Russia is running a coordinated hybrid campaign against the Baltic states, combining cyberattacks, manufactured disinformation, and a separatist provocation modelled on the Donbas playbook.
The pressure on NATO’s eastern flank has intensified sharply in recent weeks. As Ukraine escalates its long-range drone strikes on Russian infrastructure along the Baltic Sea coast, Moscow has responded not only militarily but also informationally, deploying a layered hybrid operation targeting Latvia, Lithuania, and Estonia simultaneously across multiple fronts.
The campaign blends fabricated narratives about Baltic involvement in Ukrainian attacks, a separatist provocation in Estonia’s Russian-speaking border city of Narva, sustained cyberattacks, and a proxy media network amplifying Kremlin narratives across Europe. Baltic governments and security services say the pattern is familiar — but the current intensity is not.
The Drone Disinformation Campaign
The most active front of Russia’s current information operation centres on the false claim that the Baltic states opened their airspace to Ukrainian drones targeting Russian infrastructure. Latvia’s Ministry of Defence confirmed the campaign involves coordinated disinformation spread through Russian media outlets and Telegram channels, using social media bots and targeted messaging aimed specifically at Russian-speaking communities and younger audiences.
The pretext arrived on March 25, when two Ukrainian drones strayed into Latvian and Estonian airspace during one of Kyiv’s largest mass drone strikes on Russia, hitting oil terminals in Ust-Luga and a military icebreaker in Vyborg. Russia immediately seized on the incidents — despite the fact that electronic warfare jamming and GPS spoofing routinely cause drones to veer off course, and despite the fact that Russian drones have previously strayed into Moldova and Romania under identical circumstances.
On April 10, the foreign ministers of Estonia, Latvia, and Lithuania issued a joint statement rejecting the campaign as “completely baseless”. “The Baltic states have never allowed their territories and airspace to be used for drone attacks against targets in Russia,” they stated.
“Notwithstanding the official reaction, Russia has continued lying.” Latvia’s defence ministry was equally direct, stating that through such claims “Russia demonstrates its weakness and attempts to divert attention from the fact that it is unable to defend itself against successful Ukrainian counterattacks targeting Russian infrastructure along the Baltic Sea coast.”
Zakharova’s Threats and the Escalation of Tone
Russia’s Foreign Ministry spokesperson Maria Zakharova moved the campaign from disinformation into open intimidation on April 6. “The Baltic states have received an appropriate warning,” she told reporters in Moscow. “If the regimes of these countries have enough sense, they will listen. If not, they will have to deal with a response.” No specific action was named.
The European Commission said Brussels was monitoring the situation closely. “An attack on one of our member states is an attack on the European Union as a whole,” Commission spokesperson Thomas Regnier said — while noting that for now “these are threats” and that member states hold “the first competence” to respond.
The “Narva People’s Republic” — A Donbas Script Revisited
Running parallel to the airspace narrative is a longer-running separatist provocation targeting Estonia’s Russian-speaking border city of Narva. As Insight News has previously reported, anonymous Telegram, TikTok, and VKontakte accounts have been promoting the concept of a “Narva People’s Republic” — complete with fabricated maps, separatist symbols, and calls for armed struggle — using rhetoric almost identical to that deployed in Donbas in 2014.
The most prominent Telegram channel, “Narva Republic”, was created in July 2025 but significantly increased activity in February 2026, according to Propastop, Estonia’s counter-propaganda organisation. A journalistic investigation by Estonian newspaper Postimees infiltrated the group and found it to be a small operation run from outside Estonia with apparent ties to St. Petersburg – with only 60–70 subscribers at the time of exposure, yet generating coverage in Germany’s Bild and across international media.
This dynamic illustrates what analysts at the Centre for European Policy Analysis describe as the “amplification paradox”: a marginal hostile signal enters the public sphere, defensive actors expose it, and Russian media then recode the reaction as a new story – that Estonia is panicking, repressive, and secretly knows it has a problem. TASS exemplified this dynamic directly, mocking Estonian security services for being “frightened by a social media community with memes”.
Cyberattacks: The Digital Dimension
The information operations are reinforced by a sustained cyber campaign. According to a Lithuanian security report cited by the Cyber Express, Russian influence operations targeting the Baltic states and Poland have been escalating in aggressiveness and sophistication since the onset of Russia’s full-scale invasion of Ukraine.
The hacker group NoName057 has executed DDoS attacks across Lithuanian defence, roads, logistics, telecommunications, and mobile operator websites. A July 2023 attack on the Lithuanian government exposed sensitive NATO summit security information. Sputnik has simultaneously begun broadcasting radio signals from Kaliningrad directly into Lithuanian cities – bypassing EU sanctions by exploiting the physical proximity of the Russian exclave. Latvia’s security services confirmed in January that cyberattacks and sabotage linked to Russia remain a significant ongoing threat, with officials warning that Moscow’s perception of Latvia increasingly resembles how Russia viewed Ukraine before the 2022 invasion.
The Recruitment and Proxy Infrastructure
Behind the messaging sits a recruitment and financing network. According to Lithuanian broadcaster LRT, Russian intelligence services have been recruiting Latvian residents through Telegram and during trips to Russia, targeting low-income individuals and young people with financial incentives and direct instructions on what content to produce.
Videographer Oleg Besedin was arrested in Estonia in November after years of producing Kremlin-aligned content in cooperation with contacts in Russia. In Latvia, pro-Kremlin activist Aleksandrs Gaponenko — who argued publicly that Moscow would need to prepare “ideological groundwork” for a potential “humanitarian intervention in the Baltic states” — now faces criminal charges of assisting a foreign state. The BaltNews network, connected to Rossiya Segodnya and Sputnik, has already seen its former editor convicted in Latvia for sanctions violations.
Inside the Narrative Machine: Russian State Media and Pro-Kremlin Proxies
A monitoring of Russian state media and pro-Kremlin proxy outlets reveals a coordinated set of narratives targeting the Baltic states, timed to coincide with Ukraine’s intensified strikes on Russian Baltic Sea infrastructure.
TASS has been among the most aggressive actors in the current cycle. On April 1, the outlet published expert commentary framing the Baltic states as covert participants in Ukrainian strikes: “It is unlikely that the Latvians, Lithuanians, or Estonians themselves would dare to launch air strikes against Russia from their territory — they are using Ukraine for this purpose.” By April 14, presidential aide Nikolai Patrushev had escalated the framing entirely: “The provision of airspace by the Baltic states and Finland for the passage of combat UAVs means direct participation of the NATO member states in attacks on Russian territory and infrastructure. With all the conclusions and consequences. “ Two days later, TASS published the street address of Terminal Autonomy in Riga as part of a Russian Defence Ministry list of European companies allegedly producing drones for Ukraine — the most operationally specific detail to appear across any outlet’s coverage.
- https://tass.com/world/2110003
- https://tass.com/politics/2116233
- https://tass.com/politics/2117655
RIA Novosti has been running a parallel economic destabilisation narrative. A January 2026 piece titled “It came at a high cost: how the Baltics are experiencing the break with Russia” portrayed the region as sliding toward collapse, citing a Financial University economist’s claim that “the probability of a collapse of the Baltic economies is far from zero”. An earlier piece framed Baltic military acquisitions as a direct threat: “Armed-to-the-teeth Latvians, Lithuanians, Estonians and Finns will become a serious enough threat even without their senior comrades. At least because they have missiles that can reach St Petersburg.”
- https://ria.ru/20260120/pribaltika-2068809320.html
- https://ria.ru/20250228/pribaltika-2002004390.html
RT has amplified both the economic and cultural dimensions of the campaign. In November 2025, it ran “Baltic nations want EU bailout after Russia sanctions backfire”, claiming “tourism and investment have slumped across Estonia, Latvia, and Lithuania, while cross-border trade has largely collapsed.” A separate April 2026 piece tied into the drone production narrative, warning that European countries hosting Ukrainian UAV manufacturing facilities risked “unpredictable consequences”. All three state outlets have consistently pushed a minority rights narrative, repeatedly covering the case of Latvian MP Aleksey Roslikov, expelled from parliament for speaking Russian. RT’s framing was typical: “What is next? A law prohibiting Russian names for children because they sound Russian?” The near-identical framing of the Roslikov case across RT, RIA Novosti, and TASS — using virtually the same quotes — is consistent with coordinated messaging.
- https://www.rt.com/news/628532-baltic-states-eu-bailout/
- https://www.rt.com/russia/638431-europe-manufacturing-ukrainian-drones/
- https://www.rt.com/russia/618723-latvia-eu-language-medvedev/
NarvaNews.eu occupies a uniquely strategic role among proxy outlets. Presenting itself as a neutral local news source for Estonia’s Russian-speaking population, the outlet is in reality a key node in the Kremlin’s Baltic information ecosystem — with investigative findings showing that 83% of its visitors are based in Russia, and only 11% in Estonia. Stories from NarvaNews are regularly cited by RT and Vladimir Solovyov’s Telegram channel, which present it as a “local Estonian source” to lend legitimacy to anti-Estonian narratives.
The outlet’s most striking recent content came on April 13, 2026, when it published commentary from retired Russian Colonel Viktor Baranets framing Ukrainian drone strikes as a NATO trap: “Drones will keep coming from the direction of the Baltic states. Why? They are aggressively provoking a Russian response. Now, consider this: what if we strike the Baltic countries from which these Ukrainian drones are launched? Those are NATO members. The tragedy of the moment is that they are waiting for Russia to hit the Baltics with everything we’ve got, barring nuclear weapons.” The article framed the entire drone incident not as a navigation error but as a deliberate Western provocation designed to trigger Article 5.
- https://en.narvanews.com/news/expert_explains_why_russia_isn_t_intercepting_ukrainian_drones_over_the_baltic_states/2026-04-13-91
NarvaNews has also worked to amplify existing fault lines within Estonian society. A February 2026 piece gave prominent coverage to Narva City Council Chairman Mihhail Stalnuhhin, who called Vladimir Putin “luck for Russia” and questioned internationally established facts about the Bucha massacre: “I would like to find out what really happened there… I listen to different sources – the first, second, third, and fourth.” The outlet presented his views as representative of the Russian-speaking minority’s perspective.
- https://en.narvanews.com/news/bucha_putin_and_heating_mihhail_stalnuhhin_39_s_interview_brings_narva_39_s_hidden_rift_to_the_surface/2026-02-23-89
The outlet’s minority rights coverage has been equally calculated. Articles on Latvia “liquidating” Russian-language radio, Estonian hospitals “firing” Russian-speaking medics, and residence permit tightening frame routine security and language policy measures as systematic persecution — using language designed to generate fear among Russian-speaking residents. “What is happening in Latvia is a clear example of how humanitarian values — the right to information and language — are sacrificed for geopolitical expediency,” one piece concluded.
- https://en.narvanews.com/news/latvia_enters_final_stage_of_liquidating_russian_language_radio_what_does_this_mean_for_listeners/2026-02-21-68
- https://en.narvanews.com/news/49_medics_fired_latvian_hospitals_continue_dismissing_russian_and_belarusian_citizens/2026-02-06-44
Estonia’s Internal Security Service has confirmed that the “Narva Republic” Telegram channel shares identical framing with NarvaNews on all key narratives, including the misrepresentation of Estonian Foreign Minister Margus Tsahkna’s statements about defence strategy, which both outlets presented as a threat of pre-emptive invasion rather than defensive retaliation.
The timing coordination across outlets is consistent and visible. The November 2025 coverage of the Baltic and Nordic $500 million PURL weapons pledge appeared across RT, RIA Novosti, and TASS within a 48-hour window. The April 2026 drone production stories ran across the same three outlets within days of each other. NarvaNews articles on Estonian defence rhetoric in February 2026 coincided within 24–48 hours with public statements from Maria Zakharova, Russian Duma deputies, and war correspondents – a synchronisation pattern consistent with coordinated messaging rather than independent reporting.
A Layered Operation
Taken together, the drone disinformation campaign, the Narva separatist provocation, the cyberattacks, and the proxy amplification network form a recognisable and escalating pattern. What distinguishes the current moment is the simultaneity of pressure across multiple vectors, timed to a period of divided Western attention and intensified Ukrainian strikes on Russian Baltic Sea infrastructure.
“The emergence of a ‘People’s Republic of Narva’ narrative lays the groundwork for later claims of oppression and calls for ‘protection’ from Moscow,” political scientist Nico Lange wrote on X. The same logic applies to the airspace narrative: manufactured claims of Baltic involvement in attacks on Russia construct a pretext — even if no one currently intends to use it. For now, the Baltic states are responding with joint statements, criminal prosecutions, and public exposure. Whether that is sufficient depends, in part, on whether Western attention remains fixed on NATO’s most exposed flank.
