Estonia’s Kremlin-Linked Influence Ecosystem

Kremlin Institutions and Intermediaries

The Directorate for Strategic Partnership and Cooperation in Russia’s Presidential Administration has a Baltic portfolio overseen by Vladimir Balobayev. His remit includes (1) the Baltic activities of Rossotrudnichestvo, Russia’s sanctioned federal agency for outreach to compatriots abroad, as well as Pravfond and Baltnews.

Activity targeting Estonia therefore sits within a regional structure also covering Latvia and Lithuania.

Pravfond, the Foundation for Supporting and Protecting the Rights of Compatriots Living Abroad, was established by the Russian Foreign Ministry and Rossotrudnichestvo. The sanctioned fund supports legal assistance for prosecuted activists (2) and finances media production, including the Russian-language news portal Sputnik Meedia (3) and a Telegram network (4) edited by Rossiya Segodnya correspondent Aleksei Stefanov.

Konstantin Zatulin’s Institute of CIS Countries convenes officials, media operators and former Baltic activists to develop proposals for Russian policy.

Zatulin, who is himself subject to sanctions and was then first deputy chair of the State Duma committee on CIS affairs, Eurasian integration and compatriots, called for concrete mechanisms for exerting pressure at a June 2026 round table in Kaliningrad. (5) The meeting coincided with the opening of a Pravfond branch at the Immanuel Kant Baltic Federal University. (6)

Ruslan Pankratov, a former member of the Riga City Council who relocated to Russia in 2023 (7) while facing proceedings for inciting ethnic hatred in Latvia, represents the institute’s Baltic department. (8)

Participants in its events include (9), (10), (11) Oleg Ivanov, a former leader of Estonia’s pro-Russian party KOOS; Maksim Reva, formerly of Night Watch, a Russian-speaking activist movement in Estonia; Sergei Vasilyev, editor of the pro-Kremlin Telegram channel Antifascists of the Baltics; and Aleksandr Kornilov, publisher of the Russian-language news portal baltija.eu. Russian participants include Presidential Human Rights Council member Aleksandr Brod, Baltic affairs scholar Nikolai Mezhevich and historian Vladimir Simindey.

The institute uses allegations of persecution to argue for Russian action. A February 2026 discussion (12) framed repatriation to Russia as a national security issue. An announcement for a May round table (13) alleged ethnic cleansing in the Baltic states and promised recommendations for the Presidential Administration and Security Council.

Its security narratives also portray Estonia as a potential launch point for aggression: a February 2025 round table (9) claimed that NATO could use drone attacks from Estonia and Latvia to provoke a war with Russia.

EK Stratcom’s research using archived Russian registry records identifies Pankratov as president of the Moscow-based association Expert Group as of 6 March 2026. The same registration changes listed film, video and television production as its main activity, alongside distribution, broadcasting and social-science research. The records reviewed showed no revenue or state contracts at that point. Expert Group gives Pankratov a separate legal vehicle for media production alongside his position at the institute.

Estonia’s Changing Influence Environment

Between 2019 and 2026, Estonian authorities disrupted several established channels of Russian influence. Sputnik Estonia, the local service of Russian state media outlet Sputnik, stopped publishing on 31 December 2019 after sanctions-related warnings to its employees. (14) Major Russian state television channels were removed from cable distribution in 2022. (15)

Criminal proceedings against KOOS leaders and media operators further reduced the organizational capacity available to Moscow inside Estonia.

Some operators adapted before being prosecuted or relocating. Elena Cherysheva and Mati-Dmitri Terestal launched Sputnik Meedia in 2021. KAPO, Estonia’s Internal Security Service, identified Pravfond support for the project. (3) Terestal was convicted of sanctions violations in January 2025. (16) By then, Cherysheva had left Estonia and was reported to be running Rossiya Segodnya’s operations in occupied Crimea.

Svetlana Burtseva wrote for Baltnews under a pseudonym and worked with a reserve officer of Russia’s Federal Security Service (FSB) after enrolling in an information warfare program in occupied Crimea. (17) In June 2025, an Estonian court sentenced her to six years for treason and sanctions violations. (18)

Pravfond also financed a project in which television producer Oleg Bessedin’s family filmed approximately 300 Soviet war monuments in Estonia. (19) He also developed a YouTube channel, with Ivanov as co-host.

Propastop, an Estonian propaganda-monitoring initiative, recorded (20) 170,000 subscribers in June 2025 and inferred from video comments that a substantial share of viewers were outside Estonia; by the time of Bessedin’s arrest in November 2025, Veridica reported more than 200,000 subscribers. (21) On 28 September 2026, Harju County Court sentenced Bessedin to seven years under a plea agreement for non-violent activity against Estonia and sanctions violations. (22)

The overlap between media activism and covert operations is particularly clear in the case of Allan Hantsom, a former Sputnik journalist and KOOS member. Estonian authorities linked him to Russian military intelligence, the GRU, and to the organization of attacks on the cars of then Interior Minister Lauri Läänemets and journalist Andrei Šumakov. (23) Hantsom received a six-and-a-half-year sentence in May 2024. KAPO described the intended public effect of such attacks as creating the appearance of domestic protest. (24)

Recruitment also extended beyond established activists. Ivan Dmitrijev, a member of Estonia’s volunteer Defence League, passed information to the FSB Border Service and was sentenced to four years and eleven months in prison. (25) Vjatšeslav Jefimov, a guard in the waiting area at the Koidula crossing on the Estonian–Russian border, supplied information to the FSB. (26)

Two Moldovan citizens carried out the January 2025 arson attack against Tallinn’s Slava Ukraina restaurant. In July 2025, an Estonian court convicted them; one had received the task through contacts acting for the GRU. (27)

EK Stratcom’s mapping identified no successor structure inside Estonia with coordinating capacity comparable to that of the network disrupted by these measures. The pro-Russian KOOS party remains marginal. Plaan B, a populist movement, won four seats on Narva’s city council in 2025; since July 2026 it has held the council chairmanship in a coalition with the Centre Party.

Turning Prosecutions Into Influence Campaigns

Estonian arrests, convictions and deportations provide a recurring source of content for Pravfond, baltija.eu, Sputnik and Baltnews. Their coverage shifts attention from the conduct described in Estonian proceedings to alternative portrayals of the defendants as journalists, rights defenders, anti-fascists or prisoners of conscience.

Russian officials endorse these descriptions, supporters raise money, and individual cases are grouped into a regional account of political persecution.

EK Stratcom matched more than 50 dated publications from 2021–2026 to the Estonian events they covered. The earliest Pravfond item located by EK Stratcom on pro-Kremlin activist Sergei Seredenko appeared 27 days after his March 2021 arrest. (28) The chronology records next-day coverage of Hantsom’s December 2023 arrest (29) and same-day coverage of Burtseva’s sentence (30) and the first-instance verdicts against KOOS leader Aivo Peterson and his co-defendants. (31)

Bessedin’s case shows how a local arrest becomes an international campaign. Baltija.eu reported his arrest on 4 November 2025. (32) The following day, Foreign Ministry spokeswoman Maria Zakharova described him as a victim of a witch hunt. (33) Ten days after his arrest, Valery Fadeyev, chair of the Presidential Council for Civil Society and Human Rights, appealed to the UN High Commissioner for Human Rights. (34) Twenty-one days after the arrest, Pravfond’s press center published a fundraising appeal, including details of an account held by Ivanov. (35)

The narrative treatment is consistent across cases. Seredenko is portrayed as a rights defender and anti-fascist; (36) Hantsom as an anti-fascist journalist; (37) and Peterson as a prisoner of conscience punished for his position on Russia. Seredenko was convicted of working against Estonia with people acting for Russian government agencies; (38) Hantsom of intelligence activity against Estonia; and Peterson of treason. (39) In April 2026, Peterson’s sentence was increased on appeal to 16 years. Seredenko completed his sentence and was released on 3 September 2026.

Funding sustains both legal support and publicity. According to KAPO, Russian diplomat Ovik Muradyan, expelled from Estonia in August 2025, facilitated the payment of Pravfond money to the lawyer representing Peterson’s co-defendant Andrei Andronov after the fund had been sanctioned. (17) Prosecutors charged lawyer Urmas Simon with sanctions violations in August 2025. (40)

The case connects Pravfond’s public advocacy for the defendants to payments for their legal representation.

Former Estonia-based activists continue public campaigning from Russia. In June 2025, Sergei Tšaulin and Zoja Paljamar participated in a commemoration at a replica of the Narva Soviet tank in Ivangorod. Baltija.eu presented their participation as an act of solidarity following their deportation from Estonia. (41)

The campaign also promotes prisoner exchanges. In August 2024, the Russian news agency Regnum published Hantsom’s proposal to exchange people imprisoned in Western countries for serving Moscow’s interests. (42) Baltija.eu subsequently repeated demands for exchanges involving prisoners in the Baltic states. (43) These publications connect the persecution narrative to demands for the return of people convicted in Estonia.

Legal and Historical Narratives

Russia’s Foreign Ministry is developing an international legal campaign against Estonia, Latvia and Lithuania under the International Convention on the Elimination of All Forms of Racial Discrimination. On 31 May 2026, Zakharova said (44) the pre-litigation stage would be completed by the end of 2026, and on 24 June, Maksim Musikhin, director of the Foreign Ministry’s Legal Department, said that proceedings before the International Court of Justice could begin that year. (45)

Reporting by the Central European investigative outlet VSquare and its partners identifies (46) Moscow law firm Monastyrsky, Zyuba, Stepanov & Partners as the contractor preparing the case. The firm contacted Mezhevich and Simindey for assistance, drawing on the same experts who participate in the events organized by the Institute of CIS Countries. The legal preparation covers language and education policies, the historical presence of Russians and alleged discrimination.

Russia’s Investigative Committee, the federal agency responsible for criminal investigations, pursues a parallel set of criminal cases. In January 2026, it announced charges in absentia against 255 foreign citizens over the destruction of Soviet monuments, including former Estonian prime minister Kaja Kallas and former state secretary Taimar Peterkop. (47) In September 2025, a Russian court sentenced Narva Museum director Maria Smorzhevskikh-Smirnova in absentia to ten years after the museum displayed material condemning Putin’s war against Ukraine. (48)

These proceedings extend Russian criminal accusations to Estonian officials and cultural institutions carrying out their work in Estonia.

Historical and territorial claims broaden this pressure. In January 2026, Russia’s chargé d’affaires in Tallinn, Kamran Abilov, described entries in Estonian passports identifying the Pechory district as a place of birth in Estonia as a territorial claim. (49) The area formed part of Estonia under the 1920 Tartu Peace Treaty; Soviet authorities transferred most of Petseri County, including Pechory, to the Russian Soviet Federative Socialist Republic in 1944. (50)

Telegram channels also directly challenge Estonian statehood. EK Stratcom identified repeated (51), (52) descriptions of Estonia as “the former Estonian Soviet Socialist Republic” or “so-called Estonia” in the channel Civic Optimist. Its response to Estonia’s attribution of the Milrem arson questioned the country’s continued existence.

Sabotage and Pressure Across the Border

On 15 August 2026, a building in Tallinn used by Milrem Robotics, an Estonian manufacturer of unmanned ground vehicles supplied to Ukraine, caught fire. Three Latvian citizens were detained and subsequently transferred to Estonia. On 29 September, Prime Minister Kristen Michal attributed the attack to Russian intelligence services, (53) and the Foreign Ministry summoned Russia’s chargé d’affaires. (54) Russia denied responsibility. KAPO warned that Russian services were targeting defense-industry companies.

Russia also restricted movement along the border. On 1 July 2026, it suspended (55) railway traffic through Pechory-Pskovskiye, opposite the Koidula crossing in southeastern Estonia. From 16 to 26 September, the FSB restricted (56) nighttime movement outside settlements in a five-kilometer border strip in Russia’s Kingisepp and Slantsy districts, near the Narva River. The river separates northeastern Estonia from Russia, with the cities of Narva and Ivangorod facing each other across it.

On 28 September, the US-sanctioned (57) Russian paramilitary group Rusich posted (58) a photograph of armed men with a caption placing them in the Narva area. Narva People’s Republic, a Telegram channel promoting separatist imagery about the Estonian border city, relayed (59) it the next morning, followed by the local Russian-language channel NARVANEWS. EK Stratcom recorded approximately 97,000 views and 2,700 forwards on the original post by 1 October, compared with approximately 3,000 views for the NARVANEWS repost.

The reposts brought threatening Russian military imagery into a Narva news feed.

EK Stratcom’s monitoring found limited amplification of these border-related episodes. A scan of 6,808 posts found almost no coverage of the FSB restrictions, and the monitored Pravfond-linked channels and Baltnews did not relay the Rusich photograph.

The detention of Artur Kirmjõe prompted a public appeal for a prisoner exchange. Investigations by the Russian outlet iStories and the Estonian news outlet Delfi identified (60) Kirmjõe as the Estonian citizen arrested in Vladimir, Russia, in April 2026 and accused of preparing to fight for Ukraine. Kirmjõe, a former paramedic in the Estonian army’s Scouts Battalion, had traveled there to visit his wife. His mother called for his exchange for Bessedin. Estonia’s Foreign Ministry confirmed that approximately twenty Estonian citizens were under investigation or in custody in Russia. (61)

Previous exchanges provide precedents. Russia exchanged KAPO officer Eston Kohver for convicted Russian spy Aleksei Dressen in September 2015, (62) and Estonian businessman Raivo Susi for convicted GRU agent Artyom Zinchenko in February 2018. (63)

Two other Estonian citizens crossed a frozen lake on the border into Russia in January and February 2026 seeking asylum and were detained on illegal-crossing charges, according to Russian independent outlet Mediazona and Estonian weekly Eesti Ekspress. (64) EK Stratcom found no posts about them or Kirmjõe in its corpus of 24,529 Telegram posts collected between 1 August and 1 October 2026.

Media Networks and Distribution

EK Stratcom collected 24,529 posts from 400 channels between 1 August and 1 October 2026, identifying 5,047 posts relevant to Estonia. The monitoring covers Russian-language distribution and related channels serving the Estonian information environment. The principal groups differ in funding, language and distribution role.

Rossiya Segodnya’s Baltnews supplies a state-media platform. A separate Pravfond-supported Telegram project received a €109,000 grant in 2024, according to documents examined by Re:Baltica, the Baltic investigative journalism center. (4) The application named Rossiya Segodnya correspondent Aleksei Stefanov as editor-in-chief.

EK Stratcom monitors his personal Telegram channel; the Russian-language channels Shadows of the Baltics and BalticBridge; the Estonian-language Old Thomas’s Herald; and the Sipsikova channel, associated with Sputnik presenter Viktoria Fyodorova’s video commentary. It also monitors Pravfond’s official channel.

Antifascists of the Baltics connects media distribution to the activist and institutional network described above. Telegram channels such as Civic Optimist and Russian Europe, alongside Baltic affairs scholar Nikolai Mezhevich, circulate related narratives. InfoDefense is a multilingual pro-Kremlin Telegram network. Pravda, a network of pro-Kremlin news aggregation websites, republishes Telegram material on the web. (65) EK Stratcom’s quarterly count recorded 1,799 Telegram-sourced items republished by the Estonian-language Pravda site.

The Russian military-blogging channels Two Majors and WarGonzo, and war correspondent Aleksandr Kots’s Telegram channel, have much larger subscriber bases than the Baltic-focused outlets. Russia’s embassy also maintains an official Telegram channel. The appendix records the principal channels and their subscriber figures as of 22 October 2026.

In its comparison of funded outlets, EK Stratcom groups the channels it has linked to Pravfond together with Baltnews (@BalticBridge, @tenipribaltiki, @VanaToomaseTeataja, @sipsikova, @alekseystefanov, @pravfond_official, @baltnews). Across the periods compared, these channels produced approximately a quarter of the monitored posts relevant to Estonia and accounted for between 1 and 6% of the views recorded for those posts. From 25 to 27 September 2026, these channels produced 21.8% of relevant posts and received 1.2% of views; major Russian military bloggers produced 1.6% of posts and received 28% of views.

Baltic-focused channels maintained a higher posting volume, while the military bloggers generated far more views from fewer posts.

On BalticBridge and Old Thomas’s Herald, views per post were equivalent to approximately 1.8% of each channel’s subscriber count, compared with 8 to 16% for Baltnews and Stefanov’s personal channel. In a three-day sample, EK Stratcom recorded nine forwards of funded content outside the channels’ own chats; seven stayed within the funded network.

The Milrem case illustrates how distribution changes after an official attribution. EK Stratcom coded (66) 36 posts carrying the campaign’s framing or relaying Russia’s denial, with a combined total of 220,800 views. Baltnews began (67) coverage on 18 August, questioning the search for Russian involvement. On 21 August, Shadows of the Baltics portrayed (68) the investigation as a pretext for Estonia’s isolation from Russia; Stefanov published (69) the same text seven hours later.

In the collected August posts, the Pravfond network accounted for more than half of the campaign’s views.

After Estonia attributed the attack to Russia, 21 posts on 29 and 30 September drew 206,600 views. Major Russian military bloggers (@dva_majors, @wargonzo, @sashakots) accounted for 89%, including 122,800 views on a Two Majors post calling the attack a falsification. Baltnews accounted for 7% and the Pravfond network for 0.3%.

Five clusters of Kremlin narratives dominated the monitored content:

EK Stratcom’s keyword search returned no hits for the Narva People’s Republic separatism theme in the collected corpus. Direct examination of the project’s channel documented regular posting from May to July 2026, with 2,800 to 7,750 views per post, followed by reduced activity and the September relay of the Rusich photograph. (59) The project had approximately 1,950 subscribers.

Local political material also enters the distribution network. In 1,156 Old Thomas’s Herald posts collected between March and September 2026, EK Stratcom identified 55 reposts of public posts by MPs from Estonia’s Centre Party, 24 by MPs from the Conservative People’s Party of Estonia (EKRE) and 12 by independent MP Varro Vooglaid.

Median views per post rose to approximately 740 in April and 730 in June, compared with approximately 80 in other months. The channel incorporates public statements by Estonian politicians into its Estonian-language coverage of domestic disputes.

Risks Ahead of the 2027 Election

The election campaign gives Kremlin-linked outlets opportunities to portray security prosecutions, language policy and border disputes as attacks on Russian-speaking residents. Old Thomas’s Herald already brings Estonian politicians’ statements into this network.

The Milrem case demonstrates a second risk: an attack attributed to Russian intelligence followed by a campaign to discredit Estonia’s investigation. Baltic-focused outlets questioned Russian involvement before the official attribution; major Russian military bloggers then amplified claims of fabrication. Further incidents affecting defense production or the border could generate similar campaigns.

The local relay of Rusich’s armed imagery shows another way in which threatening material can reach residents near the border.

Russian institutions sustain pressure beyond elections through Pravfond funding, diplomatic advocacy and preparations for an ICJ case. Former Estonia-based activists contribute public commentary and participate in Russian institutional forums. These campaigns present Estonia’s efforts to counter Russian interference as grounds for Moscow to intervene in its domestic affairs.

Appendix 1. Registered Entities

Registry information from the EK Stratcom source file, including archived extracts and record checks made in September and October 2026.

Appendix 2. Telegram Channels

Channel roles and subscriber figures recorded by EK Stratcom as of 22 October 2026.