter — while noting the United States would continue to provide "critical but more limited capabilities" as Europeans take up a greater share of the continent's defence.
Why this matters for Ukraine
Read together, the Danish warning and the Polish fire describe a Kremlin that cannot break Ukraine on the battlefield trying instead to break the coalition behind it — testing whether the alliance flinches when the war's infrastructure, rather than its front line, comes under attack. The Danish agency's core fear is disunity: a limited strike designed so that a divided response looks cheaper than a united one.
The answer the assessment implicitly demands is the opposite of what Moscow wants: treat attacks on the supply chain as attacks on all, and keep the weapons flowing to the country doing the actual fighting. Ukraine has held the line for more than four years; the warning from Copenhagen is that Europe's resolve is now the front line too — and Putin is watching it as closely as he watches the Donbas.
Watch our latest video coverage here: https://www.youtube.com/watch?v=cO2a4962aU0