Russian hybrid warfare targets the entire Baltic region through border provocations, cyber influence, sabotage, and mass bomb threats on schools during October-November 2023.

Military & Paramilitary OperationsUnconventional / ParamilitaryProxy forces, militias, mercenaries (e.g. Wagner-type groups)

AggressorDefense

Summary

Between early October and late November 2023, multiple hybrid warfare activities attributed to Russia targeted the Baltic region, including Latvia, Lithuania, Estonia, Finland, and Poland. These included extensive bomb threat campaigns against thousands of schools and preschools (e.g., 300 schools in Latvia, over 2000 bomb threat emails in Lithuania spanning multiple days), cyber-influence attempts documented by Microsoft in Latvia, Lithuania, and Poland, and man-made sabotage of critical undersea telecommunications cables connecting Sweden, Estonia, Finland, and Estonia-Finland gas pipeline Balticconnector. Intensifying border tensions featured over 11,000 migrants blocked by Latvia from crossing the Belarus border and increasing migrant flows pushed by Russia into Finland. Latvian authorities suspended operations at Russian border control points. Official investigations confirmed sabotage of undersea cables and pipelines, with some suspicion revolving around implicated vessels. The hybrid campaign aimed at destabilizing the unity of Baltic states and Poland, all strong supporters of Ukraine, using methods like propaganda, border disruptions, and terror through bomb threats. NATO increased maritime surveillance and deployed minesweepers in response to the cable sabotage. This broad campaign is characterized by coordinated proxy terrorism, sabotage, and influence operations targeting Baltic security and cohesion.

Classification

Confidence: High

There is clear, confirmed evidence of hostile Russian hybrid warfare activities including sabotage, border provocations, cyberattacks, and terror bomb threats targeting Baltic region allies (Latvia, Lithuania, Estonia, Finland, Poland). Concurrently, NATO and allied states are actively responding via maritime security deployments, government emergency meetings, border control adjustments, and public warnings, indicating defense preparation. The dual nature of attack and response is explicitly...

Source URL

https://x.com/amaragraps/status/1728472212976631971

Open source

Provenance

Publisher: csv-import
Submitted: Feb 1, 2026, 00:14 UTC
Last updated: Nov 4, 2026, 08:36 UTC
Event time: Nov 25, 2023, 12:00 UTC

Published as a Defense Preparations signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "2fcff5d4-c36b-473d-845c-2e365f813615",
  "url": "https://x.com/amaragraps/status/1728472212976631971",
  "source": "csv-import",
  "status": "approved",
  "category": "Military & Paramilitary Operations",
  "subcategory": "Unconventional / Paramilitary",
  "incident_type": "Proxy forces, militias, mercenaries (e.g. Wagner-type groups)",
  "country": "Latvia",
  "source_reliability": "C",
  "info_credibility": "3",
  "tags": [
    "Russia",
    "Hybrid Warfare",
    "baltic sea region",
    "Border Security",
    "offensive cyber operations",
    "Bomb Threats",
    "School Threats",
    "Sabotage",
    "Undersea Cable",
    "Balticconnector",
    "Migrants",
    "nato responses",
    "Poland",
    "Finland",
    "Estonia",
    "Lithuania",
    "Latvia"
  ],
  "nodes": [],
  "countries": [
    "Latvia",
    "Lithuania",
    "Estonia",
    "Finland",
    "Poland"
  ],
  "where_text": "Land",
  "headline": null,
  "description": "A coordinated Russian hybrid warfare campaign throughout the Baltic region has employed a multi-pronged approach during October-November 2023. Border provocations include migrant pressure on Latvia-Belarus and Finland-Russian borders; cyber-influence attempts in Latvia, Lithuania, and Poland were documented by Microsoft. Man-made sabotage of undersea telecom cables between Sweden-Estonia and the Estonia-Finland Balticconnector gas pipeline has been confirmed, with NATO augmenting maritime presence. Bomb threats targeted around 300 schools in Latvia and up to 2000 educational institutions in Lithuania over consecutive days, accompanied by similar threats in Poland and Estonia. Latvian government suspended operations at Russian border control points in response to threats. Russian proxy tactics include terror through bomb threats, disinformation, and border destabilization aiming to fracture Baltic-Polish unity in support of Ukraine.",
  "summary_short": "Russian hybrid warfare targets the entire Baltic region through border provocations, cyber influence, sabotage, and mass bomb threats on schools during October-November 2023.",
  "summary_extended": "Between early October and late November 2023, multiple hybrid warfare activities attributed to Russia targeted the Baltic region, including Latvia, Lithuania, Estonia, Finland, and Poland. These included extensive bomb threat campaigns against thousands of schools and preschools (e.g., 300 schools in Latvia, over 2000 bomb threat emails in Lithuania spanning multiple days), cyber-influence attempts documented by Microsoft in Latvia, Lithuania, and Poland, and man-made sabotage of critical undersea telecommunications cables connecting Sweden, Estonia, Finland, and Estonia-Finland gas pipeline Balticconnector. Intensifying border tensions featured over 11,000 migrants blocked by Latvia from crossing the Belarus border and increasing migrant flows pushed by Russia into Finland. Latvian authorities suspended operations at Russian border control points. Official investigations confirmed sabotage of undersea cables and pipelines, with some suspicion revolving around implicated vessels. The hybrid campaign aimed at destabilizing the unity of Baltic states and Poland, all strong supporters of Ukraine, using methods like propaganda, border disruptions, and terror through bomb threats. NATO increased maritime surveillance and deployed minesweepers in response to the cable sabotage. This broad campaign is characterized by coordinated proxy terrorism, sabotage, and influence operations targeting Baltic security and cohesion.",
  "actor_primary": null,
  "target_primary": null,
  "location_text": "Baltic region",
  "location_region": null,
  "location_coordinates_lat": null,
  "location_coordinates_lon": null,
  "location_precision": "Regional",
  "is_aggressor_signal": true,
  "signal_type": "DEFENSE_PREP_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "There is clear, confirmed evidence of hostile Russian hybrid warfare activities including sabotage, border provocations, cyberattacks, and terror bomb threats targeting Baltic region allies (Latvia, Lithuania, Estonia, Finland, Poland). Concurrently, NATO and allied states are actively responding via maritime security deployments, government emergency meetings, border control adjustments, and public warnings, indicating defense preparation. The dual nature of attack and response is explicitly...",
  "event_time_utc": "2023-11-25T12:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "unknown",
  "created_at": "2026-02-01T00:14:28.540Z",
  "updated_at": "2026-11-04T08:36:03.522Z",
  "reliability_band": "strong",
  "location_precision_band": "regional",
  "time_precision_band": "unknown",
  "severity_band": "significant",
  "attribution_confidence_band": "high",
  "attribution_basis": "single_source"
}

Public assessmentReliability: StrongSeverity: SignificantAttribution: HighSingle sourceTime: UnknownLocation: Regional

Source reliability

Info credibility

Event time

Nov 25, 2023, 12:00 UTC

Event time confidence

unknown

Location

Baltic region

Country

Latvia

Countries

Latvia, Lithuania, Estonia, Finland, Poland

Tags

Russia, Hybrid Warfare, baltic sea region, Border Security, offensive cyber operations, Bomb Threats, School Threats, Sabotage, Undersea Cable, Balticconnector, Migrants, nato responses, Poland, Finland, Estonia, Lithuania, Latvia

Loading signal...

{ "id": "2fcff5d4-c36b-473d-845c-2e365f813615", "url": "https://x.com/amaragraps/status/1728472212976631971", "source": "csv-import", "status": "approved", "category": "Military & Paramilitary Operations", "subcategory": "Unconventional / Paramilitary", "incident_type": "Proxy forces, militias, mercenaries (e.g. Wagner-type groups)", "country": "Latvia", "source_reliability": "C", "info_credibility": "3", "tags": [ "Russia", "Hybrid Warfare", "baltic sea region", "Border Security", "offensive cyber operations", "Bomb Threats", "School Threats", "Sabotage", "Undersea Cable", "Balticconnector", "Migrants", "nato responses", "Poland", "Finland", "Estonia", "Lithuania", "Latvia" ], "nodes": [], "countries": [ "Latvia", "Lithuania", "Estonia", "Finland", "Poland" ], "where_text": "Land", "headline": null, "description": "A coordinated Russian hybrid warfare campaign throughout the Baltic region has employed a multi-pronged approach during October-November 2023. Border provocations include migrant pressure on Latvia-Belarus and Finland-Russian borders; cyber-influence attempts in Latvia, Lithuania, and Poland were documented by Microsoft. Man-made sabotage of undersea telecom cables between Sweden-Estonia and the Estonia-Finland Balticconnector gas pipeline has been confirmed, with NATO augmenting maritime presence. Bomb threats targeted around 300 schools in Latvia and up to 2000 educational institutions in Lithuania over consecutive days, accompanied by similar threats in Poland and Estonia. Latvian government suspended operations at Russian border control points in response to threats. Russian proxy tactics include terror through bomb threats, disinformation, and border destabilization aiming to fracture Baltic-Polish unity in support of Ukraine.", "summary_short": "Russian hybrid warfare targets the entire Baltic region through border provocations, cyber influence, sabotage, and mass bomb threats on schools during October-November 2023.", "summary_extended": "Between early October and late November 2023, multiple hybrid warfare activities attributed to Russia targeted the Baltic region, including Latvia, Lithuania, Estonia, Finland, and Poland. These included extensive bomb threat campaigns against thousands of schools and preschools (e.g., 300 schools in Latvia, over 2000 bomb threat emails in Lithuania spanning multiple days), cyber-influence attempts documented by Microsoft in Latvia, Lithuania, and Poland, and man-made sabotage of critical undersea telecommunications cables connecting Sweden, Estonia, Finland, and Estonia-Finland gas pipeline Balticconnector. Intensifying border tensions featured over 11,000 migrants blocked by Latvia from crossing the Belarus border and increasing migrant flows pushed by Russia into Finland. Latvian authorities suspended operations at Russian border control points. Official investigations confirmed sabotage of undersea cables and pipelines, with some suspicion revolving around implicated vessels. The hybrid campaign aimed at destabilizing the unity of Baltic states and Poland, all strong supporters of Ukraine, using methods like propaganda, border disruptions, and terror through bomb threats. NATO increased maritime surveillance and deployed minesweepers in response to the cable sabotage. This broad campaign is characterized by coordinated proxy terrorism, sabotage, and influence operations targeting Baltic security and cohesion.", "actor_primary": null, "target_primary": null, "location_text": "Baltic region", "location_region": null, "location_coordinates_lat": null, "location_coordinates_lon": null, "location_precision": "Regional", "is_aggressor_signal": true, "signal_type": "DEFENSE_PREP_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "There is clear, confirmed evidence of hostile Russian hybrid warfare activities including sabotage, border provocations, cyberattacks, and terror bomb threats targeting Baltic region allies (Latvia, Lithuania, Estonia, Finland, Poland). Concurrently, NATO and allied states are actively responding via maritime security deployments, government emergency meetings, border control adjustments, and public warnings, indicating defense preparation. The dual nature of attack and response is explicitly...", "event_time_utc": "2023-11-25T12:00:00.000Z", "end_time_utc": null, "event_time_confidence": "unknown", "created_at": "2026-02-01T00:14:28.540Z", "updated_at": "2026-11-04T08:36:03.522Z", "reliability_band": "strong", "location_precision_band": "regional", "time_precision_band": "unknown", "severity_band": "significant", "attribution_confidence_band": "high", "attribution_basis": "single_source" }