Full Report
After Latvia banned broadcasts by Russian federal television channels, Telegram became a key platform for Kremlin propaganda in the country. The Insider estimates that around one-third of socio-political channels in Latvia’s Telegram ecosystem are controlled by Russian propagandists posing as “angry Latvians” — and the figure rises to upwards of 65% when only Russian-language channels are included in the count. The channels portray life in Latvia as getting worse, blaming anti-Russian sanctions for harming the Baltic states while calling for an end to support for Ukraine.
Analysis Summary
# Threat Actor: Kremlin Propaganda Network (Latvian Telegram Ecosystem)
## Attribution & Identity
* **Actor Identification:** Russian state-sponsored and state-aligned propagandists, operating under the guise of local citizens ("angry Latvians").
* **Associated Groups & Entities:**
* *Rossiya Segodnya* (Russian state-run media group, including *RT* editorial staff and journalists).
* Former disinformation networks linked to the late Wagner Group co-founder Yevgeny Prigozhin.
* Belarusian state-aligned social media actors.
* **Key Associated Individuals:**
* Aleksejs Rosļikovs (former Latvian MP and leader of the "Stability!" party, currently operating from Belarus).
* Alexei Stefanov, Ruslan Pankratov, and Nikolai Mezhevich.
## Activity Summary
Following Latvia's ban on Russian federal television broadcasts, this threat actor established a dominant presence in Latvia's socio-political Telegram ecosystem. As of early 2025, the network controls approximately one-third of all Latvian socio-political Telegram channels, rising to over 65% when isolating Russian-language channels. Operating primarily from Russia and Belarus, the network executes coordinated information operations designed to influence public opinion, exacerbate social divisions, and interfere with Latvia's domestic political processes and upcoming elections.
## Tactics, Techniques & Procedures
* **Astroturfing & Persona Adoption:** Propagandists operate from abroad while falsely presenting themselves as local, "outraged" Latvian citizens to gain trust.
* **Coordinated Inauthentic Behavior (CIB):** Utilizing a dense network of cross-reposts. Approximately 43.7% of shared content originates from Russian state media, official government channels, military bloggers ("Z-channels"), and Belarusian pro-government accounts.
* **Narrative Manipulation / Disinformation:** Systematic dissemination of specific Kremlin-aligned narratives, including:
* Portraying life in Latvia as deteriorating and claiming the population cannot afford basic necessities.
* Blaming anti-Russian sanctions and economic aid to Ukraine for local inflation and poverty.
* Falsely claiming systematic persecution of Russian speakers and the rise of Nazism in the Baltic states.
*(Note: Specific MITRE ATT&CK matrix IDs for enterprise IT infrastructure are not applicable to this influence/disinformation operation, though the behaviors map closely to standard Information Operations and DISARM frameworks).*
## Targeting
* **Sectors:** Public Opinion, Government, Electoral Systems, Media.
* **Geography:** Latvia, Baltic States.
* **Victims:** The Latvian public, specifically the Russian-speaking minority population within Latvia.
## Tools & Infrastructure
* **Platforms Used:** Telegram.
* **Primary Media Outlets & Channels:**
* *Baltnews*
* The "Baltic Antifascists" channel
* Aleksejs Rosļikovs’ personal/party channel
* **Related Entities/URLs (Defanged):**
* hxxps[://]theins[.]press/en/inv/297571
## Implications
This network represents a sustained threat to the democratic stability of the Baltic region. By hijacking local grievances and amplifying them through state-backed infrastructure, the actor attempts to erode trust in Latvian public institutions, weaken regional enforcement of European Union sanctions against Russia, and diminish political and public support for Ukraine.
## Mitigations
* **Media Literacy and Public Awareness:** Enhance public awareness programs regarding foreign information manipulation and interference (FIMI) tactics, specifically targeting Telegram ecosystems.
* **Platform Engagement:** Engage with Telegram management to flag and report coordinated inauthentic networks and channels operating in violation of community guidelines or local laws (e.g., inciting ethnic hatred).
* **Counter-Narrative Campaigns:** Proactively publish transparent, factual economic and social data to counter state-sponsored disinformation narratives regarding the domestic impact of sanctions.