Russia-linked disinformation campaigns targeting elections in Estonia and Latvia focused on security fears rather than directly attacking individual candidates, according to a report by threat intelligence company Refute. False stories about NATO deaths, drones, Ukraine and senior political figures were designed to create confusion and weaken trust in public institutions.
The findings offer a detailed look at how election interference can exploit genuine concerns. Instead of inventing entirely separate controversies, the campaigns reportedly attached false claims to real military exercises, earlier drone incidents and ongoing debates about Baltic defence.
What the report found about Baltic election interference
Refute examined information campaigns circulating around Estonia’s September 2026 presidential election and Latvia’s parliamentary vote on 3 October 2026. The company said the narratives targeted voters in both countries while also being distributed internationally.
According to the report, the campaigns sought to undermine confidence in:
- National governments and public institutions
- NATO and Baltic security arrangements
- Ukraine and European support for Kyiv
- Border controls and air-defence capabilities
- The reliability of election-related information
Refute described the activity as a deliberate effort to disorient citizens and deepen existing divisions. The company said false narratives were adapted for different platforms and audiences instead of simply being reposted unchanged.
False NATO deaths video in Latvia
One fabricated video was styled to look like a Euronews report and claimed that a Ukrainian soldier had killed three NATO servicemen during the Baltic Trust 26 military exercise before taking his own life. The alleged incident was falsely linked to the period before Latvia’s vote.
The video circulated from 14 August to 6 September, with accounts carrying it reaching a combined audience of more than 1.85 million, according to Refute. The narrative used the military exercise as an anchor, creating the misleading impression that the event had been disrupted by deaths. In reality, the exercise was scheduled to end as planned.
Latvia’s National Armed Forces rejected the claim as a coordinated disinformation campaign. The denial did not prevent the story from being translated, repackaged and repeated in other online communities. Euronews separately confirmed that it had not produced or published the footage.
Fake websites and fabricated claims in Estonia
In Estonia, a fraudulent website published a fabricated story linking President Alar Karis and Lithuanian President Gitanas Nausėda to Jeffrey Epstein’s trafficking network. The site used the name euobserver.news and was designed to resemble the legitimate Brussels-based publication EUobserver, including copied articles and journalist biographies.
Refute said the story was promoted through an AI-narrated video and more than a dozen social media accounts with a combined following of about 780,000. The case illustrates how impersonating established news organisations can make false material appear more credible, particularly when it is shared by accounts that already have large audiences.
A separate imitation website claimed that a Ukrainian drone had entered Estonian airspace and damaged two Portuguese F-16 aircraft near Ämari Air Base. The alleged damage was valued at approximately €120 million.
That story reportedly drew on real incidents involving drones and Baltic airspace, but falsely attributed major damage in Estonia to Ukrainian activity. Refute said the narrative was intended to cast doubt on Estonia’s air defences, question support for Ukraine and weaken confidence in European security cooperation.
Why real events make false stories harder to detect
The report highlights a recurring feature of modern disinformation: fabricated claims are often built around genuine events. A real military exercise, a real airspace incident or a genuine public disagreement can provide enough context for a false story to seem plausible.
Refute identified eight versions of one video. Some were adapted for Arabic- and Spanish-speaking audiences, while others included AI-generated footage. The company also said that several narratives appeared on multilingual websites, allowing them to remain available and be cited after individual social media posts had been labelled or removed.
This approach creates several challenges during an election:
- Speed: false claims can spread before authorities or journalists verify them.
- Local relevance: stories tied to national security debates may appear more credible to domestic audiences.
- Cross-platform circulation: a video, website article and influencer post can reinforce one another.
- International amplification: translated versions can shape perceptions beyond the country where the election is taking place.
What the campaigns mean for European security
Estonia and Latvia are members of both the European Union and NATO, and both strongly support Ukraine. Their geographic position and proximity to Russia make defence, border security and military readiness central political issues.
That makes the Baltic states especially vulnerable to narratives that exploit fears about escalation or challenge the credibility of allied protection. The report does not suggest that every security concern is fabricated. Instead, it shows how authentic debates can be manipulated by attaching them to invented incidents.
The issue is relevant to wider European affairs because false narratives aimed at Baltic voters can also influence international perceptions of NATO, EU policy and support for Ukraine. Disinformation that begins in one national information environment may quickly reach audiences across Europe and elsewhere.
How voters and institutions can respond
Election authorities, armed forces, journalists and social media platforms each have a role in limiting the impact of fabricated material. Rapid public clarification can help, but the Latvian example also shows that a denial may not stop a claim once it has been translated and redistributed.
Useful safeguards include:
- Checking whether a report appears on the authentic website of the claimed news organisation
- Comparing major security claims with statements from national authorities and verified institutions
- Examining the origin, publication date and editing history of videos
- Treating sensational allegations involving military deaths or senior officials with particular caution
- Avoiding the rapid sharing of material that has not been independently confirmed
European governments and EU institutions have increasingly treated foreign information manipulation as a security and democratic-resilience issue. However, the specific report discussed here attributes the campaigns to Russia-linked activity; it does not establish that every account, website or individual involved was directly controlled by the Russian state.
What happens next
The Refute findings are likely to add to discussions about election security, media impersonation, artificial intelligence and hybrid threats in the Baltic region. Estonia and Latvia will continue to face a combination of conventional security concerns and attempts to influence how those concerns are understood by voters.
For audiences across Europe, the central lesson is straightforward: a story can contain familiar places, real events and convincing visuals while still being false. In the current information environment, verifying the original source is as important as assessing the claim itself.
The wider EU news takeaway: Russia-linked disinformation targeting Baltic elections shows how security narratives can be manipulated to weaken trust in democratic institutions. The most effective response is faster verification, transparent official communication and careful scrutiny of material presented as breaking news.
