Latvian security services have exposed an alleged agent network connected to Russia’s Federal Security Service that operated inside Latvia and focused on surveillance, propaganda and preparatory activities against NATO and supporters of Ukraine. Information about the network became public on January 18, 2026, revealing a structure coordinated by individuals with long-standing ties to Russian intelligence and centred around a Telegram-based influence ecosystem, as documented in an investigation into FSB-affiliated “useful patriots” active in the Baltic region.
According to Latvian authorities, the network was led by Sergei Kolesnikov and Sergei Vasiliev. Vasiliev, who now resides in Russia and portrays himself as a political émigré, runs the Telegram channel “Antifashisty Pribaltiki”, which investigators describe as a key tool for recruitment, coordination and ideological mobilisation.
Telegram as an infrastructure for intelligence and mobilisation
Latvian law enforcement considers the Telegram channel “Antifashisty Pribaltiki” to be the backbone of the network. Its audience consists largely of individuals who consume and amplify narratives portraying the Baltic states as territories “occupied by Anglo-Saxons”, a framing typical of Russian information and psychological operations designed to legitimise potential military intervention.
The network’s members came from diverse social backgrounds, including an entrepreneur burdened with debts exceeding €40 million, a Chechen war veteran who left Russia after the adoption of the so-called Yakovlev law, and a security guard working at a Riga supermarket. Investigators stress that access to classified information was not a prerequisite for participation. Loyalty to the Kremlin and willingness to observe, report and amplify narratives were sufficient to make individuals operationally useful.
Surveillance of NATO and Ukraine supporters
Latvian authorities say the group collected information on Ukrainian nationals and Russian expatriates in Europe who support Ukraine, as well as on NATO military personnel, bases and movements. Even fragmented observations, such as routine activity near military facilities or infrastructure, were deemed valuable, as they can be aggregated into a broader intelligence picture.
Experts note that similar reliance on local civilian informants played a role in Russia’s preparations for the invasion of Ukraine. In a potential escalation scenario, such networks could assist in disorienting local authorities, identifying vulnerabilities, facilitating targeting and supporting sabotage or influence operations.
Detentions and criminal proceedings
One of the identified informants was Iveta Balode, the wife of Sergei Vasiliev. Although she lived with him in Russia, she continued to travel to Latvia. On January 15, 2026, Latvia’s State Security Service detained Balode on suspicion of transferring classified information to Russian intelligence services.
Latvian investigators have also identified the core team behind the Telegram channel as including pro-Kremlin activists Stanislavs Bukains, Viktorija Matule, Romans Samulis, Aleksandrs Zhgun and Tatjana Andriets. Criminal proceedings have been initiated against them. Many of these individuals were previously active on IMHOClub, a Russian-language blogging platform launched in Latvia in 2011.
Recruitment for the Russian armed forces
Beyond intelligence gathering, the Telegram channel actively promotes contract service in the Russian military, encouraging Russian-speaking foreigners to enlist. Latvian authorities view this as an additional element of hybrid activity, combining propaganda, recruitment and psychological operations under a single информаційно-оперативна framework.
This blending of functions underscores how Russian intelligence structures integrate information warfare with military objectives, extending their reach beyond traditional espionage into social mobilisation and ideological conditioning.
A broader hybrid strategy against the Baltic states
Latvian officials and security analysts argue that the exposed network should be seen as part of a wider Russian strategy aimed at weakening NATO’s eastern flank. The Baltic states are viewed by Moscow as particularly vulnerable due to their size, geography, proximity to Russia and the presence of Russian-speaking minorities.
The case reinforces warnings that Russia invests in agent networks well before any open conflict, consistent with its hybrid warfare doctrine, where preparation unfolds over years. Authorities caution that pro-Kremlin activist circles should not be dismissed as marginal, but assessed as potential components of an influence and intelligence infrastructure.
Implications for regional security
For Latvia and its allies, the dismantling of the alleged FSB network highlights the importance of strengthened counter-intelligence cooperation, systematic monitoring of open-source environments and closer coordination between security services across the Baltic region. The focus, officials say, must extend beyond protecting classified information to addressing the exploitation of social media and civilian networks for hostile purposes.
The Latvian case illustrates that the front line of hybrid confrontation already runs inside NATO member states, underscoring the need for sustained vigilance against dispersed, low-level but strategically coordinated intelligence activity.
