In December 2023, Russian military intelligence (GRU) orchestrated a covert vandalism campaign in Estonia aimed at intimidating critics of Russia, including Estonian Interior Minister Lauri Läänemets and Russian-language journalist Andrey Shumakov. The GRU enlisted local pro-Russian activists and criminal underworld figures to vandalize targeted vehicles by smashing their windows. Key orchestrator Allan Hantsom, a pro-Russian propagandist and GRU asset, was arrested by Estonian Internal Security Service (KAPO) before the attacks took place. Investigations uncovered a network of agents recruited via Telegram and compensated in cryptocurrency, including individuals with dual Estonian-Russian citizenship facilitating cross-border movement and espionage. Targets were politically and socially influential figures exposing Russian disinformation about the war in Ukraine, especially among Estonia’s Russian-speaking minority (~25%). Several low-level criminals carried out the vandalism, unaware they were acting for GRU. Hantsom received a 6.5-year sentence for espionage, others got suspended sentences. The operation aimed to sow fear, social division, and demonstrate Russian impunity despite Estonia's NATO membership and EU integration. The campaign reflects the GRU’s increased reliance on remote and proxy operatives for hybrid attack tactics in Europe since the 2022 Russian invasion of Ukraine.

In December 2023, Russian military intelligence (GRU) orchestrated a covert vandalism campaign in Estonia aimed at intimidating critics of Russia, including Estonian Interior Minister Lauri Läänemets and Russian-language journalist Andrey Shumakov. The GRU enlisted local pro-Russian activists and criminal underworld figures to vandalize targeted vehicles by smashing their windows. Key orchestrator Allan Hantsom, a pro-Russian propagandist and GRU asset, was arrested by Estonian Internal Security Service (KAPO) before the attacks took place. Investigations uncovered a network of agents recruited via Telegram and compensated in cryptocurrency, including individuals with dual Estonian-Russian citizenship facilitating cross-border movement and espionage. Targets were politically and socially influential figures exposing Russian disinformation about the war in Ukraine, especially among Estonia’s Russian-speaking minority (~25%). Several low-level criminals carried out the vandalism, unaware they were acting for GRU. Hantsom received a 6.5-year sentence for espionage, others got suspended sentences. The operation aimed to sow fear, social division, and demonstrate Russian impunity despite Estonia's NATO membership and EU integration. The campaign reflects the GRU’s increased reliance on remote and proxy operatives for hybrid attack tactics in Europe since the 2022 Russian invasion of Ukraine.