◈ Baltic Sonar — 2026-10-25

**BALTIC SECURITY INTELLIGENCE BRIEF: 2026-10-25** **Overall Assessment** The Baltic security environment remains stable with an overall index of 28/100 (BLUE). While no immediate kinetic threats are detected, the region faces persistent sub-threshold pressure through hybrid operations and digital infrastructure vulnerabilities. The current posture reflects a steady state of deterrence and resilience, with no indicators of imminent escalation. **Notable Developments** Recent data highlights a significant volume of hybrid activity, with 54 incidents identified in Europe over the past six months, signaling a sustained effort to erode societal trust. Concurrently, critical infrastructure sectors in Estonia, Latvia, and Lithuania experienced multiple BGP routing anomalies. Affected entities include Tallinn Airport, the NATO Cooperative Cyber Defence Centre of Excellence, Litgrid, Swedbank AS, the State Regional Development Agency, the Latvian Ministry of Foreign Affairs, and Eesti Pank. ASSESSMENT: These simultaneous anomalies suggest coordinated probing or automated scanning rather than a single large-scale attack, given the lack of reported service disruptions. **Correlated Clusters** Data shows distinct thematic correlations: Lithuania exhibits links between critical infrastructure, economic finance, hybrid threats, weather, and cyber domains. A multi-state cluster connects naval operations, GNSS electronic warfare, hybrid activities, and economic finance. Estonia correlates critical infrastructure with weather, economic finance, and diplomatic issues, while Latvia links critical infrastructure with weather, air space, and military domains. Note: Correlation does not imply causation; these clusters may reflect shared environmental or operational contexts rather than direct causal links. **Narratives Present** In the last seven days, sampled items grouped into four primary narratives: Ukraine War & Diplomacy (15 items), Hybrid Threats & Sabotage (15 items), NATO Exercises & Presence (11 items), and Baltic Defense Modernization (9 items). These counts represent current sampling distribution, not trends over time. **Monitoring Priorities** 1. **BGP Stability:** Monitor for recurrence or expansion of routing anomalies in EE, LT, and LV critical infrastructure. 2. **Hybrid Operations:** Track the 54 identified incidents for potential escalation into physical sabotage or disinformation campaigns. 3. **Naval/GNSS Interference:** Observe multi-state naval and electronic warfare activities for impacts on maritime navigation and logistics.