Escalation watch › Hybrid & sabotage › H03

Baltic coast (NATO countries): sabotage of undersea and coastal infrastructure

H03 · Both · checked 2026-11-09 · reviewed Every run · priority

Serhii Kuznietsov, a former Ukrainian special forces officer, became the first person ever tried over the September 2022 explosions - Europe's largest act of infrastructure sabotage since 1945. German prosecutors allege he led a team of Ukrainian military…

Escalation signal

Cable, pipeline or power-link damage; drones over bases, ports or terminals; sabotage at coastal sites in Finland, Estonia, Latvia, Lithuania, Poland, Germany, Denmark and Sweden. Key sites: Estlink, Balticconnector, NordBalt, Baltic Pipe, C-Lion1; LNG terminals at Klaipėda, Świnoujście, Inkoo; naval bases Gdynia, Kiel, Karlskrona; Gotland; Bornholm and the Danish straits. Escalation = confirmed state attribution, simultaneous multi-site incidents, or physical attacks rather than anchor-dragging. Shadow-fleet boardings and rules of engagement stay in E13/E14.

Baseline (21 Sep 2026)

Recurring undersea and coastal incidents: at least 11 cables damaged since Oct 2023 by anchor-dragging ships; latest wave Dec 2025–Jan 2026 (Fitburg seized by Finland 31 Dec; Lithuania–Latvia cable 2 Jan). Russian ELINT ship launched a drone in the Öresund (26 Feb 2026). Stray Ukrainian drones crashed in Lithuania, Latvia and Estonia (Mar–May 2026, one exploding at a Rēzekne oil depot). Attribution contested: some officials concluded several cable breaks were accidents.

Where to check

gCaptainOSW Centre for Eastern StudiesERR / LSM / LRTYleDefence24Augen geradeaus!MarineTrafficLloyd's Market Assoc. – Joint War CommitteeGrosswald Baltic Security TrackerRybar (Telegram)

Check log

• 2026-10-142THE NORD STREAM TRIAL OPENS IN HAMBURG, AND THE DEFENDANT IS UKRAINIAN. Serhii Kuznietsov, a former Ukrainian special forces officer, became the first person ever tried over the September 2022 explosions - Europe's largest act of infrastructure sabotage since 1945. German prosecutors allege he led a team of Ukrainian military officers and veteran divers who entered Germany on a forged passport, boarded a rented yacht at Rostock and planted the charges; the charges include a war crime, attacking civilian infrastructure and causing an explosion. Evidence cited in reporting: explosive traces aboard the yacht, telephone numbers, traffic and surveillance cameras, vehicle plates and witnesses. German authorities have alleged a possible Ukrainian STATE CONNECTION; Ukraine's Prosecutor General's Office said on 9 July 2026 that its investigators found no evidence implicating the Ukrainian state, its authorities or officials, and Zelensky has said Ukraine was not responsible. Kuznietsov denies wrongdoing and will not testify, citing rules barring former special forces personnel from discussing their service; his lawyers argue the pipelines were a legitimate military target and that Russia used them as a political and economic weapon. Arrest warrants exist for six Ukrainian citizens in total - three soldiers and four veteran divers; a second suspect faces extradition from Croatia after a Polish court refused one. WHY THIS BELONGS IN AN INDICATOR ABOUT BALTIC UNDERSEA SABOTAGE: the single largest incident in this domain was attributed in its first years overwhelmingly to Russia, and the evidence that has survived legal scrutiny points elsewhere. Sources: Courthouse News, Euronews, France 24, New Voice of Ukraine, Al Jazeera on the extradition chain.
• 2026-09-212Baseline 2: cable damage pattern since Oct 2023 (gCaptain timeline; Atlas Institute counts 11+ cables); Fitburg case 31 Dec 2025; Lithuania–Latvia cable 2 Jan 2026; Öresund Russian drone 26 Feb 2026; Ukrainian stray drones in the Baltics Mar–May 2026. Counter-evidence: Washington Post-reported official assessment that several breaks were accidental (DCD, July 2026).
• 2026-09-102QUIET-PERIOD TEST APPLIED - NOT LOWERED, and the reason matters. No new cable-cutting incident since 2 Jan 2026, which on the seabed alone would have argued for lowering to 1. But Western officials disclosed on 10 Sep that a joint British-Norwegian-US operation intercepted Russian GUGI deep-sea submarines near Svalbard in spring 2026 while they rehearsed deploying a cable-disabling device; the vessels left without damaging anything. Britain and Norway sanctioned GUGI in April 2026. Capability development and rehearsal continued through the quiet period, so the pause in incidents reflects deterrence and prosecution risk rather than abandonment. Score holds at 2. Sources: Reuters via Karmactive summaries (treat aggregator framing with caution; the underlying Reuters reporting is the source).
• 2026-08-272The cases move to court rather than the seabed: the Helsinki Court of Appeal revives the Eagle S prosecution (Estlink 2), and the Fitburg trial opens at Helsinki District Court on 8 Sep with the court asserting jurisdiction - the question the Eagle S case had left open. Whether Finnish courts can convict is now the live issue. Source: Grosswald Baltic tracker (23 Sep 2026).
• 2026-02-262A Russian ELINT vessel launches a drone in the Oresund. Stray Ukrainian drones subsequently crash in Lithuania, Latvia and Estonia (Mar-May), one exploding at a Rezekne oil depot.
• 2026-01-022A Lithuania-Latvia cable is damaged; a vessel is boarded. This is the LAST confirmed cable-cutting incident in the Baltic to date.
• 2025-12-312BASELINE RE-DATED TO EVENTS (the original entry was dated to the day the tracker was created, which hid how old the last incident was). The Fitburg cut two cables in the Gulf of Finland and was boarded by Finnish special forces.