◈ Baltic Sonar — Daily Intelligence Brief, 2026-10-24

**BALTIC SECURITY INTELLIGENCE BRIEF: 2026-10-24** **Overall Assessment** The Baltic security environment remains stable with an overall index of 39/100 (BLUE). While no immediate kinetic threats are detected, persistent digital instability characterizes the current posture. The primary concern is a widespread pattern of Border Gateway Protocol (BGP) routing anomalies affecting critical infrastructure across Estonia, Latvia, and Lithuania. These disruptions suggest ongoing probing or low-level interference with network integrity rather than a coordinated large-scale cyberattack. **Notable Developments** Significant BGP anomalies were recorded involving high-value targets, including the Freeport of Riga Authority and the Ministry of Foreign Affairs in Latvia; the NATO Cooperative Cyber Defence Centre of Excellence, Swedbank AS, and RIKS in Estonia; and the DOMREG .lt registry and LVRTC state ICT in Lithuania. ASSESSMENT: The simultaneous targeting of financial, diplomatic, and military-adjacent entities indicates a broad reconnaissance effort or automated botnet activity rather than a singular strategic operation. **Correlated Clusters** Data shows distinct thematic correlations: Lithuania links critical infrastructure with cyber, information operations, and economic factors; Estonia correlates infrastructure issues with weather and diplomatic events; and Latvia ties infrastructure to air and economic domains. Multi-state clusters involve naval, GNSS electronic warfare, and diplomatic themes. Note: Correlation does not imply causation; these links may reflect shared external stressors or coincidental timing. **Narratives Present** Recent discourse centers on Ukraine War & Peace Negotiations (14 items), Russian Hybrid Threats & Sabotage (11 items), Defense Industrial & Arms Support (10 items), and NATO Reinforcement & Military Exercises (7 items). **Monitoring Priorities** 1. **Network Stability:** Monitor BGP routing stability for the listed entities to detect escalation. 2. **Hybrid Activity:** Track Russian hybrid threat indicators for potential physical or digital spillover. 3. **Diplomatic Channels:** Observe NATO reinforcement exercises for shifts in regional force posture.