Estonian presidential security advisor Madis Roll was targeted by Russian pranksters in a phishing call in May 2023. No sensitive info was leaked. Russian propaganda misrepresented the event as a leak to spread disinformation.

Intelligence & EspionageHuman Intelligence (HUMINT)Recruitment of locals

Aggressor

Summary

In May 2023, Madis Roll, presidential security advisor of Estonia, received a phishing call from Russian pranksters Vladimir 'Vovan' Kuznetsov and Alexei 'Lexus' Stoljarov posing as Ukraine's National Security and Defense Council Secretary Rustem Umerov. During the call, Roll stated Estonia's full support for Ukraine and willingness to coordinate attacks on Saint Petersburg. No sensitive information was disclosed. The Estonian Presidential Chancellery confirmed the incident and stated Roll informed Estonian defense and security agencies. Russian propaganda outlets misrepresented the incident as a leak, using selectively released call recordings. Similar phishing calls targeted other Baltic officials at the same time. The pranksters are known for impersonating prominent figures to extract misleading statements, which are used in Russian disinformation. The incident highlights ongoing Russian hybrid tactics targeting Baltic security officials.

Classification

Confidence: High

The incident involves Russian actors employing deceptive tactics targeting a high-profile Baltic security official, intended to gather intelligence and spread disinformation, consistent with hostile hybrid warfare activities.

Source URL

https://err.ee/1610067553/presidendi-kaitsenounik-sai-vene-tungapaarilt-ongitsuskone

Open source

Provenance

Publisher: extension
Submitted: Jul 2, 2026, 07:55 UTC
Last updated: Nov 8, 2026, 18:18 UTC
Event time: May 1, 2023, 00:00 UTC

Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "095bc384-94ee-497e-befd-c3794c7d0ff2",
  "url": "https://err.ee/1610067553/presidendi-kaitsenounik-sai-vene-tungapaarilt-ongitsuskone",
  "source": "extension",
  "status": "approved",
  "category": "Intelligence & Espionage",
  "subcategory": "Human Intelligence (HUMINT)",
  "incident_type": "Recruitment of locals",
  "country": "Estonia",
  "source_reliability": "C",
  "info_credibility": "3",
  "tags": [
    "Russian propaganda",
    "phishing",
    "disinformation",
    "Baltic security",
    "Madis Roll",
    "Vovan and Lexus",
    "hybrid warfare"
  ],
  "nodes": [],
  "countries": [
    "Estonia"
  ],
  "where_text": "Land",
  "headline": null,
  "description": "In May 2023, Madis Roll, presidential security advisor of Estonia, received a phishing call from Russian pranksters Vladimir 'Vovan' Kuznetsov and Alexei 'Lexus' Stoljarov posing as Ukraine's National Security and Defense Council Secretary Rustem Umerov. During the call, Roll stated Estonia's full support for Ukraine and willingness to coordinate attacks on Saint Petersburg. No sensitive information was disclosed. The Estonian Presidential Chancellery confirmed the incident and stated Roll informed Estonian defense and security agencies. Russian propaganda outlets misrepresented the incident as a leak, using selectively released call recordings. Similar phishing calls targeted other Baltic officials at the same time. The pranksters are known for impersonating prominent figures to extract misleading statements, which are used in Russian disinformation. The incident highlights ongoing Russian hybrid tactics targeting Baltic security officials.",
  "summary_short": "Estonian presidential security advisor Madis Roll was targeted by Russian pranksters in a phishing call in May 2023. No sensitive info was leaked. Russian propaganda misrepresented the event as a leak to spread disinformation.",
  "summary_extended": null,
  "actor_primary": "Vladimir 'Vovan' Kuznetsov and Alexei 'Lexus' Stoljarov",
  "target_primary": null,
  "location_text": "Tallinn",
  "location_region": "Harju County",
  "location_coordinates_lat": 59.437,
  "location_coordinates_lon": 24.7536,
  "location_precision": "Approximate",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The incident involves Russian actors employing deceptive tactics targeting a high-profile Baltic security official, intended to gather intelligence and spread disinformation, consistent with hostile hybrid warfare activities.",
  "event_time_utc": "2023-05-01T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "unknown",
  "created_at": "2026-07-02T07:55:00.103Z",
  "updated_at": "2026-11-08T18:18:19.607Z",
  "reliability_band": "strong",
  "location_precision_band": "approximate",
  "time_precision_band": "unknown",
  "severity_band": "minor",
  "attribution_confidence_band": "high",
  "attribution_basis": "single_source"
}

Public assessmentReliability: StrongSeverity: MinorAttribution: HighSingle sourceTime: UnknownLocation: Approximate

Source reliability

Info credibility

Event time

May 1, 2023, 00:00 UTC

Event time confidence

unknown

Location

Tallinn

Region

Harju County

Primary actor

Vladimir 'Vovan' Kuznetsov and Alexei 'Lexus' Stoljarov

Country

Estonia

Countries

Estonia

Tags

Russian propaganda, phishing, disinformation, Baltic security, Madis Roll, Vovan and Lexus, hybrid warfare

Loading signal...

{ "id": "095bc384-94ee-497e-befd-c3794c7d0ff2", "url": "https://err.ee/1610067553/presidendi-kaitsenounik-sai-vene-tungapaarilt-ongitsuskone", "source": "extension", "status": "approved", "category": "Intelligence & Espionage", "subcategory": "Human Intelligence (HUMINT)", "incident_type": "Recruitment of locals", "country": "Estonia", "source_reliability": "C", "info_credibility": "3", "tags": [ "Russian propaganda", "phishing", "disinformation", "Baltic security", "Madis Roll", "Vovan and Lexus", "hybrid warfare" ], "nodes": [], "countries": [ "Estonia" ], "where_text": "Land", "headline": null, "description": "In May 2023, Madis Roll, presidential security advisor of Estonia, received a phishing call from Russian pranksters Vladimir 'Vovan' Kuznetsov and Alexei 'Lexus' Stoljarov posing as Ukraine's National Security and Defense Council Secretary Rustem Umerov. During the call, Roll stated Estonia's full support for Ukraine and willingness to coordinate attacks on Saint Petersburg. No sensitive information was disclosed. The Estonian Presidential Chancellery confirmed the incident and stated Roll informed Estonian defense and security agencies. Russian propaganda outlets misrepresented the incident as a leak, using selectively released call recordings. Similar phishing calls targeted other Baltic officials at the same time. The pranksters are known for impersonating prominent figures to extract misleading statements, which are used in Russian disinformation. The incident highlights ongoing Russian hybrid tactics targeting Baltic security officials.", "summary_short": "Estonian presidential security advisor Madis Roll was targeted by Russian pranksters in a phishing call in May 2023. No sensitive info was leaked. Russian propaganda misrepresented the event as a leak to spread disinformation.", "summary_extended": null, "actor_primary": "Vladimir 'Vovan' Kuznetsov and Alexei 'Lexus' Stoljarov", "target_primary": null, "location_text": "Tallinn", "location_region": "Harju County", "location_coordinates_lat": 59.437, "location_coordinates_lon": 24.7536, "location_precision": "Approximate", "is_aggressor_signal": true, "signal_type": "HYBRID_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "The incident involves Russian actors employing deceptive tactics targeting a high-profile Baltic security official, intended to gather intelligence and spread disinformation, consistent with hostile hybrid warfare activities.", "event_time_utc": "2023-05-01T00:00:00.000Z", "end_time_utc": null, "event_time_confidence": "unknown", "created_at": "2026-07-02T07:55:00.103Z", "updated_at": "2026-11-08T18:18:19.607Z", "reliability_band": "strong", "location_precision_band": "approximate", "time_precision_band": "unknown", "severity_band": "minor", "attribution_confidence_band": "high", "attribution_basis": "single_source" }