In May 2025, satellite navigation disruptions caused by Russian-origin GNSS spoofing near the Gulf of Finland affected aircraft and ships with false GPS signals, including distinct circular and hexagonal spoofing patterns.

Cyber & Information WarfareCyber AttacksHacking, malware, ransomware

Aggressor

Summary

Over the past year leading up to May 2025, there has been a significant increase in GNSS spoofing incidents originating from the Russian side of the Gulf of Finland border. These disruptions cause aircraft and maritime vessels to receive false GPS signals, resulting in erratic behavior such as ships appearing to 'teleport' and move in circular or hexagonal patterns in spoofed locations. One circular spoofing system displays an 8.6 km radius perfect circle pattern centered near coordinates N 60°25'27" E 27°52'48", operating in alternating half- and full-circle modes with detailed timing synchronized to UTC. Another line-based spoofer creates an irregular hexagonal pattern near an island off the coast of Primorsk, with a repeat cycle of about 663 seconds and continuous broadcast activity. The spoofing systems appear potentially mobile and individually deployed, possibly intended either as geopolitical signaling or defensive measures against drone incursions. This represents a clear hostile electronic interference targeting navigation instruments in Finnish territorial waters and airspace over the Gulf of Finland.

Classification

Confidence: High

The article clearly attributes the GNSS spoofing and navigation disruptions to Russian-origin electronic interference, detailing technical data on spoofing patterns, locations, and timing, which indicates a deliberate hostile action against Finnish maritime and air navigation. There is no indication that the event describes defensive preparations by Finland or NATO, only hostile activity.

Source URL

https://christian.panton.org/posts/going-in-circles

Open source

Provenance

Publisher: csv-import
Submitted: Feb 1, 2026, 00:14 UTC
Last updated: Nov 8, 2026, 21:35 UTC
Event time: May 20, 2025, 12:00 UTC

Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "e2b17a03-5813-474f-abd7-4c2f5ccc8102",
  "url": "https://christian.panton.org/posts/going-in-circles",
  "source": "csv-import",
  "status": "approved",
  "category": "Cyber & Information Warfare",
  "subcategory": "Cyber Attacks",
  "incident_type": "Hacking, malware, ransomware",
  "country": "Finland",
  "source_reliability": "C",
  "info_credibility": "3",
  "tags": [
    "GNSS spoofing",
    "gnss interference",
    "Maritime navigation disruption",
    "Russian electronic warfare",
    "Gulf of Finland",
    "Primorsk",
    "SatNav spoofing",
    "Hybrid warfare"
  ],
  "nodes": [
    "Node 1: Borders"
  ],
  "countries": [],
  "where_text": "Land",
  "headline": null,
  "description": "Over the past year, satellite navigation systems in the Gulf of Finland have been disrupted by GNSS spoofing attributed to Russian-origin electronic interference near the border. Aircraft and ships report false GPS signals, with vessels appearing on tracking websites to ‘teleport’ and move in circular patterns (~8.6 km radius circle centered at N 60°25'27\", E 27°52'48\") or irregular hexagonal shapes near Primorsk. The circle-spoofer operates in alternating 30- and 60-minute scanning modes and intermittently pauses briefly each hour, indicating some clock synchronization with UTC. The hexagon spoofer repeats a 662.84-second pattern and continuously broadcasts. These spoofing activities likely stem from individual, possibly mobile devices aimed at confusing navigation and have raised concerns about their purpose—ranging from geopolitical signaling to defensive electronic warfare measures shielding strategic areas from drone incursions. The spoofed positions do not represent the actual spoofer locations. Such activity disrupts maritime and aviation navigation near Finnish territorial waters and demonstrates Russian hybrid warfare techniques involving electronic navigation interference.",
  "summary_short": "In May 2025, satellite navigation disruptions caused by Russian-origin GNSS spoofing near the Gulf of Finland affected aircraft and ships with false GPS signals, including distinct circular and hexagonal spoofing patterns.",
  "summary_extended": "Over the past year leading up to May 2025, there has been a significant increase in GNSS spoofing incidents originating from the Russian side of the Gulf of Finland border. These disruptions cause aircraft and maritime vessels to receive false GPS signals, resulting in erratic behavior such as ships appearing to 'teleport' and move in circular or hexagonal patterns in spoofed locations. One circular spoofing system displays an 8.6 km radius perfect circle pattern centered near coordinates N 60°25'27\" E 27°52'48\", operating in alternating half- and full-circle modes with detailed timing synchronized to UTC. Another line-based spoofer creates an irregular hexagonal pattern near an island off the coast of Primorsk, with a repeat cycle of about 663 seconds and continuous broadcast activity. The spoofing systems appear potentially mobile and individually deployed, possibly intended either as geopolitical signaling or defensive measures against drone incursions. This represents a clear hostile electronic interference targeting navigation instruments in Finnish territorial waters and airspace over the Gulf of Finland.",
  "actor_primary": "Russian electronic warfare units",
  "target_primary": null,
  "location_text": "Gulf of Finland near Russian border; spoofing centered at N 60°25'27\" E 27°52'48\"; area near Primorsk",
  "location_region": null,
  "location_coordinates_lat": 61.92411,
  "location_coordinates_lon": 25.748151,
  "location_precision": "Approximate",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The article clearly attributes the GNSS spoofing and navigation disruptions to Russian-origin electronic interference, detailing technical data on spoofing patterns, locations, and timing, which indicates a deliberate hostile action against Finnish maritime and air navigation. There is no indication that the event describes defensive preparations by Finland or NATO, only hostile activity.",
  "event_time_utc": "2025-05-20T12:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "unknown",
  "created_at": "2026-02-01T00:14:49.086Z",
  "updated_at": "2026-11-08T21:35:58.778Z",
  "reliability_band": "strong",
  "location_precision_band": "approximate",
  "time_precision_band": "unknown",
  "severity_band": "moderate",
  "attribution_confidence_band": "medium",
  "attribution_basis": "single_source"
}

Public assessmentReliability: StrongSeverity: ModerateAttribution: MediumSingle sourceTime: UnknownLocation: Approximate

Source reliability

Info credibility

Event time

May 20, 2025, 12:00 UTC

Event time confidence

unknown

Location

Gulf of Finland near Russian border; spoofing centered at N 60°25'27" E 27°52'48"; area near Primorsk

Primary actor

Russian electronic warfare units

Country

Finland

Tags

GNSS spoofing, gnss interference, Maritime navigation disruption, Russian electronic warfare, Gulf of Finland, Primorsk, SatNav spoofing, Hybrid warfare

Nodes

Node 1: Borders

Loading signal...

{ "id": "e2b17a03-5813-474f-abd7-4c2f5ccc8102", "url": "https://christian.panton.org/posts/going-in-circles", "source": "csv-import", "status": "approved", "category": "Cyber & Information Warfare", "subcategory": "Cyber Attacks", "incident_type": "Hacking, malware, ransomware", "country": "Finland", "source_reliability": "C", "info_credibility": "3", "tags": [ "GNSS spoofing", "gnss interference", "Maritime navigation disruption", "Russian electronic warfare", "Gulf of Finland", "Primorsk", "SatNav spoofing", "Hybrid warfare" ], "nodes": [ "Node 1: Borders" ], "countries": [], "where_text": "Land", "headline": null, "description": "Over the past year, satellite navigation systems in the Gulf of Finland have been disrupted by GNSS spoofing attributed to Russian-origin electronic interference near the border. Aircraft and ships report false GPS signals, with vessels appearing on tracking websites to ‘teleport’ and move in circular patterns (~8.6 km radius circle centered at N 60°25'27\", E 27°52'48\") or irregular hexagonal shapes near Primorsk. The circle-spoofer operates in alternating 30- and 60-minute scanning modes and intermittently pauses briefly each hour, indicating some clock synchronization with UTC. The hexagon spoofer repeats a 662.84-second pattern and continuously broadcasts. These spoofing activities likely stem from individual, possibly mobile devices aimed at confusing navigation and have raised concerns about their purpose—ranging from geopolitical signaling to defensive electronic warfare measures shielding strategic areas from drone incursions. The spoofed positions do not represent the actual spoofer locations. Such activity disrupts maritime and aviation navigation near Finnish territorial waters and demonstrates Russian hybrid warfare techniques involving electronic navigation interference.", "summary_short": "In May 2025, satellite navigation disruptions caused by Russian-origin GNSS spoofing near the Gulf of Finland affected aircraft and ships with false GPS signals, including distinct circular and hexagonal spoofing patterns.", "summary_extended": "Over the past year leading up to May 2025, there has been a significant increase in GNSS spoofing incidents originating from the Russian side of the Gulf of Finland border. These disruptions cause aircraft and maritime vessels to receive false GPS signals, resulting in erratic behavior such as ships appearing to 'teleport' and move in circular or hexagonal patterns in spoofed locations. One circular spoofing system displays an 8.6 km radius perfect circle pattern centered near coordinates N 60°25'27\" E 27°52'48\", operating in alternating half- and full-circle modes with detailed timing synchronized to UTC. Another line-based spoofer creates an irregular hexagonal pattern near an island off the coast of Primorsk, with a repeat cycle of about 663 seconds and continuous broadcast activity. The spoofing systems appear potentially mobile and individually deployed, possibly intended either as geopolitical signaling or defensive measures against drone incursions. This represents a clear hostile electronic interference targeting navigation instruments in Finnish territorial waters and airspace over the Gulf of Finland.", "actor_primary": "Russian electronic warfare units", "target_primary": null, "location_text": "Gulf of Finland near Russian border; spoofing centered at N 60°25'27\" E 27°52'48\"; area near Primorsk", "location_region": null, "location_coordinates_lat": 61.92411, "location_coordinates_lon": 25.748151, "location_precision": "Approximate", "is_aggressor_signal": true, "signal_type": "HYBRID_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "The article clearly attributes the GNSS spoofing and navigation disruptions to Russian-origin electronic interference, detailing technical data on spoofing patterns, locations, and timing, which indicates a deliberate hostile action against Finnish maritime and air navigation. There is no indication that the event describes defensive preparations by Finland or NATO, only hostile activity.", "event_time_utc": "2025-05-20T12:00:00.000Z", "end_time_utc": null, "event_time_confidence": "unknown", "created_at": "2026-02-01T00:14:49.086Z", "updated_at": "2026-11-08T21:35:58.778Z", "reliability_band": "strong", "location_precision_band": "approximate", "time_precision_band": "unknown", "severity_band": "moderate", "attribution_confidence_band": "medium", "attribution_basis": "single_source" }