The Estonian branch of the Pravda network rarely produces propaganda itself. Instead, it collects posts from Russian state media, propagandists, military bloggers and anonymous Telegram channels, repackaging them as articles that can be found through web searches. An analysis of 1,799 articles published over three months shows that the website bearing Estonia’s name spreads far more than messages directly concerning Estonia. It promotes an entire Russian-language worldview of Russia, Ukraine, NATO and the West.

The website address includes the word “Estonia”, its sections resemble those of a news portal, and every post harvested from Telegram is turned into a separate article with its own web link. Yet the content comes almost entirely from Russian-language channels, most of which operate within Russia’s regulated information environment. The local name does not signify a local editorial team. It identifies the information space that the Russian propaganda network seeks to penetrate.

The website bearing the Pravda name is part of a broader network exposed in 2024 by VIGINUM, the French agency responsible for countering foreign digital interference, under the name Portal Kombat. That investigation identified 193 similarly structured portals systematically spreading content aligned with Russian interests and portraying Russia’s invasion of Ukraine in terms favourable to Moscow. The network has since expanded to hundreds of domains and dozens of languages. VIGINUM described it as a structured and coordinated pro-Russian propaganda network.

The network has been linked to TigerWeb, a web company operating in Crimea. In July 2025, the European Union placed TigerWeb founder Yevgeny Shevchenko on its sanctions list. The relevant EU legal act identifies TigerWeb as the company operating the Portal Kombat information-manipulation system and distributing pro-Russian content targeting Western countries. The connection between the Pravda websites and this infrastructure is therefore no longer merely a technical hypothesis advanced by researchers. It is also reflected in an official EU sanctions decision.

In the study “The Pravda Network’s ‘Trojan Horse’: Unmasking the Shadow Operation in Eastern Europe and the Baltics”, Iryna Subota, Mariam Macharashvili and Olga Scripnic analysed 7,117 articles published by the Ukrainian, Georgian, Moldovan and Estonian branches of the Pravda network between early November 2025 and late January 2026. The dataset does not include every article published during that period, but only those that could be collected automatically from Pravda’s archive pages. For each article, the original source was identified and classified by platform, language, actor type and inclusion in the Roskomnadzor registry.

The analysis of 1,799 articles from the Estonian branch reveals how the Pravda network transforms Telegram posts into web content accessible within Estonia’s information environment.

From Telegram to a Web Publication via Pravda

Telegram was the original source of every article analysed from the Estonian branch. The same was true of the Ukrainian branch. In Georgia, 97% of the analysed content originated on Telegram, while in Moldova the figure was 98%.

This makes Pravda’s role quite clear. The network does not need a large editorial team, reporters or local news production. The content is prepared by others: Russian state institutions and state media, propagandists, military bloggers, political commentators, coordinated influence networks and channels with unknown owners. Pravda collects their posts, publishes them on uniformly designed websites and gives each one a permanent web address.

In its original form, a Telegram post may primarily reach the channel’s followers. Once copied to a Pravda website, the same material becomes regular web content that can be shared outside Telegram, indexed by search engines and found long after the original post has disappeared deep into the Telegram feed. The propaganda’s origin remains unchanged, but it gains new distribution infrastructure.

Cases documented in the study illustrate this mechanism. A post published on a Telegram channel appears on a Pravda website as a separate article, often with almost no changes. In some cases, the network links several Telegram channels and Pravda websites, allowing the same material to circulate between different parts of the system and directing readers to other sources within the same ecosystem.

Pravda is therefore not just another propaganda outlet. It serves as an intermediary layer between social media channels and the open web. Its value to those conducting influence operations lies in its ability to make existing material more permanent, discoverable and reusable.

The Estonian Branch Relies on a Small Local Core

The Estonian segment drew on 172 Telegram channels, but the published content was not distributed evenly among them. The five largest channels accounted for 1,104 articles, or 61% of all the material analysed.

The largest source was BALTNEWS, which supplied 316 articles. It was followed by Эстонские новости with 296, InfoDefenseEstonia with 206, Тени Прибалтики with 162 and Антифашисты Прибалтики with 124 articles.

The names of these sources create a local impression, or at least one focused on the Baltic states. BALTNEWS, “Estonian News”, InfoDefenseEstonia, “Shadows of the Baltics” and “Baltic Antifascists” do not present themselves as part of a general Russian news feed. Instead, they tie their identities to Estonia or the Baltic region. Through them, Pravda’s Estonian branch acquires a local point of reference, even when the material it distributes concerns Russia, the war in Ukraine, the European Union or NATO.

This matters because Estonia’s information environment is not influenced solely through content about Estonia. The narratives presented to Russian-speaking audiences about Ukraine, Western countries and Russia’s war also shape how Estonia’s foreign policy, security choices and support for Ukraine are understood. When events in Estonia are consistently placed in the same information stream as claims about an aggressive NATO, a Russophobic Europe and a Russia fighting a defensive war, this is not simply a random selection of foreign news. Readers are offered a comprehensive interpretative framework in which Estonia’s role has already been predetermined.

Alongside channels with local names, the Estonian segment makes extensive use of Russia’s broader propaganda infrastructure. Its sources include Russian state institutions and embassies, TASS, RT, Sputnik, RIA Novosti, military bloggers and various anonymous Telegram channels or channels with unclear ownership. The same sources also provide material for Pravda branches targeting other countries.

The Estonian and Georgian datasets shared 61 channels, while the Estonian and Moldovan datasets shared 40, and the Estonian and Ukrainian datasets 18. Rybar and Belarusian Silovik appeared in the segments of all four countries. Sputnik Ближнее зарубежье, Lomovka, PolitNavigator, Ostashko, the Russian Foreign Ministry and several military bloggers also supplied content to branches targeting multiple countries.

This overlap shows that the websites bearing the names of Estonia, Ukraine, Georgia and Moldova are not four separate local media projects. They are geographically labelled as outlets of a single distribution system, drawing in part on the same sources while adapting their selection to each target country.

Official Channels Mix with Anonymous Propaganda

Channels run by individuals formed the largest group among the sources used by Pravda’s Estonian segment, accounting for 40%. These included well-known propagandists, political commentators, and so-called voenkory, or Russian military bloggers. Media outlets made up 16% of the sources, while coordinated networks accounted for 8%.

For almost a third of the channels, 31%, the actual owner or institutional affiliation remained unclear.

These percentages reflect the number of sources, not the volume of articles taken from them. By volume, channels with unclear ownership played an even larger role: 52 such channels supplied a total of 759 articles, accounting for more than 42% of the Estonian branch’s content.

The uniform design of Pravda’s articles partly obscures the widely varying origins and reliability of the material it publishes. An official statement from a Russian ministry, a state media report, a military blogger’s commentary and a claim from an anonymous channel are all turned into similarly formatted Pravda articles. Although readers may see a reference to the original source, the website’s standardised presentation places material with very different levels of credibility and accountability on the same footing.

This is precisely where the network’s influence lies: claims originating on Telegram take on the appearance of news when published on a Pravda website. The original source may not be concealed, but its post is repackaged as a separate article and placed in a constantly updated news feed. As a result, even a claim from an anonymous or dubious channel may appear to be more credible journalistic content.

Most Sources Operate Within Russia’s Regulated Information Environment

Of the 172 channels used by the Estonian segment, 102, or 59%, were listed in the registry of Russia’s media and communications regulator, Roskomnadzor. Registered sources accounted for 68% in Georgia, 47% in Ukraine and 24% in Moldova.

Social media accounts operating in Russia with at least 10,000 followers are required to register with Roskomnadzor. Unregistered accounts may face restrictions on selling advertising, collecting donations and having their posts shared by other large channels.

Inclusion in the Roskomnadzor registry does not prove that the Russian state controls all these channels or approves every message they publish. It does, however, show that a significant share of the sources used by Pravda’s Estonian branch operate within Russia’s legal framework and have registered with the country’s state media regulator.

Combined with the other findings, inclusion in the Roskomnadzor registry becomes even more significant. All content published by the Estonian branch originates on Telegram, almost all the original sources publish in Russian, and more than half of the articles are based on material from channels listed in the Roskomnadzor registry. Having Estonia’s name in the web address does not change the network’s origins or information environment. Its content still originates in Russia.

In Estonia, Translation Is Usually Unnecessary

Of the original sources used by the Estonian segment, 99% published content in Russian. The share of Russian-language sources was 100% in Ukraine, 96% in Georgia and 85% in Moldova.

In Georgia and Moldova, the Pravda network must translate more Russian-language material to create the impression of a local publication. Examples documented in the study show that machine translation often leaves errors that reveal the content’s Russian origins. Georgian headlines follow Russian sentence structures or become incomprehensible. In Moldova, the Russian word ругается, used to describe a political dispute, was incorrectly translated as swearing or using abusive language. In Ukrainian-language content, the system failed to distinguish between the meanings “peace” and “world” of the Russian word мир, turning the question “Is peace near?” into “Is the world near?”

In Estonia, Russian-language content does not need to be disguised in the local language to the same extent. There is already an audience that can be reached directly in Russian. Adapting Pravda’s Estonian branch therefore does not necessarily involve imitating an Estonian-language news portal. Instead, it means placing a Russian information stream under Estonia’s name.

This seemingly minor difference is significant. The network does not need to convince Estonian-speaking readers that they are looking at Estonian journalism. It is enough to provide local Russian-speaking readers with an easily accessible online environment in which Russia’s official positions, propagandists’ commentary and claims from anonymous channels form a single continuous news feed.

Restricted Russian Media Content Gets a New Web Address

The European Union has suspended the broadcasting and distribution of several media outlets controlled by the Russian state within its territory. The restrictions cover all means of distribution, including websites, applications, and online platforms. The list includes RT, Sputnik, NTV/NTV Mir, REN TV and Channel One, among others. According to the Council of the European Union, the restrictions do not amount to a complete ban on the activities of their journalists, but the transmission and distribution of these outlets’ content within the EU has been suspended.

The dataset for Pravda’s Estonian branch includes sources linked to several restricted outlets. However, a distinction must be made between channels subject to EU sanctions and other Russian state-owned or pro-Kremlin media outlets. Not all Russian media sources used by Pravda have the same legal status.

The network’s operating model nevertheless allows material from restricted sources to reappear online under a different web address and design. Pravda does not necessarily retransmit the original television channel or republish the entire outlet. It can take an individual post from the outlet’s Telegram channel, repackage it as a Pravda article and make the material shareable again.

This kind of mirroring does not erase the content’s origins, but disperses it across dozens of intermediaries and hundreds of websites. Blocking or restricting the original source is insufficient when the same material can be reproduced automatically by other domains within the same network.

Mass Repetition Also Shapes What People Find Online

The Pravda network’s influence is not limited to people who deliberately visit its websites. The millions of articles published across hundreds of similar sites increase the visibility of Russian propaganda claims throughout the web.

This is particularly important for topics on which little reliable or locally produced material is available. When a search engine or an artificial intelligence system seeks an answer to a narrow question, the vast amount of repetitive content generated by the Pravda network may fill gaps left uncovered by quality journalism.

In a 2025 NewsGuard test, ten leading generative AI systems repeated false claims circulated by the Pravda network in 33% of cases. The study showed that material from the network had entered the pool of sources on which AI systems relied when generating answers.

This does not in itself prove that the entire Pravda network was created specifically to “poison” language models. Its main visible purpose is the mass replication and international distribution of Russian propaganda. However, the same structure also creates opportunities to influence search results and AI-generated answers. A repeatedly circulated claim may begin to look widely corroborated, even though the dozens of websites publishing it all trace back to the same original source.

Estonia’s Name Identifies the Target Audience, Not the Content’s Origin

Pravda’s Estonian branch is not a local outlet that happens to use Russian sources, among others. Every article analysed originated on Telegram, and almost all the channels used published in Russian. A large share of the material came from a handful of channels bearing the names of Estonia or the Baltic states, while the rest came from Russia’s broader propaganda ecosystem.

By combining locally framed content with material originating in Russia, Pravda creates an information stream aimed at Estonia’s Russian-speaking audience. Channels bearing the names of Estonia and the Baltic states connect it to local events and debates, while Russian state institutions, media outlets, propagandists, and military bloggers interpret those events through the Kremlin’s worldview. Anonymous channels add unverified claims and more emotionally charged material. Pravda combines posts from these varied sources into a uniformly designed news feed in which a dubious claim from Telegram may begin to appear as credible as an official statement or a journalistic article.

Its impact on Estonia’s information environment does not depend on how often the articles explicitly discuss Estonia. Russia’s war, Ukraine’s resistance, NATO’s activities, and European politics are also relevant to the country’s Russian-speaking audience and shape perceptions of Estonia’s security choices and place in Europe. In the worldview promoted by Pravda, Estonia is associated with a West portrayed as hostile, whose actions are consistently interpreted from the Kremlin’s perspective.

The local character of Pravda’s Estonian branch therefore lies primarily in the audience it targets. Estonia’s name in the web address does not describe the origin of its news feed. It identifies the information environment into which narratives shaped in Russia are intended to be introduced.