TALLINN, Estonia — A fabricated story about Portuguese F-16 fighter jets being damaged at Estonia’s Ämari Air Base has been identified as part of a coordinated Russian influence operation, according to a new study by the Atlantic Council’s Digital Forensic Research Lab. The false report first surfaced on the social media platform X on 6 August. It claimed that a Ukrainian drone shot down in Estonian airspace had scattered debris across the air base, wrecking two Portuguese Air Force F-16s and causing an estimated €120 million in damage. There was no such incident. The claim nevertheless circulated quickly in Portuguese-language social media accounts and was designed to look like legitimate reporting. Within days, Propastop, an Estonian outlet specializing in disinformation analysis, published a detailed dissection of the hoax. Propastop showed that the story was built on a cloned version of a well-known defense news website and amplified by accounts that have since been linked to a Russian influence network known as Storm-1516. The Atlantic Council’s DFRLab, in a 17 September report, confirmed that the Ämari falsehood was not a one-off fabrication but part of a damaging campaign targeting NATO and its member states. The operation was part of a wave of at least four coordinated attacks aimed at the Baltic states over a period of about three weeks in late July and August, all intended to undermine faith in NATO, sow confusion, and weaken public support for Ukraine.
Propastop’s technical analysis revealed how the hoax was assembled. The fabricated article appeared on a fake copy of The Defense Post, a legitimate international defence publication. The original outlet is based at thedefensepost.com; the fake domain was thedefensepost.eu. According to Propastop, the fraudulent domain was registered on 3 August, only three days before the claim started circulating. The fake site copied an original article from The Defense Post and replaced its text with the invented story. However, the operation was not as clean as its creators intended. The source code of the fake page still contained the original article text, the name of the original author, share-link descriptions, and even the real website’s Google Analytics identifier. The cloned page also mentioned the legitimate domain 45 times while referring to the fake domain only five times. That combination of preparation and carelessness is characteristic of low-cost, fast-deployed influence operations. To bolster the false narrative, the publishers added an AI-manipulated video. It used original footage from the Estonian Defence Forces, then inserted a clip of burning aircraft wreckage. The edited video gave the false report a veneer of visual evidence, but the underlying material could be traced to authentic Estonian military videos. The result was a story that looked plausible enough to be shared by accounts whose users might not check the domain carefully, yet was vulnerable to technical examination.
The first known post was published in Portuguese on X by Raphael Machado at 9:51 a.m. on 6 August. Accounts followed by Lucas Leiroz and others. Most of the accounts that spread the false report were pro-Russian and connected to Portugal or Portuguese-speaking communities. The language and timing indicate a deliberate attempt to influence Portuguese public opinion. Portugal contributes to NATO’s air-policing missions and has been a visible supporter of Ukraine, making it a useful target for narratives intended to make NATO deployments appear costly and dangerous. The false story presented Portuguese hardware as destroyed, Estonian airspace as violated by Ukrainian drones, and NATO’s eastern flank as chaotic. According to Propastop, the initial analysis already suggested that the attack aimed to damage NATO’s reputation, undermine support for Ukraine, and affect Portugal’s political debate. By inventing an incident in which Ukrainian activity harms NATO allies, the operation tried to exploit both pro-Russian and anti-war sentiment. It also sought to create friction between allies, implying that Estonia’s hosting of NATO troops and aircraft could put allied assets at risk. The use of Portuguese-language accounts with pro-Russian track records allowed the falsehood to enter the mainstream via local voices, making it harder for casual readers to recognise as foreign propaganda.
DFRLab’s 17 September study connected the dots. The report described Storm-1516 as a Russia-linked disinformation network whose activities have been publicly attributed to Russia’s military intelligence agency, the GRU. Technical and organisational links have also been found to earlier operations associated with Yevgeny Prigozhin, the late Russian mercenary chief. Storm-1516 has become known for creating fake personas, cloned media sites and fabricated documents to spread false narratives in Western countries. The Ämari affair was a textbook example. DFRLab noted that the first spreader, Raphael Machado, is the leader of the Brazilian organisation Nova Resistência. French authorities’ VIGINUM unit, which monitors foreign influence operations, had earlier identified Nova Resistência as an amplifier of Storm-1516 campaigns. Lucas Leiroz, another key amplifier, is also linked to Nova Resistência and has worked for pro-Kremlin media outlets. These connections place the Ämari story within a known international network rather than treating it as an isolated amateurish fake. The same network has been used to spread Russian messaging in multiple countries, operating as a multiplier for content produced by or aligned with Russian intelligence. By identifying Machado and Leiroz, DFRLab was able to show that the people spreading the Ämari disinformation were not independent commentators but part of a coordinated operation that uses local influencers to launder Russian narratives.
The Baltic region was the target of a broader wave of attacks. Between 30 July and 17 August, DFRLab identified four disinformation campaigns aimed at Estonia, Latvia and Lithuania. The first was the Ämari report. The others included fabricated allegations linking the presidents of Estonia and Lithuania to Jeffrey Epstein; a false report claiming NATO soldiers were killed during an exercise in Latvia; and a misleading claim that only a few Latvians called up for military service had reported for duty. Each campaign was designed to exploit a local vulnerability: security, political reputation, the credibility of NATO, and social cohesion around conscription. The campaigns also shared operational features. They misused the visual identities of well-known media outlets, making fake websites look like established news brands. They circulated fabricated or manipulated videos to create a false sense of authenticity. They relied on social media accounts previously linked to Storm-1516 activity, which made it easier to launch coordinated bursts of sharing across different platforms. Across seven online platforms, DFRLab identified a total of 275 reports or posts connected to the campaigns. Some accounts amplified more than one false report, indicating cross-posting between different Baltic campaigns. This pattern suggests a single influence operation with multiple lines of attack, rather than unrelated hoaxes. The repetition of methods also allows researchers to attribute new fakes with increasing confidence, as the appearance of fake news sites, familiar amplifiers and certain visual markers can all be compared to previous operations.
The Ämari case has become a useful study for researchers in the Baltic states and beyond. In October, the disinformation research company Refute published an overview highlighting Propastop’s work as an example of how the Baltic states can quickly detect and expose influence operations. Refute observed that Russia-linked campaigns increasingly use cloned news websites, AI-generated videos and false claims spread in multiple languages. These methods are cheap and reusable, allowing the same basic playbook to be adapted to different countries and crises. The case demonstrates why it is important to examine not only the content of a false report but also its technical structure, the timing of its spread, and the first accounts to share it. Propastop’s August analysis identified the forgery and documented how it spread. DFRLab’s September study placed the case in the context of an international influence network. Refute’s October overview then highlighted the importance of local investigations to wider resilience. If one false story is examined in isolation, it can appear to be the work of a single blogger. Looked at together with cloned websites, manipulated video, known operators and multiple simultaneous campaigns, the pattern is unmistakable. For democracies, the lesson is that spending effort on rapid open-source analysis pays off in making hidden networks visible. The Estonian experience also shows that smaller countries can play an outsized role in countering disinformation by sharing technical findings with international researchers. The Ämari false report was defeated not by a single content-moderation decision, but by a chain of investigations that separated the facts from the fabrication and exposed the broader operation behind it.