Perched on the open ramp at the rear of a British Chinook helicopter, Estonian Prime Minister Kaja Kallas flew home from the annual Spring Storm military exercises, pleased to see NATO allies cooperating. But she later said that other types of warfare were on her mind.

Her nation, which borders Russia, has seen a rise in sabotage, electronic warfare and spying — all blamed on Moscow.

As the war in Ukraine turns in Russia’s favor, defenses are being bolstered in the front-line nations of Estonia, Latvia and Lithuania, as well as in Finland and Poland.

Kallas says Russia is carrying out a “shadow war” against the West.

Lithuanian President Gitanas Nauseda urged vigilance, saying Tuesday he had information that “acts of sabotage can happen again.”

Polish Prime Minister Donald Tusk said at least nine people were recently arrested on suspicion of beatings and arson, allegedly directed by Russia’s secret services, and described them as Ukrainian, Belarusian and Polish nationals, some “from the criminal world.”

Not everyone sees the attacks as interconnected, Kallas told The Associated Press, despite NATO’s assertion this month that Moscow is intensifying its campaign against the alliance from the Baltics to Britain. Russia dismissed that allegation.

Because many Russian intelligence operatives already are sanctioned, Western officials and experts say the Kremlin is shifting tactics, hiring others for hybrid operations — nonmilitary strategies including cyberattacks, election interference and disinformation, and attacks on foes of President Vladimir Putin.

With crucial elections in the West, officials say they believe the tempo of such activities will only increase, and some want tougher countermeasures.

Kallas cited a warning from an intelligence agency to a European country that one of its warehouses was targeted by Russian military intelligence. When a fire occurred at the warehouse two weeks later, officials in the country suggested that “we don’t know it is the Russians,” she said. Kallas did not identify the country.

The West must have a “serious discussion of a coordinated approach," she said. “How far do we let them go on our soil?”

Estonia has taken the challenge of finding Russian agents of influence “very seriously” since regaining independence from the USSR in 1991, rebuilding its security services from scratch, U.S. Ambassador George Kent told AP.

This year in Estonia, a university professor was arrested on charges of spying for Moscow, 13 people were arrested over attacks allegedly organized by Russian military intelligence operating under diplomatic cover, and flights between Finland and the city of Tartu were disrupted by Russian jamming of GPS signals.

In October, a Baltic Sea gas pipeline and telecoms cables were damaged after a Chinese ship dragged its anchor for over 115 miles (185 kilometers) in an incident that is still under investigation. That ship was later seen in a Russian port.

Britain expelled Russia’s defense attache in May after two British men were accused of working with Russian intelligence services to set fire to a London warehouse. In April, two German-Russian nationals were arrested and accused of trying to attack military sites in southern Germany.

“What I would like to see is the recognition that these are not isolated events," Kallas told AP. "Second, that we share information about this amongst ourselves. Third, make it as public as we can.”

Estonia has a reputation for aggressively pursuing espionage activity and publicizing it, consistently seizing more Russian agents per capita in the country of 1.3 million than other European nations.

It is “not very plausible” that there’s such a large pool of agents in Estonia that makes them easier to catch, said Kusti Salm, permanent secretary at Estonia’s Defense Ministry, in an interview with AP, implying that other countries could work harder at it.

Former Estonian President Toomas Hendrik Ilves, in office from 2006-16, told AP that some nations don’t act because they hope to do business with Russia again.

“People are afraid of decisive action, and the absence of decisive action basically tempts bad actors to keep pushing their luck," added Ilves, who dealt with a major cyber attack blamed on Russia in 2007.

Russian officials, he said, “will push their luck until something bad happens, but they won’t pay the consequence. We will.”

That could lead to unintended deaths and injuries, Estonian officials and security experts say, citing a trend of Russia is outsourcing attacks to locals, sometimes recruited relatively cheaply on video gaming platforms and social media. That makes it harder to identify connections between attacks or to trace them back to Russia.

Bulgarian investigative journalist Christo Grozev, who exposed Russian intelligence involvement in poisoning former spy Sergei Skripal in 2018 in Britain and the late opposition leader Alexei Navalny in 2020, was a victim of such outsourcing.

A former Austrian intelligence officer was arrested in March for supplying Grozev’s address to Russian intelligence, which allegedly hired burglars to break into the journalist’s apartment in 2022 to steal a laptop connected to the Navalny investigation. Grozev had to move from Vienna last year after authorities said they couldn’t guarantee his security.

Grozev said his son was in his room playing computer games when the 2022 break-in occurred, adding: "Imagine if he had walked out.”

He and other journalists discovered links between an attack on a Russian opposition figure in Argentina last year and a Polish organized crime cell. When the information was passed to Polish authorities, they found a connection between the Argentina attack and one on Russian opposition figure Leonid Volkov in Lithuania in March. Lithuania’s security service said that attack was probably Russian-organized.

Grozev said nations need to enforce intelligence sharing between their own security services and police and prosecutors and create a “proactive international working task force” to combat foreign influence operations.

Although Russia has been blamed for attacks in Europe for decades, Estonian officials and security experts indicated there’s no collective mechanism for dealing with them, and suggested the EU do more.

Kallas says Russia uses spies in the guise of diplomats “all the time,” and senior Estonian officials support a Czech initiative limiting visas for Russian envoys to the country where they are posted.

That would make it harder for them to travel in the EU, where IDs aren’t needed at the border. It also could reduce the possibility of one nation expelling spies, only to see them return to another and continue working under diplomatic cover.

Estonia also is pushing for separate sanctions within the EU to counter hybrid threats. Although many Russian intelligence agents already are sanctioned, these could dissuade some “intermediaries” – local organized crime figures, disillusioned youth and potential spies and collaborators – from working for Moscow, said Jonatan Vseviov, secretary general of Estonia’s Foreign Ministry.

While some countries feel such exposure could cause instability and erode trust, Grozev called it an important deterrent.

Russian intelligence agents running operations abroad are “extremely averse” to incidents where they are named and shamed, Grozev said. Such individuals can be denied promotion, and proxies will realize they cannot be guaranteed immunity, he said.

The threat of sanctions and reduced opportunities for travel and study abroad can also help discourage younger Russians from joining security services.

Russia seeks “to sow fear” and break Western support for Kyiv, Kallas said.

Vseviov said Putin wants to use every tool available, including the shadowy attacks, to “undermine our unity, collapse our policy and destroy the collective West, as we know it, as a functioning body."