Estonia Detained Record Number of Russian Intelligence Collaborators in 2025

The Estonian Internal Security Service caught 16 people working with Russian intelligence last year, the highest number since the agency began tracking such cases, as Moscow increasingly turns to social media and one-off recruits to compensate for its shrinking operational footprint in the country.

Estonia’s Internal Security Service (ISS/KAPO) published its annual review on April 13, revealing that 16 individuals linked to Russian special services — both the FSB and GRU — were apprehended in 2025. The figure marks a record for the agency and reflects what officials describe as sustained and intensifying pressure from Russian intelligence to find new ways to operate inside Estonian territory.

Margo Palloson, director general of the Internal Security Service, presented the findings at a press conference in Tallinn. “Pressure to recruit agents remained consistently high last year,” he said. “Since the beginning of last year, we have apprehended and thwarted the activities of 16 collaborators of Russian special services. The vast majority were ordinary people who did not work in government institutions and did not have access to sensitive information.” Palloson added that in all 16 cases, the collaborators’ activities were disrupted at an early stage and that they “were not able to cause significant harm to Estonia’s security”, as ERR News reported.

New Tactics, Same Goal

ISS/KAPO spokesperson Marta Tuul outlined a significant shift in how Russian intelligence services are now operating. Since Russian services cannot work directly on Estonian soil, they are increasingly seeking what Tuul described as “easier agents” — individuals willing to carry out isolated tasks rather than serve as long-term embedded operatives. “They are seeking so-called easier agents who would carry out certain tasks on their behalf. But this record year shows that they are not succeeding. Our officials are very capable and catch them fairly quickly, so there is no need for concern at all,” she said, according to ERR News.

Social media has become a central recruitment tool. Tuul explained that Russian services are using online platforms to identify and approach individuals willing to carry out one-off acts, including vandalism targeting Estonian memorial sites. “On social media, they try to find one-off agents who would carry out acts of vandalism, for example, to destroy or deface the Blue Hills memorials or do other things,” she said. The Blue Hills — Sinimäed in Estonian — are a significant national memorial marking fierce Estonian resistance against Soviet forces in 1944.

Tuul also highlighted the risks posed by travel to Russia. Border crossing points have become active recruitment zones, with Russian operatives profiling and screening travellers on site. “Visiting Russia poses a significant risk, as there are operatives at the borders who profile and screen people on site and may already make recruitment approaches at border crossing points,” she said.

From Broadcast to Social: Russia’s Shrinking Influence Toolbox

The record number of apprehensions comes against the backdrop of a broader degradation of Russia’s traditional influence infrastructure in Estonia. According to the KAPO annual review, sanctions imposed following Russia’s full-scale invasion of Ukraine have“curtailed” Moscow’s “hostile activities”, including the spread of propaganda through established media channels. Several Russian-linked outlets operating in Estonia, including Sputnik and Baltnews, have been shut down in recent years, forcing a strategic shift toward social media as the primary vehicle for influence operations.

That shift has come with its own limitations. Tuul noted that attempts to spread false narratives through social platforms, including fabricated bomb threats against schools and claims of a planned attack on the border city of Narva, have found no traction among the Estonian public. “There is absolutely no real support or following for this in Estonia. They may try, but there is no basis or real substance to it,” she said.

The picture that emerges from the 2025 review is of a Russian intelligence apparatus that is persistent but increasingly constrained – adapting its methods in response to closed channels but failing to compensate for the loss of its more established tools. The record number of detentions, Estonian officials suggest, reflects not a more dangerous environment but a more effective one: Russian services are trying harder and being caught faster.