Latvia Faces Rising Russian Hybrid Threats In 2026

Latvia, a small Baltic nation perched on NATO’s eastern flank, finds itself in an increasingly precarious position as Russia’s stance towards it hardens. According to the 2025 annual report of Latvia’s Constitution Protection Bureau (Satversmes aizsardzības birojs, SAB), released on January 26, 2026, Moscow now views Latvia with a mindset eerily reminiscent of its attitude toward Ukraine before the 2022 invasion. While the agency stresses there is "no direct military threat … at the moment," it nonetheless flags a number of worrying signs that point to potential long-term plans by Russia.

The SAB’s unclassified report paints a complex picture of hybrid threats—ranging from disinformation campaigns to cyber-attacks—designed to undermine Latvia’s security, test the cohesion of Western alliances, and sow doubt within Latvian society. The Kremlin’s narratives, as outlined by SAB, increasingly present Latvia as “russophobic,” accuse it of oppressing Russian speakers, and depict the country as a “Nazi state,” a “puppet” of Britain and the United States, and even a “failed state.” These themes, the agency notes, are strikingly similar to those Russia promoted about Ukraine before launching its full-scale war in 2022.

"Russia’s perception of Latvia is becoming increasingly similar to the one Russia had of Ukraine before the war," the SAB report warns. This rhetorical escalation, while not yet matched by overt military moves, signals a hardening of Moscow’s political framing. The report emphasizes that the Kremlin’s view of the West has also grown more rigid and detached from reality, shaped by isolation and a distorted sense of threat.

Yet, for all the saber-rattling in the information sphere, the SAB does not believe Latvia is currently at risk of a direct military attack. Instead, the agency’s director, Egils Zviedris, cautions that the threat from Russia remains high, particularly as the country braces for parliamentary elections later this year. Zviedris explicitly warned that Russia may attempt to influence the 2026 elections, leveraging both traditional propaganda and more subtle forms of legal and cyber pressure.

"The threat from Russia would remain high," Zviedris said, adding that Moscow would likely try to sway Latvia’s parliamentary polls. According to Latvian Public Media, the SAB expects legal pressure to feature alongside propaganda, including the use of international legal mechanisms to discredit Latvia and pursue claims of discrimination against Russian speakers. This dual-pronged approach mirrors earlier Russian efforts to reshape Europe’s security architecture, such as the 2021 draft agreements that demanded NATO halt its enlargement—a demand firmly rejected by both the alliance and the United States in early 2022.

Latvia’s security calculus is shaped by its membership in NATO, which provides a collective defense umbrella. Canada leads a multinational presence in Latvia, currently being developed into a brigade at Camp Ādaži, with up to 2,200 Canadian troops expected by 2026. In response to the shifting threat landscape, Riga has ramped up its defense spending, with the Ministry of Defence reporting a budget of 3.8 percent of GDP in 2025 and expectations to reach 4.9 percent in 2026 under NATO definitions.

But the most insidious threats, the SAB argues, are those that fall below the threshold of open conflict. Russia continues to refine its hybrid warfare toolkit, deploying both old and new instruments to target Latvia and its allies. Information operations, often amplified by artificial intelligence, are tailored to specific audiences in an effort to fracture Western unity and undermine public trust. Europol’s 2025 EU Serious and Organised Crime Threat Assessment echoes these concerns, noting that hostile actors—including state-linked proxies—can exploit criminal networks to maintain deniability in their operations.

Cybersecurity, in particular, has become a front line in this struggle. In its 2025 report, released on January 27, the SAB details a surge in Russian sabotage, information operations, and preparations for cyber-attacks targeting industrial control systems (ICS) not just in Latvia but across Western Europe. The scale of the threat is sobering: in 2025, Latvia experienced a full spectrum of cyber-attacks, including intrusion attempts, malware distribution, equipment compromise, and distributed denial-of-service (DDoS) attacks. The overall level of registered cyber threats reached an all-time high, having increased multiple times since Russia’s invasion of Ukraine.

While most incidents were cybercrimes and digital fraud with limited impact on critical infrastructure, the SAB warns that operational technologies (OT)—the systems that monitor and control essential services like energy, water, and transport—are increasingly vulnerable. Many of these systems lack adequate cybersecurity, making them tempting targets for malicious actors. The European Union Agency for Cybersecurity (ENISA) reported that nearly one-fifth of cyber-attacks in Europe were aimed at operational technologies.

Russian hacktivists have demonstrated both the willingness and capability to disrupt Western ICS systems. In April 2025, a Norwegian dam used for fish farming was targeted via a weak password, allowing hackers to increase water pass-through. Although the incident was quickly detected and the consequences were limited, it served as a stark warning. A more serious attack occurred in August, when Russian hacktivists remotely accessed the control systems of the Gdansk hydro-electric power station in Poland, causing a complete shutdown by altering operational parameters.

So far, Latvia has avoided major disruptions to its own critical infrastructure, thanks in large part to proactive monitoring and effective preventive measures. For example, in 2025, vulnerabilities in a municipal service provider’s ICS were identified and addressed before any damage could occur. The SAB credits Latvia’s national Cyber Incident Response Institution (CERT.LV) and a robust, government-funded DDoS defense service operated by the Latvian State Radio and Television Centre (LVRTC) for helping blunt the impact of repeated DDoS attacks, which often coincide with politically significant dates or announcements.

“Year 2025 was also a significant one in the field of cybersecurity,” SAB director Egils Zviedris wrote in the annual report. He highlighted a new regulation adopted by the Cabinet of Ministers in June 2025, which sets minimum cybersecurity requirements for critical infrastructure and bans cooperation with third countries outside the EU and NATO in ICT procurement. “This regulation is part of the legal basis which is being developed to form a cybersecurity framework corresponding to the current security challenges.”

Despite these efforts, the SAB stresses that vigilance is essential. “Significant incidents endangering critical infrastructure and vital services have not been registered,” the report notes, but the agency warns that both public and private sector organizations must systematically improve the cybersecurity of their operational technologies to minimize the risk of future attacks.

With Russia’s strategic focus still fixed on Ukraine and the broader goal of weakening Western cohesion, Latvia finds itself at the crossroads of a new kind of confrontation—one fought not with tanks and missiles, but with disinformation, legal maneuvering, and digital sabotage. As the 2026 parliamentary elections approach, the SAB’s message is clear: deterrence and resilience are more important than ever, and the stakes for Latvian democracy and Western unity could hardly be higher.