◈ Baltic Sonar — Daily Intelligence Brief, 2026-09-16

**BALTIC SECURITY INTELLIGENCE BRIEF: 2026-09-16** **Overall Index:** 56/100 (YELLOW) **Overall Assessment** The Baltic security environment remains elevated but stable. Recent incidents indicate heightened hybrid pressure, primarily involving cross-border drone incursions and cyber infrastructure targeting. While no direct kinetic conflict has occurred, the convergence of air domain violations and digital anomalies suggests a coordinated or opportunistic testing of regional defenses. **Notable Developments** Lithuanian President Nausėda attributes a recent drone incursion to a Russian attack drone intended for Ukraine, allegedly diverted by Ukrainian electronic warfare. This incident has prompted strong diplomatic responses, with the German Foreign Minister asserting NATO’s resolve against intimidation. Concurrently, U.S. authorities uncovered a plot involving Russian and Cuban nationals to assassinate dissidents in Washington and Vilnius, highlighting persistent internal threat vectors. In Latvia, the defense minister noted that the investigation into a separate drone incident will require time. Additionally, repeated BGP routing anomalies targeting the Latvian Ministry of Foreign Affairs signal ongoing cyber probing of critical infrastructure. **Correlated Clusters** Lithuania exhibits a broad correlation across air, military, and hybrid domains. Multi-state clusters link naval and GNSS/EW activities with economic and diplomatic factors. Russia shows strong correlations in military, cyber, and hybrid operations. Latvia’s cluster is dominated by critical infrastructure and economic finance concerns. *Note: Correlation does not imply causation.* **Narratives Present** Recent discourse focuses on Drone Incidents & Air Defense (21 items), Military Readiness & Exercises (13 items), Belarus-Russia Hybrid Threat (8 items), and EU Strategic Autonomy (8 items). **Monitoring Priorities** 1. **Air Domain Integrity:** Monitor for further unauthorized drone incursions and electronic warfare interference. 2. **Cyber Infrastructure:** Track BGP anomalies and potential DDoS attacks against Baltic government entities. 3. **Internal Threats:** Assess risks related to transnational assassination plots targeting political dissidents. *ASSESSMENT: The current threat landscape reflects a sustained hybrid campaign rather than an imminent conventional escalation.*