The NATO Russia threat picture has shifted, according to new US intelligence assessments reported by the Wall Street Journal, which warn that Vladimir Putin could test the alliance’s cohesion with a limited attack on a member state within the next few years.

The scenarios described are notable for what they exclude. Officials cited in the report point to cyberattacks, sabotage or a small-scale ground incursion rather than full-scale invasion.

Why the Scale Matters

The distinction between a limited probe and an invasion is the entire point of the assessment.

NATO’s collective defense commitment under Article 5 is unambiguous in principle but untested at the margins. A large conventional assault on a member state would trigger a clear response. A cyberattack on infrastructure, an act of sabotage attributed to no one, or a brief incursion by unmarked forces creates genuine ambiguity.

That ambiguity is the target. The value of such an operation would not be territorial. It would be diagnostic, revealing whether allies respond as one or spend weeks arguing about attribution and thresholds while the moment passes.

An alliance that hesitates once establishes something about how it will behave the next time.

The Timing Problem

The assessment arrives alongside an inconvenient reality about American inventories.

The US faces shortages of key munitions, including long-range missiles and Stinger air-defense systems, following supply to Ukraine and military operations against Iran.

President Trump has denied shortages exist, saying Biden gave a tremendous amount of munitions to Ukraine.

Whatever the accurate figure, the perception itself carries strategic weight. Deterrence functions on what an adversary believes about capability and willingness. Public discussion of depleted stockpiles feeds directly into that calculation, regardless of the underlying numbers.

Lithuania’s Specific Fear

Lithuania has raised a more concrete concern.

Defence Minister Robertas Kaunas said his country believes Russia may be considering the use of Ukrainian-made drones to stage provocations in the Baltic region.

The logic behind a false flag operation of that kind is straightforward. Drones of Ukrainian origin striking Baltic targets would muddy attribution, potentially strain relationships between NATO members and Kyiv, and create exactly the kind of confusion that delays collective response.

Kaunas said Lithuanian intelligence is actively collecting information on the matter, and that critical infrastructure has been reinforced against potential attack.

He also offered a measure of reassurance, noting that the military and security institutions are monitoring the situation and that no singular direct threat currently exists.

The concern follows a series of drone incursions along Europe’s eastern frontier in recent months.

The War Itself Continues

The intelligence warnings sit against ongoing fighting that has intensified in both directions.

Ukraine reported striking Russian oil refineries and vessels in the Black Sea through long-range attacks. Those strikes target the revenue infrastructure funding the war rather than front-line forces.

A Wildberries logistics hub in Russia’s Sverdlovsk region caught fire, according to the company.

On the Ukrainian side, the Kyiv region marked an official day of mourning after a Russian missile and drone barrage killed 17 people.

That casualty figure is the reminder underneath all the strategic analysis. Whatever assessments say about future scenarios, the current war continues to kill civilians.

How the Pieces Connect

Three developments here reinforce one another.

Ukraine is striking deeper into Russian territory, which increases pressure on Moscow. Russia is escalating strikes on Ukrainian cities. And Western intelligence is warning that Russian planning may extend beyond Ukraine to probing NATO itself.

The munitions question links them. A West with constrained inventories has less capacity to sustain support for Ukraine while simultaneously maintaining credible deterrence elsewhere. Any adversary evaluating opportunity would factor that in.

What to Watch

Several indicators would clarify how seriously the assessment is being treated.

Whether NATO members increase force posture or air defense deployments in the Baltics. Whether allied governments publicly echo the intelligence findings or distance themselves from them. Whether drone incursions along the eastern frontier continue or escalate.

And whether Western defense budgets show accelerated munitions procurement in the coming months. That would answer the capability question more definitively than any statement.