Headline: Microsoft report outlines Russian cyber-influence attempt in Latvia, Lithuania, Poland
Short Summary: Russian actors led a coordinated cyber-influence campaign targeting Latvia, Lithuania, and Poland, spreading disinformation about repatriation and conscription via email and fake documents, according to a Microsoft report.
Description and Notes
A Microsoft report identified a Russian-backed campaign distributing disinformation and inauthentic documents to spread narratives about forced conscription and repatriation of Ukrainian citizens in Latvia, Lithuania, and Poland. The campaign, which intensified around mid-January 2023, targeted governments, refugees, and diaspora populations in these NATO member states.
Notes: 3 Countries
Evidence
Media
"A new report from Microsoft on the state of worldwide nefarious cyber activity unsurprisingly names Russia as a major criminal player, and includes evidence of some of its specific activities in Latvi...""A new report from Microsoft on the state of worldwide nefarious cyber activity unsurprisingly names Russia as a major criminal player, and includes evidence of some of its specific activities in Latvia, Lithuania and Poland."
""The campaign, which was first observed around end-January 2023, leveraged email dissemination and inauthentic documents to spread a narrative that government officials may seek forced repatriation / ..."""The campaign, which was first observed around end-January 2023, leveraged email dissemination and inauthentic documents to spread a narrative that government officials may seek forced repatriation / mobilization or conscript European citizens for the war in Ukraine. Populations in NATO member countries such as Poland, Latvia, and Lithuania were the primary targets.""
"Pro-Russian influence operators have specifically aimed to disrupt Western military support to Ukraine by encouraging purported military-eligible Ukrainians to seek asylum and attempt assistance."
""The campaign, which was first observed around mid-January 2023, leveraged email dissemination and inauthentic documents to spread a narrative that government officials may seek forced repatriation of..."""The campaign, which was first observed around mid-January 2023, leveraged email dissemination and inauthentic documents to spread a narrative that government officials may seek forced repatriation of Ukrainian or conscript European citizens for the war in Ukraine. Populations in NATO member countries Poland, Latvia, and Lithuania were the primary targets.""
""Russia affiliated threat groups engaging in influence campaigns continue to try to sow distrust between European countries using social networks, cyber-enabled operations, and online content.""
""Pro-Russian influence operators have specifically aimed to disrupt Western unity by attempting to turn Latvia by encouraging support for Ukraine among Latvian officials, and highlighting the costs an..."""Pro-Russian influence operators have specifically aimed to disrupt Western unity by attempting to turn Latvia by encouraging support for Ukraine among Latvian officials, and highlighting the costs and risks of military assistance," says report."
"The campaign, which was first observed around mid-January 2023, leveraged email dissemination and inauthentic documents to spread a narrative that government officials may seek forced repatriation of ...""The campaign, which was first observed around mid-January 2023, leveraged email dissemination and inauthentic documents to spread a narrative that government officials may seek forced repatriation of Ukrainians or conscript European citizens for the war in Ukraine. Populations in NATO member states Poland, Latvia, and Lithuania were the primary targets."
"Microsoft says it has observed instances of convergence between Russia-affiliated cyber operations, and pro-Russian hacktivist attacks in Ukraine that primarily seem to obscure Russian state involveme...""Microsoft says it has observed instances of convergence between Russia-affiliated cyber operations, and pro-Russian hacktivist attacks in Ukraine that primarily seem to obscure Russian state involvement."
"Pro-Russian influence operators have specifically aimed to disrupt Western military support to Ukraine by encouraging populations in Latvia and Poland to demonstrate against military assistance."
{
"border_violation_countries": [
"LV",
"LT",
"PL",
"Air"
],
"category": "Uncategorized",
"confidence": "Low",
"confidence_rationale": "Multiple direct quotes from Microsoft's public Digital Defense Report and the Latvian national media confirm the activity, involved actors, and countries targeted. The link to a major official source increases reliability.",
"countries": [
"Latvia",
"Lithuania",
"Poland",
"Russia"
],
"country": "Latvia",
"defense_prep": {
"links": [
"https://www.microsoft.com/en-us/security/security-insider/microsoft-digital-defense-report-2023"
],
"title": "Microsoft report outlines ??Russian cyber-influence attempt in ??????Latvia, Lithuania, Poland"
},
"description": "A Microsoft report identified a Russian-backed campaign distributing disinformation and inauthentic documents to spread narratives about forced conscription and repatriation of Ukrainian citizens in Latvia, Lithuania, and Poland. The campaign, which intensified around mid-January 2023, targeted governments, refugees, and diaspora populations in these NATO member states.",
"event_time_utc": "2023-10-12T12:00:00Z",
"evidence": [
"Report explicitly links Russia-aligned activity to specific operations targeting Latvia, Lithuania, Poland.",
"Details dissemination of forged/fake documents both online and offline.",
"References coordinated campaigns observed since early 2023 aimed at disrupting Western support for Ukraine.",
"Microsoft's 2023 report cites multiple instances of cyber-influence and disinformation targeting Latvia, Lithuania, and Poland.",
"Identified tactics included dissemination of inauthentic documents and narratives intended to undermine solidarity with Ukraine.",
"Microsoft asserts observed overlap between Russian state-linked cyber operations and such influence campaigns.",
"Microsoft report attributes a disinformation campaign to Russian actors, aimed at creating narratives about forced repatriation and conscription.",
"Operations involved distribution of inauthentic documents and leveraged cyber influence tactics.",
"Targeted Baltic and Polish NATO member states, with both digital and in-person influence efforts."
],
"evidence_quotes": [
"A new report from Microsoft on the state of worldwide nefarious cyber activity unsurprisingly names Russia as a major criminal player, and includes evidence of some of its specific activities in Latvia, Lithuania and Poland.",
"\"The campaign, which was first observed around end-January 2023, leveraged email dissemination and inauthentic documents to spread a narrative that government officials may seek forced repatriation / mobilization or conscript European citizens for the war in Ukraine. Populations in NATO member countries such as Poland, Latvia, and Lithuania were the primary targets.\"",
"Pro-Russian influence operators have specifically aimed to disrupt Western military support to Ukraine by encouraging purported military-eligible Ukrainians to seek asylum and attempt assistance.",
"\"The campaign, which was first observed around mid-January 2023, leveraged email dissemination and inauthentic documents to spread a narrative that government officials may seek forced repatriation of Ukrainian or conscript European citizens for the war in Ukraine. Populations in NATO member countries Poland, Latvia, and Lithuania were the primary targets.\"",
"\"Russia affiliated threat groups engaging in influence campaigns continue to try to sow distrust between European countries using social networks, cyber-enabled operations, and online content.\"",
"\"Pro-Russian influence operators have specifically aimed to disrupt Western unity by attempting to turn Latvia by encouraging support for Ukraine among Latvian officials, and highlighting the costs and risks of military assistance,\" says report.",
"The campaign, which was first observed around mid-January 2023, leveraged email dissemination and inauthentic documents to spread a narrative that government officials may seek forced repatriation of Ukrainians or conscript European citizens for the war in Ukraine. Populations in NATO member states Poland, Latvia, and Lithuania were the primary targets.",
"Microsoft says it has observed instances of convergence between Russia-affiliated cyber operations, and pro-Russian hacktivist attacks in Ukraine that primarily seem to obscure Russian state involvement.",
"Pro-Russian influence operators have specifically aimed to disrupt Western military support to Ukraine by encouraging populations in Latvia and Poland to demonstrate against military assistance."
],
"evidence_urls": [
"https://www.microsoft.com/en-us/security/security-insider/microsoft-digital-defense-report-2023",
"https://eng.lsm.lv/article/society/defense/12.10.2023-microsoft-report-outlines-russian-cyber-influence-attempt-in-latvia-lithuania-poland.a527556/"
],
"extra": {
"extra": {
"extra": {
"extra": {
"evidence": [
"Report explicitly links Russia-aligned activity to specific operations targeting Latvia, Lithuania, Poland.",
"Details dissemination of forged/fake documents both online and offline.",
"References coordinated campaigns observed since early 2023 aimed at disrupting Western support for Ukraine."
]
}
}
}
},
"follow_up_by_country": [],
"headline": "Microsoft report outlines Russian cyber-influence attempt in Latvia, Lithuania, Poland",
"location_text": "Latvia, Lithuania, Poland",
"media_assets": [
{
"captured_at": "2025-11-23T15:53:14.914905Z",
"description": "Screenshot capture",
"hash": "05422b651a5c037bc5f1561f9965617d597bca1153759a1627c746054a35e487",
"mime": "image/jpeg",
"origin": "restore",
"size_bytes": 2667153,
"source_url": null,
"type": "screenshot",
"url": "/media/event_8_1763913194_d6d6c9c0.jpg"
}
],
"notes": "3 Countries",
"primary_ref_links": [
"https://www.microsoft.com/en-us/security/security-insider/microsoft-digital-defense-report-2023"
],
"schema_version": "v1",
"screenshot_count": 1,
"sources": [
"https://eng.lsm.lv/article/society/defense/12.10.2023-microsoft-report-outlines-russian-cyber-influence-attempt-in-latvia-lithuania-poland.a527556/",
"https://www.microsoft.com/en-us/security/security-insider/microsoft-digital-defense-report-2023"
],
"summary_short": "Russian actors led a coordinated cyber-influence campaign targeting Latvia, Lithuania, and Poland, spreading disinformation about repatriation and conscription via email and fake documents, according to a Microsoft report.",
"url": "https://eng.lsm.lv/article/society/defense/12.10.2023-microsoft-report-outlines-russian-cyber-influence-attempt-in-latvia-lithuania-poland.a527556/"
}
Payload is too large for diff rendering (>50KB). Showing raw JSON instead.
Re-enrichment
Re-enrich
Enrichment-only: keeps existing processed data, screenshots, and media. Re-runs only the enrichment step (AI extraction) without refetching the source or regenerating screenshots. Use this if enrichment failed or you need updated AI-extracted data.
Destructive Actions
Delete Event
⚠️ Warning: This permanently removes the event and its history. This action cannot be undone.
