Lithuania’s warning about possible Russian attacks on critical infrastructure moves Europe’s hybrid-threat debate from cyber disruption towards physical sabotage against energy and transport systems.

Lithuania is increasing protection around critical infrastructure after President Gitanas Nauseda said intelligence indicated Russia could be preparing targeted physical attacks intended to damage or disrupt energy and transport assets in the Baltic region or Poland.

The warning, reported on 15 July, did not identify a specific target. That absence is important. It suggests a security posture shaped by intelligence indicators rather than by an imminent publicly known threat. For Lithuania, the practical response is therefore to harden likely targets, raise vigilance and coordinate with allies without disclosing operational detail that could help an adversary.

The development matters because it shifts the hybrid-threat discussion from familiar cyber and information operations towards the possibility of small-scale kinetic attacks. Sabotage against a substation, railway link, fuel terminal, communications node or border logistics facility would fall below the threshold of conventional invasion, but could still create political pressure, economic disruption and uncertainty about attribution.

That is why the wording from Vilnius is careful. A government that says a threat exists without naming a target is trying to deter, prepare and signal to allies at the same time. It must give operators enough warning to raise protection while avoiding claims that cannot yet be disclosed or proved publicly.

Lithuania is especially exposed because geography turns infrastructure into strategy. The country sits on NATO’s north-eastern flank, borders Belarus and the Russian exclave of Kaliningrad, and forms part of the Baltic region’s energy and transport connection to the rest of Europe. A disruption in Lithuania could affect allied movement, civilian confidence and the wider resilience of Poland and the Baltic states.

European governments have already been tightening their view of Russian hybrid activity. In recent months, concern has focused on cyber intrusion, suspected proxy networks, drone incidents, logistics disruption and attempts to test civil infrastructure. Defence Matters has examined how Europe’s air-defence debate has widened from Baltic Air Policing to broader protection against drones and missiles. Lithuania’s latest warning adds the ground infrastructure layer to the same security problem.

The hardest issue is attribution. A physical attack against infrastructure may look like an accident, criminal damage, technical failure or local sabotage before intelligence agencies can identify a state link. Russia would not need to claim responsibility to create strategic effect. Ambiguity is useful if the goal is to test NATO cohesion, force governments to divert resources or make the public feel that critical services are vulnerable.

That creates a deterrence problem. NATO’s Article 5 is designed for armed attack, but many hostile acts are calibrated to remain below that threshold. A cut cable, damaged transformer or disrupted rail line could be serious without giving allies a clean legal or political trigger. Governments may agree privately that Russia is responsible while disagreeing publicly over how much evidence can be released and what response is proportionate.

For Lithuania, the immediate answer is resilience rather than retaliation. That means more guards, surveillance, access control, backup systems, cyber-physical monitoring and coordination between intelligence services, police, infrastructure operators and NATO partners. It also means rehearsing how to keep services running if an attack succeeds.

The warning also has a civilian dimension. Energy, transport and communications networks are operated through a mixture of public agencies and private companies. They support everyday life as well as military mobility. A sabotage threat therefore cannot be handled only by the armed forces. It requires operators to share information quickly and governments to give clear instructions without creating panic.

The Baltic states have also invested heavily in reducing dependence on Russian-linked systems, especially in energy. That makes infrastructure both more resilient and more politically significant. A hostile operation against power, rail or port assets would not only cause disruption; it would also test the credibility of Europe’s effort to separate critical systems from Russian leverage.

The Baltic region has long warned that Russia uses pressure in ways designed to avoid direct confrontation. Lithuania’s latest measures show that those warnings are now being translated into practical protection of physical assets. The unanswered question is whether European institutions and NATO can respond just as quickly if an attack moves from warning to event.