Russian-linked disinformation campaigns aimed at voters in Estonia and Latvia have shifted focus from individual candidates to the security issues that shape electoral decisions, according to a new report by the London-based threat intelligence company Refute. The report, published on Tuesday, details how fabricated stories were woven into genuine debates about NATO, drones, and border security to sow confusion and distrust.
“Russia is deploying disinformation as a deliberate instrument designed to disorient citizens, shape public debate and deepen divisions ahead of elections,” said Tom Garnett, co-founder and CEO of Refute. The campaigns were not confined to the Baltics; they also targeted international audiences, seeking to undermine perceptions of Baltic security abroad.
Fake NATO deaths and Epstein links
In Latvia, a fabricated video styled as a Euronews report claimed that a Ukrainian soldier had killed three NATO servicemen during the Baltic Trust 26 military exercise before taking his own life, ahead of the October parliamentary vote. The claim circulated between August 14 and September 6, reaching a combined audience of more than 1.85 million across dozens of accounts, according to the report. The story was anchored to the timing of the exercise, creating the impression that it had been halted over the alleged deaths, when in fact it ended as scheduled.
Latvia’s National Armed Forces quickly denounced the story as a coordinated disinformation campaign, but the denial did not stop its spread. The video was translated into multiple languages, repackaged by influencers, and subsequently discussed in pro-Russian information ecosystems as though the incident had actually occurred. Euronews confirmed it had neither produced nor published the footage.
In Estonia, a fake news site, euobserver.news, published a fabricated story linking outgoing President Alar Karis and Lithuanian President Gitanas Nausėda to Jeffrey Epstein’s trafficking network. The site was designed to resemble the legitimate Brussels-based outlet EUobserver, copying genuine articles and journalists’ biographies. The story was promoted through an AI-narrated video and more than a dozen social media accounts with a combined following of around 780,000.
Drone claims and eroding trust
A separate fake website imitating US defence publication The Defense Post claimed that a Ukrainian drone had entered Estonian airspace and damaged two Portuguese F-16s near Ämari Air Base, costing approximately €120 million. The claim built on genuine incidents involving drones entering Baltic airspace, diverted by Russian electronic warfare, but falsely suggested that Ukrainian activity had caused significant damage on Estonian soil.
The aim, according to the report, was “to erode trust in Ukraine, question Estonian and wider European support for Kyiv, and cast doubt on Estonia’s air defences.” The story circulated in at least seven languages and tapped into ongoing debates over Estonia’s air defences and support for Ukraine.
Refute identified eight versions of one video, including edits tailored to Arabic- and Spanish-speaking audiences and versions incorporating AI-generated footage. Some narratives were subsequently published on websites in multiple languages, giving them a more durable form that could be cited and recirculated even after social media posts were labelled or removed.
“The campaigns that Refute found reflect repeated tactics that represent a step change in how Russia is systemically targeting the information ecosystems in the Baltics and beyond,” said Vlad Galu, co-founder and CTO of Refute.
The report comes as European security concerns remain high, with Germany pledging €1.3bn in aid during a visit to Kyiv and Ukraine exposing Russian fake sites targeting officials and media. The Baltic states, as NATO’s eastern flank, are particularly vulnerable to such influence operations, which aim to weaken public confidence in collective defence and support for Ukraine.
