Executive Summary
On June 24 and 25, 2025, representatives of all 32 members of the North Atlantic Treaty Organization (NATO) will convene in The Hague, the Netherlands, for the 2025 NATO Summit. With each members head of state or government in attendance, the summit represents a high-profile diplomatic event taking place amid heightened geopolitical uncertainty and internal alliance tensions. Key issues, such as the ongoing war in Ukraine, economic volatility, rising Euroscepticism, and concern over the United States (US) commitment to NATO going forward, are all likely to dominate the agenda.
The complex geopolitical backdrop of the 2025 NATO Summit almost certainly increases its appeal as a target for a wide spectrum of threat actors, including state-sponsored influence operations groups and cyber threat actors, cybercriminals, and hacktivists. Insikt Group assesses that malign influence operations, cyber-espionage activity, and a measurable uptick in cybercriminal and hacktivist activity likely represent the three primary threat vectors to the 2025 NATO Summit. Russian and Chinese influence networks will almost certainly seek to exploit the summit to amplify perceptions of NATO disunity and undermine its credibility as a reliable security partner. In parallel, Russian state-sponsored cyber actors are highly likely to conduct targeted espionage against NATO-affiliated entities and personnel, while Chinese cyber threat actors are more likely to pursue opportunistic intrusions to glean insight into alliance policies and future planning. Hacktivist and cybercriminal actors are already attempting to capitalize on the summits geopolitical visibility for financial gain and political messaging, based on closed forum references to NATO and ongoing targeting of NATO member states.
Security officials are simultaneously preparing extensive physical security measures to safeguard the event. While direct attacks on the summit by Russian hybrid actors encompassing conventional and irregular military forces are unlikely, tactics such as sabotage, vandalism, weaponized migration, and provocative military signaling will very likely continue to pressure NATO member states around the time of the event, particularly allies in Eastern Europe. At the time of publication, Insikt Group assesses that protests during the summit are very likely, but risks associated with protest activities are largely mitigated through proactive security measures. Additionally, we have not observed any credible evidence suggesting that violent non-state actors are planning or expressing intent to target the summit.
Key Findings
- We assess NATOs ability to project unified geopolitical and military strength is likely more uncertain than any time in recent years, driven by US rhetoric questioning the alliances utility, rising political influence of Eurosceptic far right parties in several NATO member states, and Russias continued efforts to undermine NATO unity via its military campaign in Ukraine and hybrid sabotage and influence operations in Europe.
- Russian hybrid threats, including sabotage of critical infrastructure, vandalism, weaponized migration, and coercive military posturing, will very likely continue to target European countries ahead of and following the 2025 NATO Summit, particularly if the summit results in significant action regarding Ukraine with the Baltic states, Poland, and Germany likely at highest risk.
- Both Russia and Chinas own influence ecosystems will almost certainly attempt to shape public opinion around the 2025 NATO Summit by portraying the alliance as aggressive, divisive, and divided.
- Malign influence actors, particularly from Russia, are likely to use artificial intelligence (AI)-generated media in an effort to discredit NATO leadership, delegitimize summit outcomes, and further inflame tensions among member states.
- Cybercriminal and hacktivist activity referencing NATO has surged across dark web and special-access forums in the months leading up to the 2025 NATO Summit, very likely signaling a heightened risk of ideologically driven and financially motivated multi-vector campaigns targeting NATO member states and defense-affiliated entities.
- Russian state-aligned threat groups have already begun deploying new malware in cyber operations targeting personnel and infrastructure associated with the 2025 NATO Summit.
- Chinese state-sponsored groups tasked with the collection of foreign intelligence, particularly those under the Ministry of State Security, are likely to engage in some level of opportunistic cyber-espionage operations against select attendees with the goal of understanding summit-related policy discussions and outcomes.
- The Netherlands extensive security posture around the 2025 NATO Summit will very likely mitigate the scope, sophistication, and impact of physical security threats to the event from violent non-state actors, including terrorists, violent extremists, criminal organizations, and disruptive protest movements.
Strategic Threat Environment
2025 NATO Summit Likely Pivotal for Alliances Future Unity
The 2025 NATO Summit comes at a time when the alliances ability to project unified geopolitical and military strength is likely more uncertain than any time in recent years, driven by US rhetoric questioning the alliances utility; rising political influence of Euroskeptic far right parties in several NATO member states; and Russias continued efforts to undermine NATO unity via its military campaign in Ukraine, and hybrid sabotage and influence operations in Europe.
The US governments public messaging concerning its commitment to NATO has been inconsistent throughout President Donald Trumps first and second terms. In 2025, President Trump suggested that the USs commitment to Article 5 of NATOs founding treaty would depend on a given NATO states defense spending, stating, If they dont pay, Im not going to defend them. In contrast, in 2017, President Trump stated, Absolutely, Id be committed to Article 5.
Secretary of State Marco Rubio announced that all NATO members will be expected to spend 5% of their GDP on defense over the next decade, an increase from the previous benchmark of 2%. Although Rubio emphasized that the US remains committed to supporting NATO, notes from an internal Trump Administration proposal revealed plans to reduce the amount of money the US would contribute to NATOs budget. The US currently provides roughly 16% of the alliances funding.
In some key NATO states, the rising political influence of far-right parties that are skeptical of NATO and sympathetic to Russia likely complicates their ability to reinforce NATO commitments. For example, Frances Rassemblement National (RN) has historically advocated for Frances withdrawal from NATO. Though the RN has recently moderated its position, its historically anti-NATO position risks complicating French President Emmanuel Macrons ability to achieve consensus on increased French defense spending for NATO. Germanys Alternative fr Deutschland (AfD) has questioned NATOs continued utility and has advocated for closer Germany-Russia ties.
Differences in NATO states probable responses to Russias multi-pronged attempts to weaken NATO and its allies will almost certainly strain NATOs ability to project a unified response to Russias actions. Though NATO has, from its founding in 1945, been primarily concerned with resisting Russian aggression, in the last two years, Russia has significantly escalated its aggression towards NATO and its allies, with Moscows full-scale invasion of Ukraine, escalating sabotage operations in NATO territory, and widespread influence operations aimed at undermining public confidence in Western democracy and manipulating elections in favor of pro-Russia candidates.
Profiles of Key Players
United States Unpredictable NATO Leader
Inconsistent statements by senior US officials about NATOs utility and how much to resist Russian aggression likely make it difficult to predict the USs 2025 NATO Summit priorities, which will have significant influence over the tone of the summit and the text of the Summit Declaration. That said, the US almost certainly will call for NATO member states to spend 3.5 to 5% of their GDP on defense, judging from past statements by President Trump. The US is also likely to push for NATOs increased focus on China-nexus threats to NATO territory, judging from the Trump administrations emphasis on resisting Chinese global aggression. The USs inconsistent policies toward Russia ranging from supporting Russias view that Kyiv started the Russia-Ukraine war to calling for additional sanctions on Russia make it difficult to predict the USs stance on Russia at the summit. Reporting suggests senior NATO officials including the NATO Secretary General are considering deemphasizing Ukraine at the summit, potentially including not inviting Ukrainian President Volodymyr Zelensky, to avoid alienating President Trump. We assess this suggests that at least some NATO states might be willing to compromise on their priorities to ensure the US remains invested in the alliance.
Poland Concerns about Existential Threats from Moscow Drive Militarization
Polands presidential election likely raises questions about Warsaws level of support for Ukraine at the 2025 NATO Summit and beyond. Law and Justice (PiS) candidate Karol Nawrocki won the runoff on June 2, 2025. Nawrocki has stated that he would veto Ukraines accession to NATO, suggesting Warsaw is likely to be less inclined to support additional NATO aid to Ukraine. However, Nawrocki is likely to remain committed to building up Polands military capabilities to resist Russian aggression. Warsaws history of being invaded by Russia and Putins rhetoric undermining Polands sovereignty almost certainly have led Poland to conclude that NATO strength is one of the only deterrents to Russian aggression within Poland, potentially including territorial incursions. Polish leaders have announced plans to increase the size of Polands standing army from 200,000 to 500,000 and provide military training to every Polish man.
United Kingdom Member of Pro-NATO Unity Bloc
The United Kingdom (UK) is likely to strongly advocate for continued NATO unity to resist threats, including an increase in NATO assistance to Ukraine. The UK has announced a commitment to increase its defense spending to 2.5% of its GDP by 2030. Notably, UK Prime Minister Keir Starmer has backed NATO membership for Ukraine despite US objections, suggesting there could be tension between the US and UK on this issue at the summit.
Germany Member of Pro-NATO Unity Bloc
Germany is likely to be more committed to NATO unity and increased defense spending than it has in previous NATO summits, as it adopts a position similar to that of the UK and France. Senior German officials have pledged to spend 5% of Germanys GDP on defense. Merzs government voted to revise Germanys constitution to allow increased defense spending and facilitate the largest German rearmament since World War II. Chancellor Merz has also expressed support for Ukraine joining NATO, though he has rejected the idea of sending NATO troops to Ukraine.
France Member of Pro-NATO Unity Bloc
Frances position at the 2025 NATO Summit is likely to be broadly similar to that of the UK and Germany. French President Emmanuel Macron has advocated for NATO states to increase their defense spending to 3 to 3.5% of their GDPs. France has called for credible security guarantees for Ukraine via a coordinated NATO strategy, including a pathway for Ukraine to join NATO. Macron is also likely to advocate for the expansion of nuclear deterrence measures to strengthen NATOs defenses.
Hungary Efforts to Balance NATO Membership with Close Russia Relations Complicate NATO Unity
Hungary is likely to take a multifaceted approach that aims to balance participation in core NATO functions, including defense spending targets and collective defense mechanisms, with avoiding providing direct military assistance to Ukraine, likely to preserve Hungarys relationship with Russia. Hungary has met NATOs longtime 2% defense spending target, though its efforts to maintain a positive relationship with Russia are likely to complicate NATOs ability to project a unified response to Russian aggression. Hungarys plans to determine a way to avoid operations outside of NATO territory suggest it could complicate NATO responses to conflicts, even outside of the Russia-Ukraine war.
Trkiye Pivotal Independent Player, Most Well-Positioned to Influence NATO Priorities
Trkiyes strong military and unique diplomatic positioning to broker talks with Western powers as well as Russia and China means it likely feels empowered to push NATO to adopt Turkish priorities. For example, Trkiye initially opposed Swedish admission into NATO due to Sweden providing asylum for members of the Kurdistan Workers Party, a political party Ankara considers a terrorist organization. Trkiye eventually agreed to Swedish admission into NATO after securing key concessions from the US, including F-16 fighter jets.
Trkiye announced plans in October 2024 to increase its defense and security spending in 2025 to $47 billion, its highest-ever military budget. Ankara has offered up its services as a mediator in the Russia-Ukraine war, though Ankaras often close relations with Moscow make it unclear to what extent Trkiye would be able to be a neutral arbiter between Moscow and Kyiv. More broadly, Trkiye is likely to seek NATO support for its own national priorities, including counterterrorism, as well as a lifting of NATO arms embargoes on Trkiye, which Ankara argues undermines Turkish defense capabilities.
Hybrid Threats to NATO Member States
Russian hybrid threats including sabotage of critical infrastructure, vandalism, weaponized migration, and coercive military posture will very likely continue to target European countries ahead of and following the 2025 NATO Summit. While these operations are unlikely to directly target the summit event itself, threats to the critical infrastructure of NATO member countries are likely heightened as Moscow seeks to destabilize member states and exploit divisions within the alliance. Hybrid threats will almost certainly increase their targeting of NATO member countries following the summit if it results in significant action regarding Ukraine, such as a joint commitment to further military aid to Kyiv. In January 2025, the Finnish Defence Forces assessed that Russia will likely increase the use of all hybrid methods as it seeks to cause disunity within NATO and the European Union, including cyber and information influencing, coercive use of energy exports, targeting of energy and other critical infrastructure, weaponizing immigration, and intelligence operations.
Russian Hybrid Warfare Units
Insikt Group identified at least five Russian units dedicated to hybrid warfare operations, including sabotage, assassinations, arson attacks, espionage, and recruitment of foreign agents (Table 1). The Kremlin also very likely employs individuals not directly affiliated with its security or intelligence services to conduct hybrid threat activity, in an effort to prevent discovery and complicate attribution. For example, GRU Military Unit 54654 very likely recruits operatives without prior military contracts or connections to the Russian government to avoid identification, including recruiting foreign students studying in Russia, Russian students abroad, and criminal organizations in Russia and abroad.
Recent arrests and incidents of potential sabotage across Europe indicate that recruits are largely young men, Russian-speaking but not Russian citizens, often with a criminal background and recruited via Telegram. For example, Polish Foreign Minister Radek Sikorski stated in an interview that Russia used Telegram to recruit the perpetrators of the May 2024 arson attacks on a Warsaw shopping mall. In March 2025, the Finnish Defence Forces assessed that attempts to recruit human sources online, and particularly on pro-Russian social media platforms, are likely to become more common. Similarly, Moscow can also likely co-opt vessels affiliated with its shadow fleet to conduct low-sophistication destructive actions targeting submarine infrastructure, such as anchor dragging, as these assets likely draw less scrutiny.
| Entity | Hierarchy | Operations |
| Department of Special Tasks ( ) | Established in 2023 by GRU Deputy Director Andrey Vladimirovich Averyanov and Ivan Sergeevich Kasianenko Encompasses GRU units 29155 and 54654 | Reportedly responsible for a planned assassination plot targeting Rheinmetall CEO Armin Papperger and explosives planted at DHL logistics centers in 2024 |
| GRU Unit 29155 (/ 29155) | Now under the Department of Special Tasks; led by Averyanov | Reportedly involved in bounties on US soldiers in Afghanistan, the 2018 Skripal poisoning and sabotage operations; linked to cyber espionage and Russian influence network CopyCop |
| GRU Unit 54654 (/ 54654) | Now under Department of Special Tasks | Recruits operatives without prior military or government connections; behind illegals intelligence programs |
| GRU Unit 54777 (/ 54777) | Also known as the 72nd Special Service Center | Conducts psychological operations; exploited Ukraine peace demonstrations in Germany to influence public opinion |
| Main Directorate of Deep Sea Research ( , GUGI) | Reports directly to the Ministry of Defense; naval base in Olenya Bay | Very likely involved in submarine infrastructure surveillance and sabotage; maintains at least eight nuclear submarines and thirteen ships, including the Yantar, which hosts two deep-sea submarines |
Table 1: Formal Russian government entities affiliated with sabotage or hybrid threat operations (Source: Recorded Future)
Sabotage
Russia very likely aims to target European critical infrastructure with hybrid cyber-kinetic operations, regardless of the outcome of current peace negotiations on Ukraine. Based on recent incidents, countries neighboring Russia Estonia, Finland, Latvia, Lithuania, and Poland likely represent the most attractive targets for sabotage operations. Additionally, countries providing the strongest support to Ukraine, such as Germany and Poland, are almost certainly at greater risk of physical threats than countries that do not provide significant aid, such as Hungary, which Moscow is unlikely to directly target. Specifically, Insikt Group assessed in April 2025 that Russias threat perception and intent to target European energy entities would likely increase following the European Union (EU)s announcement of a framework to eliminate Russian fossil fuel imports by 2027.
Russia-directed sabotage attacks targeting the critical infrastructure and key government and military facilities of European countries have almost certainly increased since 2022. Recent incidents suggest that these operations largely involve low-sophistication tactics with a degree of plausible deniability and obfuscated links to Moscow, often initially appearing as accidents or single criminal events, complicating attribution and identification of a larger strategic trend. For example, in March 2025, Polish prosecutors announced that an alleged Belarusian refugee masquerading as an opposition activist had set fire to a Warsaw supermarket on Russias behalf in April 2024, and Lithuanian prosecutors attributed an arson attack on an Ikea store in Vilnius in May 2024 to two teenagers recruited by Russias Main Directorate of the General Staff of the Armed Forces (GRU). In December 2024, the Federal Prosecutors Office in Germany announced charges against three Russian-German nationals for reportedly surveying a US military base in Grafenwhr, a weapons factory in Bayreuth, and military facilities and railway lines to support sabotage operations using explosives. According to the Center for Strategic and International Studies (CSIS), Russia-directed sabotage attacks in Europe tripled between 2023 and 2024 (from 12 to 34 attacks), after quadrupling between 2022 and 2023 (from 3 to 12 attacks).
Threats to Submarine Cable Infrastructure
Sabotage operations targeting submarine cables off the coast of Europe almost certainly represent a relatively low-effort, high-reward vector for targeting European critical infrastructure. In June 2023, Insikt Group assessed that Russias ongoing war against Ukraine was very likely fueling physical attacks and intelligence collection efforts against the submarine cable system to undermine the economic, diplomatic, and national security objectives of the US and its NATO allies. Specifically, Russia almost certainly presents the greatest direct threat to submarine cables in the North and Baltic Seas.
Insikt Group identified four incidents involving damage to eight submarine cables in the Baltic Sea in 2024 and 2025: January 2025 damages to the C-Lion1 cable connecting Germany and Finland; January 2025 damages to the Sweden-Latvia cable; December 2024 damages to four submarine internet cables (likely the Finland Estonia Connection 1, Finland Estonia Connection 2, Baltic Sea Submarine Cable, and C-Lion1) and the Estlink-2 power cable; and November 2024 damages to the C-Lion1 and BCS East-West Interlink. Prosecutors have attributed these damages to vessels, some with connections to Russia, dragging their anchors; for example, the Eagle S vessel behind the December 2024 cable cuts is suspected to be part of Russias shadow fleet and reportedly carried surveillance equipment. While none of these incidents caused prolonged outages or communication disruptions due to the availability of alternate routes for data transmission, increased societal concerns about the vulnerability of critical infrastructure had a clear psychological impact on northern European populations. A more coordinated attack on submarine critical infrastructure could cause disruptions to business operations, financial losses, and communications disruptions, raising the risk of economic ramifications to northern and eastern Europe. In 2024, Estonian power provider Elering reported that energy bills spiked by 10% due to a technical problem with a power cable, with board member Erkki Sapp stating that energy infrastructure can handle any single event, but if there are several of these sorts of events, then this may lead to issues with security of supply.
In addition to threats to critical infrastructure, Moscow has very likely attempted to weaponize refugee flows in an effort to foment domestic unrest and exploit concerns about immigration in countries bordering Russia and Belarus. In October 2024, Poland temporarily suspended asylum rights for migrants entering the country via Belarus, over concerns that Russia had orchestrated an influx of migrants at that border as part of hybrid tactics to destabilize Poland. Similarly, Finland closed its last border crossing with Russia in November 2023 after accusing Moscow of facilitating the crossing of approximately 1,000 migrants without valid documentation. Throughout 2021 and 2022, Lithuania documented similar efforts by the Belarusian government to push migrants across the border. As such, the weaponization of migration across Russian and Belarusian borders with NATO member states, particularly Finland, Poland, Estonia, Latvia, and Lithuania, likely remains a viable tactic to attempt to destabilize these countries.
Coercive Military Posture
Russias plans to expand its military capabilities near the border with Finland and the Baltic states will very likely focus on increasing military presence and intelligence capabilities. Moscows ability to implement these changes has been constrained by its ongoing military operations in Ukraine, although it has already taken several key steps in 2024 most notably, the creation of the Leningrad Military District bordering Finland and the Baltics, which Moscow frames as its response to NATO expansion. Russia reportedly aims to increase the size of its armed forces by 350,000 by 2026, of which up to 50,000 will deploy to the Leningrad Military District, potentially increasing troop numbers near Finland from approximately 30,000 to 80,000. While Finnish and Latvian intelligence services have assessed that planned troop increases will not be completed for several years, Russia will very likely seek to ramp up implementation of military reforms should the conflict in Ukraine decrease in intensity, focusing on increasing military presence and capabilities in its northwestern regions.
In addition to expanding its military capabilities along NATO member state borders, Russian coercive military actions via incursions into NATO airspace will also likely increase ahead of the 2025 NATO Summit. In April 2024, the foreign ministers of Estonia, Latvia, Lithuania, Finland, and Sweden met to discuss growing global positioning system (GPS) interference in the region, which Estonian Foreign Minister Margus Tsahkna attributed to Russia and which Insikt Group assessed would continue through then-ongoing STEADFAST DEFENDER 2024 military exercises. In its annual report in May 2025, Latvias Military Intelligence and Security Service (MIDD) reported that Russia has increasingly been monitoring NATO activity in the Baltic Sea and engaging in acts such as unauthorized airspace violations, in a likely attempt to intimidate, test NATO responses, and discredit regional defense capabilities.
To read the entire analysis, click here to download the report as a PDF.
Source: RecordedFuture
Source Link: https://www.recordedfuture.com/research/threats-2025-nato-summit