Leaked Kremlin documents reveal coordinated hybrid information warfare against the Baltics led by Aleksejs Žuravļovs, using propaganda, proxies, and online campaigns in Russia and Baltic diaspora.

Cyber & Information WarfareInformation OperationsPropaganda & disinformation campaigns

Aggressor

Summary

In early April 2024, leaked documents from the Russian Presidential Administration expose Kremlin information warfare strategies against the Baltic states coordinated under Aleksejs Žuravļovs, who leads the Interregional and Cultural Relations department deploying intelligence operatives to interfere in Baltic internal affairs. Propaganda themes for distribution by Kremlin agents are being developed under his supervision targeting Latvia, Estonia, and Lithuania. Separate reporting reveals a Moscow-based 'antifašistu štābs' (anti-fascist headquarters) with ties to Latvian exile Sergejs Vasiļjevs, publicly known as 'Сева Рига', who faces terrorism financing allegations in Latvia. This group is engaged in well-funded hybrid activities, including commissioning statues and developing a 'Baltic fascists' database website designed with DDoS protection, indicating well-organized cyber and psychological warfare components against Baltic countries. The efforts include cultivating pro-Kremlin media agents and exploiting ethnic Russian minorities for online radicalization and disinformation campaigns. These operations reflect a multi-nodal hybrid warfare approach integrating cyber, information, and political subversion targeting Baltic allies. The activities are corroborated by Baltic opposition journalists and extensive Telegram monitoring, with identified links to Russian intelligence and corrupt elites, such as the Moscow-based Iron Birds motorcycle club with connections to Russian prosecutors on the Magnitsky list.

Classification

Confidence: High

The leaked official documents, detailed coordination by Kremlin operatives, active propaganda dissemination, and proxy activities such as online hostile messaging, memorial commissioning, and targeted databases constitute direct hybrid warfare actions aimed at destabilizing Baltic states.

Source URL

https://x.com/i/web/status/1777192940403658885

Open source

Provenance

Publisher: csv-import
Submitted: Feb 14, 2026, 12:22 UTC
Last updated: Nov 8, 2026, 20:18 UTC
Event time: Apr 8, 2024, 00:00 UTC

Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "53394040-fada-455c-a9bd-66e1a568158a",
  "url": "https://x.com/i/web/status/1777192940403658885",
  "source": "csv-import",
  "status": "approved",
  "category": "Cyber & Information Warfare",
  "subcategory": "Information Operations",
  "incident_type": "Propaganda & disinformation campaigns",
  "country": "Unknown",
  "source_reliability": "C",
  "info_credibility": "3",
  "tags": [
    "Kremlin",
    "baltic sea region",
    "information operations",
    "Propaganda",
    "Telegram",
    "Russian diaspora",
    "Hybrid warfare",
    "Latvia",
    "Estonia",
    "Moscow",
    "Iron Birds",
    "Magnitsky sanctions"
  ],
  "nodes": [
    "Node 2: 5th Column"
  ],
  "countries": [],
  "where_text": "Cyberspace",
  "headline": null,
  "description": "Leaked documents from the Russian Presidential Administration reveal Kremlin-directed information warfare efforts targeting the Baltic states. Aleksejs Žuravļovs leads Kremlin's Interregional and Cultural Relations Department since 2021, coordinating propaganda operations aimed at the Baltics, Belarus, and Moldova. Kremlin operatives with intelligence backgrounds disseminate propaganda theses. Baltic opposition journalists from Lithuania, Estonia, and Belarus analyzed these leaks. In Latvia, some Radio 4 journalists previously received Kremlin journalism awards. Pro-Kremlin Telegram chat groups, including one named 'Ja Russkij' involving Estonian Russians, share chauvinistic and anti-Western content. Latvian influencer Iļja Magnus with links to the Russian regime and the Iron Birds biker club continues online disparagement of Latvia. The Iron Birds' leader is son of former Russian General Prosecutor Yuri Chaika, listed in the Magnitsky sanctions. Moscow-based 'antifascist headquarters' coordinate Baltic operations, led publicly by Kremlin advocate Sergejs Vasiļjevs, wanted in Latvia for terrorism financing. Their activities include creating a 'Baltic fascists database' website with anti-DDoS protection and commissioning replicas of a memorial opposite the Latvian embassy in Moscow estimated to cost between 3.5 and 9 million rubles. This points to a well-funded Kremlin hybrid warfare campaign using propaganda, information operations, and proxy activism to destabilize Baltic societies.",
  "summary_short": "Leaked Kremlin documents reveal coordinated hybrid information warfare against the Baltics led by Aleksejs Žuravļovs, using propaganda, proxies, and online campaigns in Russia and Baltic diaspora.",
  "summary_extended": "In early April 2024, leaked documents from the Russian Presidential Administration expose Kremlin information warfare strategies against the Baltic states coordinated under Aleksejs Žuravļovs, who leads the Interregional and Cultural Relations department deploying intelligence operatives to interfere in Baltic internal affairs. Propaganda themes for distribution by Kremlin agents are being developed under his supervision targeting Latvia, Estonia, and Lithuania. Separate reporting reveals a Moscow-based 'antifašistu štābs' (anti-fascist headquarters) with ties to Latvian exile Sergejs Vasiļjevs, publicly known as 'Сева Рига', who faces terrorism financing allegations in Latvia. This group is engaged in well-funded hybrid activities, including commissioning statues and developing a 'Baltic fascists' database website designed with DDoS protection, indicating well-organized cyber and psychological warfare components against Baltic countries. The efforts include cultivating pro-Kremlin media agents and exploiting ethnic Russian minorities for online radicalization and disinformation campaigns. These operations reflect a multi-nodal hybrid warfare approach integrating cyber, information, and political subversion targeting Baltic allies. The activities are corroborated by Baltic opposition journalists and extensive Telegram monitoring, with identified links to Russian intelligence and corrupt elites, such as the Moscow-based Iron Birds motorcycle club with connections to Russian prosecutors on the Magnitsky list.",
  "actor_primary": "Kremlin Interregional and Cultural Relations Department",
  "target_primary": null,
  "location_text": "Riga",
  "location_region": "Riga",
  "location_coordinates_lat": 56.9496,
  "location_coordinates_lon": 24.1052,
  "location_precision": "Unknown",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The leaked official documents, detailed coordination by Kremlin operatives, active propaganda dissemination, and proxy activities such as online hostile messaging, memorial commissioning, and targeted databases constitute direct hybrid warfare actions aimed at destabilizing Baltic states.",
  "event_time_utc": "2024-04-08T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "pm24h",
  "created_at": "2026-02-14T12:22:51.416Z",
  "updated_at": "2026-11-08T20:18:54.585Z",
  "reliability_band": "strong",
  "location_precision_band": "unknown",
  "time_precision_band": "within_24h",
  "severity_band": "moderate",
  "attribution_confidence_band": "high",
  "attribution_basis": "independent_sources"
}

Public assessmentReliability: StrongSeverity: ModerateAttribution: HighIndependence confirmedTime: Same dayLocation: Unknown

Source reliability

Info credibility

Event time

Apr 8, 2024, 00:00 UTC

Event time confidence

pm24h

Location

Riga

Region

Riga

Primary actor

Kremlin Interregional and Cultural Relations Department

Country

Unknown

Tags

Kremlin, baltic sea region, information operations, Propaganda, Telegram, Russian diaspora, Hybrid warfare, Latvia, Estonia, Moscow, Iron Birds, Magnitsky sanctions

Nodes

Node 2: 5th Column

Loading signal...

{ "id": "53394040-fada-455c-a9bd-66e1a568158a", "url": "https://x.com/i/web/status/1777192940403658885", "source": "csv-import", "status": "approved", "category": "Cyber & Information Warfare", "subcategory": "Information Operations", "incident_type": "Propaganda & disinformation campaigns", "country": "Unknown", "source_reliability": "C", "info_credibility": "3", "tags": [ "Kremlin", "baltic sea region", "information operations", "Propaganda", "Telegram", "Russian diaspora", "Hybrid warfare", "Latvia", "Estonia", "Moscow", "Iron Birds", "Magnitsky sanctions" ], "nodes": [ "Node 2: 5th Column" ], "countries": [], "where_text": "Cyberspace", "headline": null, "description": "Leaked documents from the Russian Presidential Administration reveal Kremlin-directed information warfare efforts targeting the Baltic states. Aleksejs Žuravļovs leads Kremlin's Interregional and Cultural Relations Department since 2021, coordinating propaganda operations aimed at the Baltics, Belarus, and Moldova. Kremlin operatives with intelligence backgrounds disseminate propaganda theses. Baltic opposition journalists from Lithuania, Estonia, and Belarus analyzed these leaks. In Latvia, some Radio 4 journalists previously received Kremlin journalism awards. Pro-Kremlin Telegram chat groups, including one named 'Ja Russkij' involving Estonian Russians, share chauvinistic and anti-Western content. Latvian influencer Iļja Magnus with links to the Russian regime and the Iron Birds biker club continues online disparagement of Latvia. The Iron Birds' leader is son of former Russian General Prosecutor Yuri Chaika, listed in the Magnitsky sanctions. Moscow-based 'antifascist headquarters' coordinate Baltic operations, led publicly by Kremlin advocate Sergejs Vasiļjevs, wanted in Latvia for terrorism financing. Their activities include creating a 'Baltic fascists database' website with anti-DDoS protection and commissioning replicas of a memorial opposite the Latvian embassy in Moscow estimated to cost between 3.5 and 9 million rubles. This points to a well-funded Kremlin hybrid warfare campaign using propaganda, information operations, and proxy activism to destabilize Baltic societies.", "summary_short": "Leaked Kremlin documents reveal coordinated hybrid information warfare against the Baltics led by Aleksejs Žuravļovs, using propaganda, proxies, and online campaigns in Russia and Baltic diaspora.", "summary_extended": "In early April 2024, leaked documents from the Russian Presidential Administration expose Kremlin information warfare strategies against the Baltic states coordinated under Aleksejs Žuravļovs, who leads the Interregional and Cultural Relations department deploying intelligence operatives to interfere in Baltic internal affairs. Propaganda themes for distribution by Kremlin agents are being developed under his supervision targeting Latvia, Estonia, and Lithuania. Separate reporting reveals a Moscow-based 'antifašistu štābs' (anti-fascist headquarters) with ties to Latvian exile Sergejs Vasiļjevs, publicly known as 'Сева Рига', who faces terrorism financing allegations in Latvia. This group is engaged in well-funded hybrid activities, including commissioning statues and developing a 'Baltic fascists' database website designed with DDoS protection, indicating well-organized cyber and psychological warfare components against Baltic countries. The efforts include cultivating pro-Kremlin media agents and exploiting ethnic Russian minorities for online radicalization and disinformation campaigns. These operations reflect a multi-nodal hybrid warfare approach integrating cyber, information, and political subversion targeting Baltic allies. The activities are corroborated by Baltic opposition journalists and extensive Telegram monitoring, with identified links to Russian intelligence and corrupt elites, such as the Moscow-based Iron Birds motorcycle club with connections to Russian prosecutors on the Magnitsky list.", "actor_primary": "Kremlin Interregional and Cultural Relations Department", "target_primary": null, "location_text": "Riga", "location_region": "Riga", "location_coordinates_lat": 56.9496, "location_coordinates_lon": 24.1052, "location_precision": "Unknown", "is_aggressor_signal": true, "signal_type": "HYBRID_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "The leaked official documents, detailed coordination by Kremlin operatives, active propaganda dissemination, and proxy activities such as online hostile messaging, memorial commissioning, and targeted databases constitute direct hybrid warfare actions aimed at destabilizing Baltic states.", "event_time_utc": "2024-04-08T00:00:00.000Z", "end_time_utc": null, "event_time_confidence": "pm24h", "created_at": "2026-02-14T12:22:51.416Z", "updated_at": "2026-11-08T20:18:54.585Z", "reliability_band": "strong", "location_precision_band": "unknown", "time_precision_band": "within_24h", "severity_band": "moderate", "attribution_confidence_band": "high", "attribution_basis": "independent_sources" }