Brief: Increasing Violations of NATO Airspace Threaten Wider War

Key Findings

• Over the past several weeks, NATO allies have reported an increase in Russian violations of their airspace, as well as suspicious Russian flight patterns in international territory close to Allied states. The majority of these incidents took place in the Baltic region.
• The airspace violations likely serve mutually beneficial goals under the umbrellas of reconnaissance (probing NATO defenses) and signaling the possibility of direct conflict with Russia.
• NATO held emergency consultations under Article 4 twice and began work to integrate NATO air and ground defenses on its eastern flank. European leaders have also increasingly discussed seizing Russian assets and possibly directing military support to Ukraine.
• Russian leaders have denied responsibility for any airspace violations and have warned NATO that asset seizures or direct military aid to Ukraine would constitute an act of war.

Details

Over the past two weeks, Russia has escalated the frequency and scope of incursions into NATO airspace, as well as suspicious flight patterns in international territory. Since Russia’s full-scale invasion of Ukraine began in 2022, a small number of drones have strayed into Poland and Romania and have been largely dismissed as accidental intrusions. However, the pace and breadth of recent incidents suggest Russia is now likely conducting a campaign of purposeful incursions into NATO territory and concerning activity in international airspace near NATO states. A timeline of recent incidents is below:

• September 10: About 19 Russian Gerbera drones entered Polish airspace during an attack on Ukraine, some traveling up to 300 kilometers deep into Polish territory.¹ NATO aircraft shot down three or four of the drones, marking the first time a NATO member has fired shots during Russia's war in Ukraine.
• September 13: Romania’s Defense Ministry reported a Russian drone entered Romanian airspace for about 50 minutes during an attack on Ukraine. Romanian F-16 jets intercepted the drone but chose not to open fire due to risk of collateral damage. Following the incident, Romanian Defense Minister Ionuț Moșteanu stated that the frequency of Russian drones entering Romanian airspace has increased and that Russian drones violate Romania’s airspace almost every week.²
• September 19: Three Russian MiG-31 fighter jets entered Estonian airspace without permission and remained there for a total of 12 minutes. NATO scrambled aircraft to intercept and escort the jets out of Estonian airspace.
• September 19: Poland reported that two Russian jets performed a low pass over the Petrobaltic oil drilling platform in the Baltic Sea, located in Poland’s exclusive economic zone. In a statement, Poland's border guards said the flyover violated the platform's safety zone.³
• September 21: Germany scrambled two jets after a Russian reconnaissance aircraft entered neutral airspace over the Baltic Sea without a flight plan or radio contact.⁴
• September 24: The North American Aerospace Defense Command (NORAD) detected and tracked two Russian Tu-95s and two Su-35s operating in the Alaskan Air Defense Identification Zone. NORAD scrambled jets to positively identify and intercept the Russian aircraft. The Russian military aircraft remained in international airspace but did not enter American or Canadian sovereign airspace.⁵

While the incidents highlighted above used Russian military assets that can be directly tied to the country, European leaders suspect Russia is also using hybrid tactics to disrupt their airspace.

• On September 22, Copenhagen Airport halted operations for four hours after unknown drones were sighted operating nearby.⁶ According to Danish police, the drones came from several different directions and flew in a manner suggesting a “capable operator” was responsible for the incident. Similar drone sightings were also reported near the Oslo Airport on the same night, again temporarily halting airport operations.⁷
• Officials have been unable to directly connect these incidents to Russia, though Danish Prime Minister Mette Frederiksen called the drone incident "the most serious attack" on the state’s critical infrastructure and suggested Russia could be responsible.⁸

Frederiksen’s comments echo previous warnings from Allied leaders that Russia is increasingly targeting European infrastructure using hybrid tactics. Hybrid measures are generally low-risk, low-cost, and offer Russia potentially high rewards. Historically, these measures have included sending groups of migrants to the borders of EU states, recruiting criminals for petty acts of sabotage of critical infrastructure, economic coercion, disinformation campaigns, and elections interference. 

• One of the key types of hybrid warfare has been strategic attacks on European critical infrastructure, such as GPS jamming and targeting physical supply chains.

Since hybrid measures do not rise to the level of a military attack, they have gone largely unanswered by European authorities.

• Toeing this line in and of itself constitutes a new hybrid risk to NATO, in which European leaders must consider the risk of possible escalation when calculating how to respond to acts of Russian aggression.
• Russia’s recent use of fighter jets and drones shifts its hybrid tactics closer to military action but remains below the threshold of direct military confrontation.

Possible Motivations 

Russia’s recent air activities likely serve mutually beneficial goals under the umbrellas of reconnaissance and signaling. Russia can be expected to continue these exercises as it adopts an increasingly aggressive stance towards Europe and NATO. 

• Reconnaissance
  • The incursions allow the Russian military to probe NATO defenses and observe the granular procedures of each NATO response to a violation. The use of both drones and fighter jets allows the Russian military to observe how NATO’s response varies based on the means of the attack. These experiences offer the Russian military key technical insight into how NATO may react during a future conflict.
  • The political responses from NATO leaders allow Russian leaders to probe the political structure of the Alliance. The various responses of NATO member-states offer Russian leaders key insight into how the bloc operates and have the potential to reveal internal differences or disagreements that Russia may seek to exploit. Russian leaders were likely especially interested in whether U.S. President Donald Trump would align his response to that of NATO’s European allies.
• Signaling
  • The incursions signal that NATO must seriously consider bolstering defenses on its eastern flank, a priority that would likely interfere with aid to Ukraine. For example, these incursions could make NATO hesitant to deploy its own stock of air defense systems to Ukraine; NATO may instead save these systems to buoy the Alliance’s own air defenses.
  • The incursions may also be a signal warning NATO of the possible consequences of direct military support for Ukraine. Russia is likely demonstrating that direct NATO involvement in Ukraine would risk bringing Europe into a war, rather than deterring Russia.

NATO Response

Article 4 Consultations

Following the September 10 incursion into Poland and September 19 incursion into Estonia, both countries respectively requested NATO Article 4 consultations. Article 4 places urgent matters on NATO’s agenda, allowing any member to request formal consultations with the Allies when it believes its territorial integrity, political independence, or security is threatened. Article 4 does not automatically trigger any diplomatic or military action—unlike the more famous Article 5, which states an attack on one NATO member is an attack on all members. However, discussions between allies under Article 4 can facilitate some form of joint response.

• The invocation of Article 4 twice in two weeks is unprecedented in NATO’s history.
• Since the alliance’s creation in 1949, Article 4 has been invoked nine times. The last time NATO invoked Article 4 prior to the Poland incursion was the day Russia began its full-scale invasion of Ukraine on February 24, 2022.⁹

Operation Eastern Sentry

On September 12, 2025, NATO Secretary General Mark Rutte announced the launch of Operation Eastern Sentry in response to the incursion into Polish airspace. The operation is aimed at integrating air and ground-based defenses on NATO’s eastern flank, while also improving information-sharing between NATO members. However, Rutte’s announcement lacked details about what exactly the operation would entail. 

• While Eastern Sentry demonstrates a show of unity and deterrence, some have criticized the operation as a traditional response to a new threat. Critics argue that Eastern Sentry relies on costly, high-end assets like fighter jets to counter cheap, low-tech threats such as drones. Additionally, some have questioned whether the jets are effective against the modern drone and electronic warfare capabilities Russia has developed in Ukraine.¹⁰
• However, upcoming NATO military funding deadlines may indicate whether the Alliance plans to commit additional resources to its eastern flank. Proposals for the Security Action for Europe (SAFE) program are due by November 30, 2025. SAFE is a joint European Union (EU) member fund of EUR 150 billion used to invest in defense capabilities that Europe lacks, including drones, cyber defense, missiles, and a possible European air shield.¹¹

Defensive Posture

Meanwhile, NATO members have reiterated that the Alliance retains the right to shoot down Russian aircraft that violate NATO airspace. 

• Polish Foreign Minister Radosław Sikorski warned Russia not to “whine” if Poland or other NATO member states shoot down Russian drones or fighter jets that violate NATO airspace.¹²
• U.S. President Trump echoed Sikorski on September 23, saying NATO members should shoot down Russian aircraft that enter their airspace.¹³
• Also on September 23, Lithuania’s parliament authorized the country’s military to shoot down any unmanned drones violating its airspace. Previously, the Lithuanian military was only allowed to target drones deemed to be armed or pose an imminent danger to the state.¹⁴

Despite the rhetoric from some individual members, NATO Secretary General Mark Rutte offered a more nuanced statement when asked whether NATO will shoot down any aircraft that violates NATO airspace. Rutte cautioned that such decisions are always made in real time depending on the threat posed by the aircraft and indicators of intent.¹⁵

• Rutte’s statement aligns with NATO’s responses to Russia’s latest airspace violations and will likely govern future NATO responses as well.
• While NATO will almost certainly continue to mount armed responses to future airspace violations, the Alliance will likely mete out any response to avoid escalating the incident into a direct conflict with Russia.

Economic Response

The drone incursion into Poland specifically prompted renewed focus on providing financial support to Ukraine using frozen Russian assets. On September 10, European Commission President Ursula von der Leyen proposed seizing Russian assets to fund a so-called reparations loan for Ukraine worth up to EUR 130 billion (USD 153 billion).¹⁶

• According to von der Leyen’s proposal, the EU would replace frozen Russian assets with zero-coupon bonds issued by the European Commission. The assets would then fund loans to Ukraine, which would only be repaid once Russia pays Ukraine reparations under a peace settlement.¹⁷
• While the EU has used the interest from frozen Russian assets to finance support for Ukraine, the bloc has not confiscated the assets themselves. Several member-states oppose such a move, concerned that the precedent of confiscating sovereign assets could undermine confidence in EU government bonds.¹⁸
• While von der Leyen’s proposal is unlikely to develop in the short term, it aligns with a U.S. emphasis on worsening the economic costs for Russia in an attempt to force a quicker end to the conflict.

NATO members, most of whom are also EU members, likely have different risk tolerances when it comes to military conflict with Russia. Western European states are less likely to support action expected to lead to a military conflict that would increase risks to their own national and economic security. Meanwhile, eastern European states often advocate for more robust responses—even at significant risk—due to their recent histories with Russian occupation.

• For many in NATO, Russia’s inability to take more than 20 percent of Ukraine (a significantly weaker military) after three years of fighting has demonstrated it is no longer the security threat it once was. This is likely behind U.S. (the largest military in NATO) reasoning to reduce its commitments to Ukraine and Europe and refocus on threats in Latin America.
• However, states along Russia’s western periphery (such as Finland, Estonia, Latvia, Lithuania, and Poland), which share about 2,200 miles of borders with Russia and its ally, Belarus, likely have a different perception of the risk posed by Russia. These shared histories under Soviet occupation or as former members of the union have, in many cases, made them the most outspoken about Russia's threat to Europe.
• Western European states, led by Germany and France, are likely caught in between the U.S. and eastern European position. While they likely view Russia as a threat, they are less likely to support action that could lead to economic and military retaliation while they attempt to address more tangible domestic issues.

Russian Response 

Russia has categorically dismissed the aforementioned airspace violations as “baseless” claims.¹⁹ Russian officials and state media have claimed that neither Poland nor Romania can prove Russian drones violated their respective airspaces, instead suggesting Ukrainian drones were responsible for the incursions. Meanwhile, following the incident in Estonia, Russia’s Ministry of Defense confirmed that the three MiG-31 jets completed a planned flight from Karelia to Kaliningrad but denied the aircraft ever entered Estonian airspace.²⁰ 

• These statements align with Russia’s typical strategy of denying responsibility for such incidents and suggesting potential alternative explanations in an attempt to maintain plausible deniability.
• Russia will almost certainly continue to deny responsibility for future airspace violations, suspicious flight patterns, or suspected hybrid measures.

Russian rhetoric cautioning NATO’s response has been sharp. Following a suggestion from Polish Foreign Minister Sikorski that NATO establish a no-fly zone over Ukraine to defend the Alliance from future airspace violations,²¹ the Deputy Chairman of the Security Council of Russia, Dmitry Medvedev, said such a move would lead to a direct war between NATO and Russia.²² 

• Medvedev’s rhetoric towards the West is often aggressive and designed to grab headlines. However, the meaning behind his statement is plain: if NATO presents a more united front in halting Russia’s goals in Ukraine, the Alliance risks becoming a target.

Conclusion

Russia’s recent air incursions into NATO territory appear aimed at both reconnaissance and signaling, providing the Kremlin with technical insight into NATO’s military responses and political cohesion while simultaneously warning the Alliance against deeper support for Ukraine. While NATO forces have responded to each individual incident and reinforced their commitment to European defense under Operation Eastern Sentry, it remains unclear if NATO members are willing to utilize significant force to deter Russian aggression. In the near term, Russia is expected to continue its pattern of increased violations of NATO airspace and suspicious flight activity in international airspace bordering NATO members. 

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 1:00 PM (EDT) on September 25, 2025; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

ZeroFox Intelligence Probability Scale 

All ZeroFox intelligence products leverage probabilistic assessment language in analytic judgments. Qualitative statements used in these judgments refer to associated probability ranges, which state the likelihood of occurrence of an event or development. Ranges are used to avoid a false impression of accuracy. This scale is a standard that aligns with how readers should interpret such terms.

1. hXXps://tvpworld[.]com/88839959/russian-drones-violate-polish-airspace-locations-of-drone-crashes-and-debris-found
2. hXXps://theins[.]press/en/news/284947
3. hXXps://x[.]com/Morski_SG/status/1969082563068071983
4. hXXps://www.reuters[.]com/world/europe/russian-military-plane-entered-airspace-over-baltic-sea-sunday-germanys-air-2025-09-21/
5. hXXps://www.norad[.]mil/Newsroom/Press-Releases/Article/4314460/norad-detects-and-tracks-russian-aircraft-operating-in-the-alaskan-air-defense/
6. hXXps://x[.]com/CPHAirports/status/1970254853113847970
7. hXXps://www.bbc[.]com/news/articles/c7401vk4lgzo
8. hXXps://www[.]dw[.]com/en/drone-incursions-in-denmark-were-hybrid-attack/a-74129141
9. hXXps://www.nato[.]int/cps/en/natohq/topics_49187.htm
10. hXXps://www.rferl[.]org/a/nato-eastern-sentry-russia-drones-poland/33536306.html
11. hXXps://defence-industry-space[.]ec[.]europa[.]eu/eu-defence-industry/safe-security-action-europe_en
12. hXXps://www.euronews[.]com/2025/09/23/poland-warns-russia-not-to-whine-if-its-jets-are-shot-down-in-nato-airspace
13. hXXps://thehill[.]com/policy/defense/5518211-trump-nato-countries-should-shoot-down-russian-planes-if-they-enter-airspace/
14. hXXps://tvpworld[.]com/89084462/lithuanian-army-cleared-to-shoot-drones-violating-airspace
15. hXXps://www.nato[.]int/cps/en/natohq/opinions_237718.htm
16. hXXps://newsukraine[.]rbc[.]ua/news/-300-350-billion-in-frozen-russian-assets-1758615053.html
17. ibid.
18. Ibid.
19. hXXps://ria[.]ru/20250922/peskov-2043496889.html
20. hXXps://ria[.]ru/20250924/london-2043872909.html
21. hXXps://www.faz[.]net/aktuell/politik/ukraine/sikorski-sollten-ueber-flugverbotszone-in-der-ukraine-nachdenken-accg-110684693.html
22. hXXps://www.rbc[.]ru/rbcfreenews/68c7be5d9a7947e6da2fc956