“If I had a nickel for every time a Chinese ship was dragging its anchor on the bottom of the Baltic Sea in the vicinity of important cables,” Lithuanian Foreign Minister Gabrielius Landsbergis posted on X (formerly Twitter) in November, “I would have two nickels, which isn’t much, but it’s weird that it happened twice.”
Landsbergis is right. It is weird that twice now, a Chinese ship has damaged a vital undersea internet and communications cable in the Baltic Sea. But what is weirder is the fact that not just two, but eleven important undersea cables have been damaged by ships in professed accidents in the Baltic region – all in only the past fourteen months.
Beijing has denied any involvement in the two instances of dragging anchor, but in many ways, this concern is overshadowed by what many NATO countries consider to be the bigger issue at play: Russia. It is Russia, not China, that has most countries worried, as it is the presumed suspect in the other nine instances of cable damage.
Most countries suspect Russia for one main reason: since 2022, Russia has been waging a hybrid war against the US and NATO more broadly – a covert campaign of sabotage against supporters of Ukraine that is now escalating in both scope and intensity.
Sometimes referred to as “shadow” or “grey-zone” warfare, hybrid warfare is a military strategy in which a country uses both military and non-military strategies and instruments to cause instability without declaring an all-out war. Russia has long preferred “punching back at NATO in the shadows,” as journalist and Washington Post columnist David Ignatius describes. But in the past few years, these covert attacks have become far more serious. Using strategies such as cyberattacks, political manipulation, and the spread of disinformation, Russia has caused disruption and created chaos in ways that might look minor in isolation, but taken together indicate a new phase in Russia’s war against the West.
Now, as NATO Secretary General Jens Stoltenberg explains, it seems that “sabotage actions against critical infrastructure” – specifically undersea cables – amount to Russia’s next stage in its hybrid war.
These claims of sabotage are further bolstered by the fact that Russia’s “shadow fleet” has become more and more active in the Baltic region over the past year. Since the start of the Ukraine war, Russia has been building up a fleet of mostly aging and repurposed ships – “shadow vessels” – which it has used to circumvent the G7 price cap on Russian oil exports. These vessels have obscure ownership, are poorly maintained, and often obfuscate their movements by manipulating or disabling their AIS, the tracking system required on all commercial vessels for the safety of maritime traffic. They also frequently change their flag registration, flying under so-called “flags of convenience” to enjoy more permissive regulations, evade sanctions, and distance themselves from Russia.
Growing steadily in number since 2022, around 17 percent of all oil tankers on the oceans today are estimated to belong to the shadow fleet. Used primarily in the past to transport Russian crude oil, it appears that these ships are now being used to conduct espionage activities for Moscow, including charting – and sometimes destroying – vital undersea cables.
In January 2025 alone, two undersea cables were destroyed by vessels suspected of being part of Russia’s shadow fleet: the Cook Island-registered shadow tanker Eagle S and the Maltese-flagged Vezhen. So at this point, “no one believes that [the] cables were cut accidentally,” as German Defense Minister Boris Pistorius said. As Landsbergis makes clear in his quip regarding China, the idea that so many cables have been damaged in the same region accidentally is hard to believe. NATO is convinced, but this has led to speculation as to what Russia’s end goal might be.
These cables are what German Foreign Minister Annalena Baerbock calls the “communication arteries that hold our world together.” There are hundreds running across the seabed of the world’s oceans, forming a network through which most communications and internet traffic travels, as well as accounting for more than $10 trillion in daily worldwide financial transactions. A coordinated attack could therefore disable a critical piece of the world’s communications infrastructure, significantly disrupting private, government, and military communications, as well as industries that rely on such information, including financial markets and energy suppliers.
Since these cables also play a role in energy supply and production, Russia’s ability to monitor and supposedly damage these cables is “the equivalent of Russia having an off switch for a big part of Europe’s energy production,” as Foreign Policy columnist and Atlantic Council senior fellow Elisabeth Braw explains. By sabotaging these cables, Russia could have the ability to disrupt the whole of Europe.
Moscow has not claimed responsibility, but it is not going to. It is clear that Russia’s efforts to monitor and access undersea infrastructure are expanding, becoming formal, systematic, and far-reaching. As former Russian president and close Putin ally Dmitry Medvedev stated in 2023, there are no longer any constraints left “to prevent us from destroying the ocean floor cable communications of our enemies.” It is clear that Putin holds a similar view, spreading the task of maritime special operations across multiple organizations within the government, including a dedicated military unit called GUGI, or the “General Staff Main Directorate for Deep Sea Research.”
Knowing the stakes, governments are working quickly. NATO has started increasing patrols of the Baltic Sea by way of a new operation, the “Baltic Sentry,” the US and UK have instituted new sanctions on Russia’s oil sector to target the shadow fleet, and many countries have prioritized introducing and strengthening insurance requirements, port restrictions, and collective monitoring of suspected shadow vessels.
Any remaining doubts as to Russia’s culpability have practically disappeared, and NATO countries are responding accordingly. But this leaves them in a difficult situation. If the US and countries surrounding the Baltic are correct in their accusations of Russian sabotage, it amounts to a major escalation of conflict on the world stage. Even as they institute these defensive measures, many countries are questioning what such an escalation might mean, as well as what will happen next.
The fact that Russia is now likely targeting such important infrastructure in ways that have had, and will have, such enormous consequences for a large portion of the world, suggests that Moscow is becoming far more brazen in taking its war west. By targeting undersea cables, Russia aims to sow discord and uncertainty, with the likely goal of undermining Western unity in opposing Russian aggression and switching the focus from Ukraine.
The German Foreign Minister calls these cable cuttings an “urgent wake-up call,” and she’s right – it’s one we need to listen to. Living in a digitalized world, an attack on undersea cables is an attack on our communication life force. Therefore at the same time that NATO continues the fight against Russian aggression in Ukraine, it also needs to correct the vulnerable nature of undersea digital and energy infrastructure – one cannot distract from the other. In order to fully close enforcement gaps, and to avoid any sabotage operations that could plunge data and energy systems into crisis, NATO-allied countries can work to enhance intelligence sharing and monitoring, address and target flag of convenience states, and establish collective cable security standards and regulations across both the physical and digital domains.
Neither Russia nor NATO would benefit from all-out and head-on conflict, but every time one attacks and the other responds, the danger of a misstep gets worse. In every tit-for-tat action, one truth becomes more and more evident: Russia’s hybrid war is escalating, and soon it will reach a tipping point.