Estonia’s internal security service has recorded a sharp rise in Russian-linked intelligence activity, including expanded use of online propaganda and recruitment networks. Authorities say they disrupted multiple operations and detained a record number of individuals acting in the interests of Russian intelligence. According to official data, 16 people were arrested in 2024 on suspicion of involvement with Russian espionage, the highest annual figure to date. The findings are outlined in this report on record arrests linked to Russian intelligence activity in Estonia.
shift towards decentralised recruitment and “disposable agents”
Security officials highlight a notable shift in tactics following the expulsion of Russian intelligence officers operating under diplomatic cover across Europe. Russian services are increasingly recruiting individuals locally, including citizens, tourists and dual nationals, often without full awareness of the broader operational context. These recruits are typically tasked with low-level activities such as surveillance, vandalism or arson, aimed at testing responses and creating disruption. Authorities describe them as “disposable agents”, selected for their vulnerability, criminal background or susceptibility to online manipulation.
digital platforms central to influence and coordination
The report underscores the growing role of online ecosystems in facilitating both propaganda dissemination and operational coordination. Informal networks operating عبر social media platforms are used to identify targets, spread narratives and establish contact with potential recruits. Estonian officials warn that such activity contributes to a broader effort to shape public perception, amplify divisions and create an environment conducive to destabilisation. The convergence of information operations and intelligence tasks reflects an increasingly integrated approach.
baltic region remains priority target for hybrid activity
Estonia and neighbouring Baltic states are assessed as high-priority targets due to their strategic position on NATO’s eastern flank and their consistent opposition to Russian policy. Intelligence activity in the region is viewed as part of longer-term preparation for hybrid operations that could include both internal destabilisation and external pressure. Officials note that vulnerable communities and marginalised groups are frequently targeted as entry points for influence and recruitment.
implications for european security and alliance cohesion
The increase in such operations is seen as a test of resilience within both the European Union and NATO. By combining espionage, sabotage and information campaigns, Russian services aim to strain institutional capacity and public trust. Estonian authorities stress that the objective extends beyond immediate disruption to probing the cohesion and response mechanisms of allied structures. The evolving tactics underline the need for coordinated countermeasures across member states.
