Each row is a canonical record with direct evidence links. Leads, capabilities and ruled-out cases stay separate from attributed incidents. Evidence measures source strength; escalation measures consequence—not likelihood.
63 of 63 records
Date / place
Record
Assessment
Evidence
Escalation
Source
Details
Romania · East of Vylkove, near Tulcea
Romanian fighters monitored an aerial target without an airspace incursionAerial target near the border · Air / drone
Attribution unresolvedControl · Activity near NATO territory; no incursion
Commercial imagery showed new surface works and a second visible tunnel entranceUnderground test-site entrances and surface works · Imagery / capability
Romania is the most exposed NATO edge in this theatre. That does not establish it as Russia's selected target. The dashboard separates activity near Romania from evidence of hostile intent against Romania.
Current postureHigh activity · direct attack not establishedPrimary vector: aerial and maritime drones
Exposure hotspotDanube delta
Tulcea, Sulina, Chilia Veche, Galați and Grindu sit beside Russian strike routes into Izmail, Reni and Orlivka.
Infrastructure hotspotConstanța–Neptun Deep
Port logistics, offshore gas, shipping lanes and the Romanian EEZ create a second air-and-maritime drone exposure zone.
Trigger sourceNovorossiysk / Tsemess Bay
Repeated attacks on Russia's naval refuge and oil and grain terminals could generate retaliation, coercive rhetoric or wider Black Sea activity.
Areas to watch
01
Danube border corridor
Repeat incursions, debris falls, alerts or strikes immediately opposite Romania. Deep or repeated tracks carry more weight than brief spillover.
Russian statements naming the NATO air base, reconnaissance near its approaches, or sabotage against connected logistics would be significant.
04
Novorossiysk response cycle
Track the sequence: attack on Russian port or fleet assets → official attribution → threats naming Romania → military or hybrid response.
Escalation indicatorsWhat would change the assessment
WATCH
Russian officials allege Romanian territory, intelligence, aircraft or bases enabled an attack on Novorossiysk, Crimea or a Russian vessel.
HIGH
A warning or threat explicitly names Constanța, Mihail Kogălniceanu, Neptun Deep or Romanian military forces.
HIGH
Repeated or deep drone tracks enter Romania, loiter, approach infrastructure or recur on the same route without a credible spillover explanation.
WATCH
Russian naval sorties, missile loading, bomber activity, GNSS disruption or unusual AIS loss rises after a Novorossiysk attack.
CRITICAL
Russia attributes casualties or loss of a strategic asset to Romanian military action, or a Russian weapon deliberately engages Romanian territory or forces.
A single indicator is not proof. Confidence rises when diplomatic language, force posture, technical tracks and effects align in time.
These are collection priorities, not predictions and not proof of a single command structure. Counts use canonical operations so one coordinated parcel campaign is not mistaken for several independent campaigns.
01 · Highest verified density
Poland corridor
Commercial arson, proxy attacks, rail explosives and energy-sector cyber activity form the densest verified cross-domain cluster.
Airspace events, rail arson, defence-supply fires, proxy recruitment, GNSS interference and border pressure overlap—but do not share one attribution status.
The 2024 incendiary parcel is tied to a GRU-linked network. The separate August 2026 explosive-drone incident remains a high-priority attribution case.
Repeated incursions, near-border alerts and maritime drones make Romania the most exposed NATO edge in the Black Sea. Novorossiysk is tracked as a potential trigger source; direct Russian targeting of Romania is not established.
Poland, Lithuania and Latvia have verified underground crossings. Belarusian knowledge is strongly suspected; Russian construction, military use and troop infiltration are not supported by public evidence.
Leyton and Birmingham are verified Russian/Wagner or GRU-linked operations. Heathrow is a high-impact infrastructure failure and remains visible as a correction control.
Satellite basemaps provide context. Narrow, buried border tunnels beneath forest cannot be verified from free Sentinel imagery; official ground photographs are the primary evidence. Larger surface construction can be tracked over time.
Satellite-confirmed surface change
Chernyakhovsk antenna array
Sentinel time series shows clearance from March 2023 and a roughly 1.6-kilometre circular array. A signals-intelligence role is an assessed function, not an official admission.
Lithuanian guards photographed timber reinforcement, a concealed Belarusian entrance and a passage extending four metres into Lithuania. The physical tunnel is verified; the builder and state direction are not.
Commercial imagery showed new surface buildings and another visible entrance near an established test complex. It does not prove an attack plan, nuclear test preparation or a cross-border tunnel.
The public record supports sustained pressure below the level of conventional attack: recruited proxies, sabotage, reconnaissance, GNSS interference, cyber-physical activity, airspace violations and ambiguous maritime events. It does not establish a selected target or an imminent conventional attack.
Feasible now
Cheap drones, aircraft, missiles, cyber operations, proxies, electronic warfare and maritime reconnaissance remain available despite land-force attrition.
Tests range from ongoing hybrid action to extremely unlikely near-term war
These are qualitative feasibility judgements, not forecasts. Capability does not establish intent; attribution, scale, effects and treaty geography must be assessed separately.
01
Already occurring
Hybrid pressure and sabotage
Now
Cyber activity, recruited proxies, arson and sabotage plots, GNSS interference, reconnaissance and information operations are the central near-term threat.
Potential wedge
Keep each event small and deniable enough that allies argue about attribution and proportionality.
Main blocker
Repeated patterns improve attribution and can produce coordinated law-enforcement, sanctions and counter-intelligence action.
02
Feasible
Deliberate unmanned or missile probe
Now–12 months
Technically easy and less demanding than a ground operation. Russia could exploit the cover of attacks on Ukraine, especially around Poland or Romania.
Potential wedge
Test interception rules and Article 4 consultation while claiming navigation error, electronic warfare or accidental spillover.
Main blocker
Deaths or repeated precision would weaken deniability and could unify the alliance rather than split it.
03
Low
Small deniable Baltic incursion
12–36 months
The Baltic geography and Russian influence narratives make a very small, short-warning move conceivable, but public evidence does not show an operation has been ordered.
Potential wedge
Create a local fact before consensus forms, then threaten escalation if NATO reverses it.
Main blocker
Forward-deployed allied troops, Nordic accession and the difficulty of holding ground make a clean, isolated test improbable.
04
Very low
Temporary Svalbard or Arctic seizure
12–60 months
Remote geography and Russian Arctic forces make it imaginable, but Svalbard is Norwegian territory covered by NATO. Empty land is not a treaty loophole.
Potential wedge
Present the move as treaty enforcement or protection of Russian residents and bet that allies will not reverse it.
Main blocker
Exposed resupply, Nordic and British air-maritime power, and the risk to Russia's Kola nuclear bastion.
05
Extremely low
Large conventional attack on NATO
Near term
Russia remains committed in Ukraine, lacks a free strategic land reserve and is conventionally weaker than NATO in aggregate.
Potential wedge
Would require a belief that US commitment had collapsed and European rearmament had failed.
Main blocker
This would be a regional war, not a limited test; Russian losses and NATO's conventional and nuclear strength make it a poor near-term gamble.
Law and alliance politics
Empty territory is not an Article 5 loophole
An armed attack on one ally is treated as an attack on all. Each ally must assist “forthwith”, but may choose the action it considers necessary, including armed force.[9] Collective defence and Article 5[11] The North Atlantic Treaty Assistance can be military, intelligence, logistical, cyber or another measure.
Clear cases
Romania and Norway are covered
A deliberate strike or seizure can qualify even in an empty field or on an uninhabited island. Population density is not a treaty test.
Threshold cases
A stray drone is normally not an armed attack
Intent, attribution, scale and effects distinguish a violation or spillover event from an attack.
Hard cases
Hybrid and cyber acts are case-specific
NATO says a significant single or cumulative operation may qualify, but publishes no numerical trigger.
Consensus
Different contributions do not void the treaty
A dissenter can complicate NATO action but cannot erase other allies' treaty duties or prevent bilateral assistance.
Svalbard is under Norwegian sovereignty and Norway states that NATO protection applies.[12] Norway's authoritative Svalbard legal position The Svalbard Treaty's restrictions do not create Russian sovereign territory or an exemption for “empty” land.
Capability
Low-cost tools survive high-cost attrition
The UK estimated cumulative Russian casualties at roughly 1.3 million and more than 30,000 a month in early 2026.[8] Evidence shows catastrophic Russian losses for minimal gains That constrains a sustained conventional second front. It does not remove long-range aviation, missiles, electronic warfare, cyber units, proxy recruitment, unmanned systems or Northern Fleet capabilities.
≈1.3mcumulative casualties in the cited UK wartime estimate
16tn ₽estimated 2025 military spending
>5,000attack drones a month assessed available since summer 2025
No free reservefor a second Ukraine-scale land war at current intensity
Norway assesses that Russia seeks to avoid direct NATO war while observing allied responses and using ships, aircraft and civilian platforms for intelligence collection.[5] Focus 2026
Collection requirements
Indicators that would materially change the assessment
01
Ukraine ceasefire or operational freeze
The pivotal condition in several European intelligence assessments: it could release experienced formations and production for regeneration.
02
Real reserves return to NATO-facing districts
Personnel, armour, air defence and ammunition moving to Leningrad, Kaliningrad or Kola matters more than announced paper formations.
03
Sustained enabling logistics
Fuel, bridging equipment, field hospitals, rail movements and dispersal around one border would distinguish preparation from routine signalling.
04
Exercises that do not stand down
No-notice activity becomes more concerning if forces stay forward, live ammunition accumulates and civilian air or sea space remains closed.
05
A concentrated grievance narrative
Claims about persecuted Russian speakers, a Polish or Baltic provocation, or Norway violating the Svalbard Treaty could supply political cover.
06
Multi-domain concentration
GNSS interference, cyber pre-positioning, reconnaissance, drones, border pressure and disinformation focused on one locality would be a campaign signal.
07
Nuclear coercion synchronised with movement
A limited territorial gamble would probably depend on threats intended to deter NATO from reversing it.
Method and safeguards
The model keeps three outputs separate: observed activity, Russian-link assessment and analyst-review priority. Reports describing the same operation are grouped under one operation identifier. Official and forensic findings outrank repetition; article or social-post volume never raises the evidence score. Controls remain visible to prevent disproved claims from returning as facts.
Evidence 5 official or final technical findingEvidence 3 credible but unresolved public recordHotspot activity density or review priority, never probabilityImagery claim limited to resolvable surface evidence
Incident-level evidence is linked in every map inspector and register row. This list contains the strategic assessments, legal texts and research used to interpret them.
This is an open-source evidence-gathering workspace, not an intelligence service or a real-time military feed. Assessments are revision-controlled and should change when official findings change.