Central Intelligence Agency (CIA) director John Ratcliffe’s surprise visit to Moscow this week quickly prompted speculation over why the spy chief would make the long, but brief, journey to the Russian capital—including whether he hoped to head off a possible Russian attack on NATO.
President Donald Trump, while not detailing the agenda nor who was present from the Russian side, described the meeting as “semi-routine.”
The Kremlin said Ratcliffe hadn’t met with Russian President Vladimir Putin but had made the unannounced trip to keep up “contacts between security services.”
Read More on World
Ratcliffe warned top Russian officials not to up the long-running hybrid warfare campaign against NATO allies, particularly against the three Baltic states deeply worried about how Moscow may respond to the standstill in the war against Ukraine, Politico reported, citing two anonymous people familiar with the matter.
For many, Ratcliffe’s trip revived memories of former CIA head William Burns’ rare personal visit to Moscow in November 2021, when Burns sat down with senior Kremlin names and the head of Russia’s SVR foreign intelligence service, Sergei Naryshki.
Burns, a former U.S. envoy to Moscow, later said he had made the journey to warn the Kremlin against launching a full-scale invasion of Ukraine as its troops amassed on the border with its neighbor. Russia invaded little over three months later.
“I came away from those conversations even more troubled than when I arrived,” Burns said in July 2022.
Ratcliffe’s visit comes just weeks after U.S. officials said Washington now assesses Russia could launch a “limited” attack on NATO’s eastern European edge as soon as this fall.
This could involve sending a small number of Russian troops over into the Baltic states or Poland or the upping of Moscow’s hybrid warfare operations, U.S. officials told The Wall Street Journal earlier this month.
“Hybrid attacks” is a catch-all term for operations that stop short of open fighting, like cyberattacks, information campaigns, arson incidents or the targeting of vulnerable infrastructure, such as undersea cables.
NATO says Russia has been waging a hybrid war with the alliance for years.
Russia has repeatedly denied planning to attack NATO territory, and dismissed the claims as “nonsense.” Moscow also denied planning to invade Ukraine in the months leading up to the start of the war in February 2022.
So, what could a Russian assault on NATO look like, if Russia did greenlight some form of attack?
Limited Incursion
A large-scale military attack on NATO is extremely unlikely. But a small, probing land grab against one of the Baltic states or Poland is generally seen as the realistic worst-case scenario. However, it becomes increasingly likely the more time passes, the U.S. officials told the Journal.
For this type of incursion, Russia wouldn’t need a high number of troops, analysts say; Moscow would just require a small force that takes a sliver of land, but ultimately doesn’t inspire all of NATO—including the U.S. and the western European nations—to strike back overwhelmingly.
Their failure to do so, they say, would spell the end of NATO’s credibility because NATO states are bound by Article 5 of the alliance’s founding treaty, which commits all members to the defense of another NATO country if they’re attacked.
Some experts say that if Russia did move to take part of NATO territory, it would probably amass soldiers close to Estonia, Latvia or Lithuania’s eastern borders. Some would likely be deployed to confuse NATO forces monitoring where Russia may try to push through, disguising the true targets and forcing NATO to spread its defenses.
When Russian soldiers cross the border, they’d be accompanied by electronic warfare systems to confuse NATO communications and navigation, and cyber onslaughts.
Once they hold a piece of land, Moscow would quickly populate the area with air defenses that could shoot down NATO aircraft that skirted within range to strike Russian forces, some experts predict.
NATO is actively rehearsing for this scenario to happen in the next four years. The Allied Rapid Reaction Corps (ARRC), which would be some of the very first NATO troops deployed if Russian tanks were poised to enter the Baltic states, war-gamed a Russian invasion of these three countries in 2030 in May this year.
NATO says it picked 2030 because that’s when the threat from Russia will be “most acute.”
Another scenario could be operations around the Suwałki Gap, Ed Arnold, a senior adviser for defense with The D Group organization of business leaders and experts, previously told Newsweek.
A small strip of land close to the Polish-Lithuanian border that links Belarus to the Russian exclave of Kaliningrad, the Suwałki Gap is a constant, rumbling concern in Eastern Europe. The 40-mile Suwałki Gap has been intermittently described as NATO’s weak point and the alliance’s most fortified boundary.
Russian soldiers could push into the gap from Kaliningrad or from Belarus, sweeping outward and broadening up the corridor by eating into Polish and Lithuanian territory, Arnold said.
But it wouldn’t need to be an attack made up of bloated numbers of Russian soldiers. A war-game run by German newspaper Die Welt in December, simulating a Russian incursion into Lithuania in October 2026, found that with just 15,000 troops, Russia was able to seize the Lithuanian city of Marijampole from the Suwałki Gap.
In the war-game, the U.S. didn’t invoke Article 5, and Germany dithered, ultimately leaving Russia victorious in its territorial snatch and in its goal of undermining NATO.
Russia has built at least 10 secret sites capable of firing long-range drones into NATO territory, British newspaper The Telegraph reported earlier this month.
Russia has installed dozens of new “launch rails,” which troops can use to get fixed-wing drones airborne for missions or attacks, at bases along the Russian border with Belarus and Ukraine, according to the report.
Bombing Campaigns
On August 4, a drone laden with explosives was found at the eastern German airport of Leipzig, near to planes operated by Ukraine’s Antonov Airlines. The airport is a major military aid hub and often used by NATO forces.
The drone didn’t detonate and German authorities defused the device. Investigators said a second drone may have crashed into another nearby cargo aircraft.
Observers have suggested Russia may be responsible, but German officials haven’t leveled any official accusations at Moscow beyond questioning whether a foreign power was at work. Russia has denied involvement.
German media then reported on Tuesday a third drone carrying undetonated explosives was found on August 14, in a field directly looking out onto Leipzig Airport.
German investigators discovered a device that may have been used to control the drones just north of Leipzig airport, according to Germany’s Süddeutsche Zeitung newspaper.
Chancellor Friedrich Merz said on Tuesday that Germany was staring down a “very real threat” and those behind actions against the country would “pay a price.”
In late 2024, it emerged that Western intelligence officials suspected Russia of plotting to put incendiary devices aboard cargo planes, including aircraft bound for the U.S.
Four packages were sent from Lithuania to the United Kingdom and Poland in July 2024, one of which caught fire just before it was loaded onto an aircraft in Leipzig. Another caught fire in a warehouse in the U.K., and a third was set ablaze on a truck in Poland.
Cyber Attacks
NATO has said Russia subjects its members to “persistent malicious cyber activities” and has warned Moscow to reel back its cyber attacks.
In 2024, NATO said a Russian group backed by the GRU foreign military intelligence agency was responsible for cyber campaigns in Germany and the Czech Republic. The following year, Estonia, France, the U.K. and the U.S. said the same spy agency had targeted the alliance with cyber assaults.
NATO has previously said the alliance can decide that cyber attacks could trigger Article 5, but has been ambiguous about what this threshold would actually be. Daily cyber attacks on NATO members are now the norm, officials say.
Targeting of Undersea Infrastructure
The overwhelming majority of the world’s data travels via undersea cables, effectively underpinning much of normal daily life. Targeting these cables can have huge military and civilian implications and give an adversary a major advantage for carrying out other operations.
But the vast stretches of cables—as well as pipelines carrying oil and gas—are incredibly difficult to protect, and NATO isn’t entirely clear on whether it’s a military responsibility to look after them, or whether this job falls to private companies.
And at least 13 cables under the Baltic Sea were damaged between fall 2023 and the start of 2025. The Baltic Sea is sometimes referred to as a “NATO lake,” as it is bracketed almost entirely by alliance members, minus Kaliningrad.
Assassinations
In an unusual public statement, a senior NATO official confirmed in January 2025 the alliance was aware of multiple assassination plots against defense industry leaders, including Armin Papperger, the chief executive of German defense giant Rheinmetall.
Several months earlier, CNN had reported Russia had hatched a plan to kill Papperger and other defense executives in Europe. The Kremlin rejected the allegation at the time.
Contact Newsweek editors on this story: John Fitzpatrick and Cristina Diciu.