Have Russian disinformation methods in the Nordic region changed? We investigate

The Norwegian Police Security Service warns that the threat from Russian intelligence and sabotage in Norway and the Arctic will increase significantly in 2026, focusing on allied military installations, exercises, Oslo’s support for Ukraine, and operations in the High North and the Arctic. The Nordic region has become one of the main theatres of Russia’s hybrid war, and the scale and variety of attacks are systematically growing.

The most spectacular new method is the infiltration of large language models such as ChatGPT and Microsoft Copilot. Nordic fact-checking organisations Faktabaari, TjekDet, Källkritikbyrån, and Faktisk conducted a test in 2025 which showed that chatbots, when answering questions in Nordic languages, sometimes replicate Russian propaganda. The most telling example concerned the false information about the death of a Danish F-16 pilot in Ukraine. When asked in Danish whether a Dane had died in an attack on a flight school in Kryvyi Rih, Microsoft Copilot answered affirmatively, citing as its only source the Danish version of the Pravda portal. ChatGPT gave a more balanced answer, pointing to conflicting reports, but the very fact that chatbots were replicating this narrative is worrying.

This practice, known as “LLM grooming,” involves contaminating artificial intelligence systems with automated propaganda. Russia uses a network of over 180 internet domains that replicate thousands of articles from Kremlin-controlled disinformation outlets such as RT, RIA Novosti, Lenta, and Tsargrad TV in multiple languages. In this way, false narratives reach AI systems, which then disseminate them as “facts” to users across the Nordic region.

Cyberattacks and sabotage, from disinformation to physical disruption

Russian hybrid operations in the Nordic region extend far beyond disinformation alone. They increasingly take the form of direct cyberattacks and physical sabotage, which have real consequences for critical infrastructure and the safety of citizens. In 2024, hackers linked to Russia carried out a destructive cyberattack on a Danish water treatment plant, gaining access to the control system and increasing water pressure, causing pipes to burst and depriving residents of water access. Former Danish Defence Minister Troels Lund Poulsen officially blamed Russia for the attack.

In 2026 alone, Denmark recorded 247 hacker attacks, the highest number among the Nordic countries. Most were DDoS attacks on the websites of public institutions and critical infrastructure companies, but there have also been successful intrusions into monitoring systems. In April 2025, unauthorised individuals gained digital access to a fish hatchery dam in Bremanger, Norway, controlling the panel for four hours and increasing water flow. Norwegian police linked the incident to Russian hacker groups. These attacks demonstrate that Russia is not only spreading disinformation but is actively testing the resilience of Nordic critical infrastructure, using hybrid methods to physically disrupt the functioning of states.

Norwegian alternative media as a channel for propaganda transfer

A new quality in Russian disinformation operations is the use of domestic, anti-establishment alternative media as an effective channel for transferring Kremlin narratives. An investigation published in January 2026 revealed that two Norwegian portals, Steigan.no and Derimot.no, systematically disseminate Russian propaganda, reaching over 200,000 readers per month. Steigan.no, run by former Maoist leader Pål Steigan, attracts nearly 165,000 visits per month and has been identified for years by Norwegian researchers as a hub for Russian propaganda and conspiracy theories. The portal uses Russian state terminology, referring to the invasion of Ukraine as a “special military operation” and describing it as an effort to “liberate a fraternal people from a militaristic dictatorship infected with Nazis.” Steigan.no regularly cites sanctioned Russian state media such as Sputnik, RT, and RIA Novosti as credible sources, which is an example of “source laundering,” giving Russian narratives a Norwegian voice and facilitating the circumvention of EU sanctions. Derimot.no operates on a similar principle, and both platforms function as a repetitive disinformation pipeline: they take a Kremlin narrative, wrap it in Norwegian anti-elite language, cite Russian state sources as facts, and add an emotional hook encouraging sharing. This shows that Russia no longer needs to create its own media in the Nordic countries; it successfully infiltrates and exploits existing domestic platforms that enjoy the trust of a segment of society.

Trolling of the Russian-speaking community, precision targeting of weak points

Russian disinformation operations have also become more precise and tailored to local conditions. A study published in July 2026 by Cambridge University Press analysed a trolling campaign targeting a Russian-speaking Facebook group in Finland in 2024. The researchers identified two strategies, “thick” and “subtle” trolling, which provoked emotional reactions and prompted users to reproduce propaganda narratives, reinforcing existing tensions. The key point of vulnerability turned out to be the belief that the Russian-speaking audience “has no home” in Finland. Trolls drew on local media content and socio-cultural tensions, making their messaging more credible. Although some users succumbed to provocation, others resisted it, restoring group cohesion. The study emphasises the importance of micro-level analysis to understand audience vulnerabilities and recommends recognising the “pain points” of target groups and incorporating them into public discourse as members of multicultural societies. This shows that Russian disinformation in the Nordic region is no longer a mass, non-selective campaign but a precise tool exploiting local tensions and vulnerabilities of specific social groups.

Anti-NATO narratives and pre-election campaigns

With the accession of Sweden and Finland to NATO, Russian disinformation narratives in the Nordic region have shifted towards undermining the alliance and creating the impression that the Nordic countries are being drawn into a conflict with Russia. A recurring motif is accusing the Nordic and Baltic countries of “Nazism,” a narrative used against Finland for years, which intensified in 2025 through organised legal actions, destruction of monuments, political statements, and open threats. In June 2026, the Russian group “Our Victory” placed posters at bus stops in Russia accusing Swedish national heroes, Astrid Lindgren, Ingvar Kamprad, and Ingmar Bergman of Nazism. The Swedish Ministry of Foreign Affairs confirmed that the campaign is the work of a Russian group.

Equally significant are disinformation operations related to elections. The rise in Russian disinformation on NATO’s eastern flank may be linked to upcoming parliamentary elections in Latvia and Estonia. Russia accuses the Baltic countries of enabling Ukraine to use their airspace for drone attacks on Russian oil infrastructure. Intelligence services emphasise that Russia has for years threatened alleged deportations of Russian-speaking residents, which the Kremlin portrays as “deportations.” In response, the foreign ministers of the Nordic and Baltic countries issued a joint statement in May 2026, firmly rejecting the Russian disinformation campaign.

GPS jamming, shadow fleet, and underwater operations, hybrid warfare in the Baltic

Russian activities in the Nordic region also include extensive operations at sea and in airspace. There have been numerous instances of GPS jamming and spoofing in Sweden, Estonia, and Finland, which have sometimes caused disruptions to civil aviation. Russian warships and civilian vessels are conducting reconnaissance of the seabed and critical infrastructure in Denmark, Norway, Finland, and Sweden. Between 2024 and 2026, 144 suspicious drone observations were identified in Europe. Russia likely used shadow fleet ships to launch drones over NATO territory, disrupting civil aviation, monitoring military installations, and testing air defence systems. Denmark confirmed the presence of drones in its airspace in September and October 2025. Since 2022, there have been numerous incidents of damage to fibre optic cables and pipelines in the Baltic Sea, including the explosion on the Balticconnector gas pipeline linking Finland and Estonia in October 2023. In January 2022, a fibre optic cable linking Svalbard to Norway was severed. These actions demonstrate that Russia is systematically probing the resilience of Nordic critical infrastructure, using a wide range of hybrid methods to identify weaknesses and destabilise the region.