A coordinated Russian disinformation network spreading false narratives across Europe operates through a German-language website attracting 100,000 monthly visitors, financial infrastructure in Czech Republic and Bulgaria, and amplification channels linked to Russia's FSB intelligence service, according to an investigation by OCCRP.
The network, centered on Anonymous News, produces false stories discrediting Ukraine and Western leaders supporting Kyiv while promoting Kremlin talking points. Its structure reveals the sophisticated infrastructure behind Russian information operations targeting European democracies—operations that Baltic counter-intelligence agencies, drawing from three decades of experience on NATO's eastern flank, have become European leaders in detecting.
In the Baltics, as on NATO's eastern flank, geography and history create an acute awareness of security realities. Estonia, Latvia, and Lithuania face disproportionate targeting from Russian disinformation due to their Russian-speaking minorities, proximity to Russia, and front-line NATO position—making Baltic expertise critical for understanding these operations across Europe.
The Network Infrastructure
Mario Rönsch, a German far-right activist previously convicted of weapons trafficking, emerged as the public face of Anonymous News. He launched a Moscow-based YouTube channel promoting positive portrayals of Russia, claiming to deliver "authentic, uncensored and always committed to the truth" coverage. Rönsch had previously operated large far-right channels before pivoting to pro-Russia content following Moscow's 2022 invasion of Ukraine.
The operation's financial infrastructure reveals deliberate obfuscation. Reader donations flowed through a Czech company nominally owned by Ivelin Borisov, an impoverished Bulgarian villager who admitted signing papers for approximately 200-300 euros without understanding the arrangement. A Czech administrator confirmed a "German man she knew only as Mario" orchestrated the setup—a classic cutout structure designed to hide beneficial ownership and evade sanctions.
Most revealing: amplification came from Alexey Bashilov, a Russian operating Telegram accounts spreading Anonymous News content. His phone contacts included FSB department numbers, and his registered address linked to FSB headquarters on Bolshaya Lubyanka in Moscow. His Telegram channel "Woland's Notes" garnered shares from prominent Kremlin propagandists and Russian lawmakers, demonstrating direct connection to Russia's state disinformation apparatus.
Disinformation Campaign Examples
The network produced baseless claims linking French President Emmanuel Macron to Jeffrey Epstein, citing non-existent emails from released documents. False articles appeared on cloned websites impersonating legitimate outlets like France-Soir. These narratives spread rapidly across X (formerly Twitter) and Telegram before amplification networks picked them up.
France's Viginum disinformation monitoring service attributed the campaign to "Storm-1516," publicly linked to Russian military intelligence Unit 29155—the same GRU unit implicated in the 2018 Salisbury poisoning in the United Kingdom, attempted coup in Montenegro, and numerous other hostile operations across Europe.
The attribution reveals Russian military intelligence's direct involvement in information operations alongside the FSB's efforts—a coordinated approach utilizing different intelligence services' capabilities for comprehensive hybrid warfare campaigns.
Baltic States as Primary Targets
While Anonymous News focused on German-language audiences, Baltic states face particularly intense Russian disinformation targeting. Their Russian-speaking populations—approximately 25% in Estonia and Latvia—create opportunities for Russian-language information operations that bypass language barriers affecting other European countries.
Recent Estonian observations document systematic anti-Estonian content campaigns across social media. Random YouTube videos mentioning Estonia attract hundreds of hostile comments from accounts making absurd claims: that Estonia is "meaningless," that Estonians are "starving and freezing," that the country lacks viability. Similar patterns target Latvia and Lithuania.
These operations serve multiple purposes: undermining Baltic states' international reputation, testing NATO cohesion, attempting to demoralize Baltic populations, and creating ambiguity about genuine sentiment versus manufactured hostility. Estonian security service KaPo recently identified a "Narva Republic" separatist campaign as a Russian information operation—part of the same broader strategy.
European Counter-Disinformation Challenges
While individual channels maintain modest subscriber counts, experts note the coordinated ecosystem gradually erodes trust in institutions. As disinformation researcher Katarina Bader explained, regular exposure to such narratives causes audiences to "consider almost everything as potential propaganda," regardless of whether they believe specific claims.
This erosion of information trust serves Russian strategic interests even when specific false narratives fail to convince. If European populations cannot distinguish reliable information from disinformation, democratic deliberation becomes impossible and Russia achieves its objective of degrading Western decision-making capacity.
Baltic counter-intelligence agencies have pioneered response strategies: rapid public disclosure of disinformation campaigns, media literacy education, fact-checking infrastructure, and sharing expertise with European partners. Tallinn hosts NATO's Cooperative Cyber Defence Centre of Excellence, positioning Estonia as an alliance leader in information security.
The three Baltic states' experience managing Russian information operations since regaining independence in 1991 provides institutional knowledge that larger Western European countries often lack. Estonian, Latvian, and Lithuanian security services understand Russian strategic thinking, recognize manipulation techniques, and monitor Russian-language information ecosystems more effectively than agencies without similar historical experience.
The Broader European Threat
The OCCRP investigation's exposure of Anonymous News infrastructure demonstrates that Russian disinformation targeting Europe operates as a systematic, intelligence-directed enterprise rather than organic far-right activism. The FSB and GRU connections, Moscow-based production, and coordinated amplification reveal state resources devoted to undermining European cohesion.
As European Parliament elections approach and multiple member states face national elections, Russian disinformation infrastructure stands ready to exploit political divisions, amplify extremist voices, and undermine support for Ukraine. The Anonymous News network represents one visible component of a much larger apparatus.
Baltic expertise in detecting and countering these operations makes Estonia, Latvia, and Lithuania critical partners for European security—their small size offset by frontline experience and digital sophistication. When Russian disinformation targets Europe, Baltic counter-intelligence agencies often provide the early warning systems and analytical frameworks that larger European nations are still developing.
The coordinated nature of Russian information operations—spanning multiple countries, languages, platforms, and intelligence services—requires equally coordinated European responses. Baltic states' willingness to share counter-intelligence expertise reflects their understanding that Russian disinformation threatens not just individual countries but the entire European security architecture that protects small democracies from aggressive neighbors.
