On Christmas Day last year, Finland and Estonia got an unwanted shock.
A power line that ran along the seabed between the two countries was damaged, slashing electricity flow by?two thirds.
The next day, Finnish police boarded and seized a ship carrying Russian oil bound for Turkey on suspicion of cutting the line along with four nearby internet cables.
The Cook Islands-registered ship, named the Eagle S, was later found to have dragged its anchor along the ocean floor for more than 100 kilometres.
European Union leaders labelled it sabotage and levelled blame at Russia's so-called "shadow fleet" or "ghost ships" which Moscow uses to avoid Western sanctions imposed on its cargo exports.
The incident has sprung NATO allies into action, with joint forces from 11 member nations signing up to tackle sabotage at sea.
The ABC gained rare access to the mission and headed out with Dutch and Belgian crews on the Baltic Sea off the coast of Lithuania — a former Soviet country that is now a key Western ally.
Taking off from London before dawn, it took two flights and all day to reach the small port city of Klaipeda where we met the convoy.
Undersea cables are a vital part of global infrastructure, carrying electricity and data between countries and continents. There are hundreds of them around the world.
Commander Erik Kockx has been charged with overseeing this operation in the Baltic Sea.
"There have been some incidents with pipelines and cables. We are here to prevent that from happening again," he told the ABC.
"The consequences of cutting an underwater sea cable, first of all, it's very expensive to repair it, secondly if it's an energy or data cable, you cut people off from energy or information."
Since Russian President Vladimir Putin ordered his country's full-scale invasion of Ukraine in February 2022, Finland and Sweden joined NATO, making Russia the only country bordering the Baltic Sea without membership of the security alliance.
Since then, multiple cables have been cut or damaged.
"Anybody who has any intentions of inflicting damage or harm to any infrastructure in the Baltic Sea region should be aware that it will be observed, it will be monitored, it will be reported, and it will not remain without consequence," Commander Kockx said.
Russia's second-largest city and port of St Petersburg is the country's main access point to the Baltic Sea's critical shipping corridor.
Further south and wedged between Lithuania and Poland, is the Russian exclave of Kaliningrad, which also hosts strategic port capacity but more crucially is home to a large military build-up of Kremlin forces.
The NATO missions are designed to be a deterrent, with a bigger military presence on the surface and eyes underwater inspecting for sabotage.
Small underwater drones, remotely operated vehicles and divers are being sent down to build a map of the seabed.
Merte Peeters is the commanding officer of the Dutch ship, the Snellius, which is the lead vessel in the mission.
"I think it's a two-legged solution, one we show people who basically aren't paying attention sailing around the Baltic, hey someone's looking at you, you are being noticed," he said.
"And to the other countries in the vicinity you show that we are present."
Most of the accusations of sabotage involve a ship dragging its anchor along the seabed for long distances, in some cases hundreds of kilometres.
Two lines were severed within 24 hours of each other in the month before the Christmas Day incident.
The Arelion cable between the Swedish island of Gotland and Lithuania was severed and then the C-Lion 1 cable was damaged between the Finnish capital, Helsinki, and the German port of Rostock.
A Chinese ship, the Yi Peng 3, is suspected of dragging its anchor over both the cables in a separate act of Russian sabotage.
In October 2023, another Chinese ship, the Newnew Polar Bear, was identified as the main suspect for rupturing a gas pipeline between Finland and Estonia.
The Chinese government admitted the ship was at fault but rejected the suggestion it was intentional.
"If I would drop my anchor for this vessel, I would notice, of course," Commanding Officer Peeters said.
The Yi Peng 3 and the Eagle S are both suspected Russian ghost ships which have become a pivotal tool in Moscow continuing oil exports in defiance of Western sanctions.
By mid-2024, this clandestine armada was responsible for shipping more than 70 per cent of Russia's oil and its by-products.
The European Union last month slapped more sanctions on the covert ships and increased the number of banned vessels to 342, although some experts predict the fleet consists of more than 700.
Continuing oil exports through undercover means has been critical to keeping Russia's economy afloat and funding its war efforts in Ukraine.
Some estimates predict Moscow has spent more than $15 billion building up the fleet, which are often old and rundown ships, which sail without insurance and flags, allowing them to evade detection and sanctions.
They also "go dark" by disabling their tracking transponders, making it difficult for authorities to follow their movements.
The Kremlin has repeatedly denied the use of shadow ships and rejected claims it was responsible for damaging undersea cables in the Baltic.
With investigations ongoing, NATO isn't keen to point fingers or inflame tensions but some countries in the region including Estonia, Finland and Germany, have blamed Russia's shadow fleet.
But what started as covert shipments to prop up an ailing economy has morphed into a so-called "hybrid war" or "shadow conflict", which are actions taken to destabilise democracies and cause chaos and fear.
On another vessel in the NATO mission, Commanding Officer of Belgian ship, Lobelia, Gill Priem tells the ABC his crew have adapted to battle this new type of conflict.
"NATO has to adapt to the evolving geopolitical situation in the world," he said.
"Since the increased presence of NATO in this region ... we did not have any accidents occurring in this particular region."
The alleged acts of sabotage fall short of all-out military action but force countries to react and beef up security measures.
While the mission until now has been focused on protecting the hundreds of kilometres of critical cables crisscrossing the seabed, Russia last month upped the stakes.
When a suspected Russian shadow ship, named the Jaguar, and under sanction by British authorities, entered Estonian waters, the navy attempted to stop it.
The crew on board refused and then the Estonian warship was then met with a Russian fighter jet, which flew into NATO airspace for close to a minute.
"They entered the NATO airspace, this is serious," Lithuania's Foreign Minister Kestutis Budrys told the ABC.
"They escalated in the military way, from now on, we cannot say that it is civilian activities.
"They were showing their intent to use this force."
It was the first time Russia has shown support for an alleged shadow ship.
"This reckless use of hundreds of vessels for the purpose to fuel the war machine of Russia, it put us in an explosive mix, and we have to control all of it," he said.
"We see how one authoritarian regime wants to avoid the sanctions and is just exploiting all the weak parts of it."
The minister, who's been highly critical of the West's response to Russian aggression, has no doubt of? Moscow's intentions in the region.
"Russia is preparing itself for long-term confrontation and conflict with the West," he said.
"If we are weak, if we are not resilient and if we are not resolute, it means we are increasing the opportunities for Russia to use the capabilities for their intent."
Intent and sabotage combined make an explosive mix which is sparking fears of a broader European conflict.
