It began like so many digital rumors do: a short, alarming post on social media, quickly followed by a flurry of shares, a dramatic video, and a headline that seemed tailor-made for outrage. In early August, users on X were confronted with a story claiming that a Ukrainian drone had been shot down over Estonian airspace, and that crashing debris had badly damaged two Portuguese Air Force F-16 fighter jets stationed at Ämari Air Base. The alleged repair bill, according to the story, was an eye-watering €120 million. The problem, of course, was that none of it had happened. There had been no drone, no shootdown, no damaged jets, and no Portuguese military emergency. Yet for a few hours, the story existed in a kind of gray zone where enough people could see it, share it, and wonder. It was only through the patient investigative work of Propastop, an Estonian research outlet focused on disinformation, that the entire house of cards began to collapse. The initial article on Propastop, published on 12 August, revealed that the false report was not simply a social media mistake or an exaggerated headline, but a carefully manufactured piece of deception. A fake version of the well-known defense news website The Defense Post had been created, with a domain registered just three days before the rumor broke. The real outlet lives at thedefensepost.com; the impostor was hosted at thedefensepost.eu. On the surface, it looked like a real news site. Underneath, though, it was a sloppy forgery. The fake article had taken an original piece from the real outlet and replaced the text with a fabricated story, but the site’s underlying code still contained the original author’s name, the original sharing text, and even the real website’s Google Analytics tracker. The fake domain was mentioned only five times in the code, while the real domain appeared forty-five times. It was, in every sense, a digital mask that kept slipping.
What made the attack so striking was not just the lie itself, but how much effort had gone into making it look credible, and how quickly the online machinery of manipulation went into motion. The first known post appeared at 9:51 in the morning on 6 August, published on X in Portuguese by an account named Raphael Machado. Within a short time, other accounts joined in, including Lucas Leiroz and a number of pro-Russian commentators who either lived in Portugal or operated in the Portuguese-language information space. This was not a coincidence. The choice of Portuguese was deliberate: the story involved Portuguese military equipment, Portuguese pilots, and Portuguese taxpayers’ money. The intended audience was clearly Portugal, and the intended effect was equally clear: to damage NATO’s reputation, to undermine public support for Ukraine, and to plant suspicion that Estonia, as a frontline NATO member, was recklessly drawing the alliance into dangerous territory. The accusation that a Ukrainian drone had somehow been shot down over Estonia and damaged allied jets was designed to provoke anger in two directions at once. To Portuguese readers, it suggested that their country’s soldiers were being put in harm’s way by reckless Eastern European allies. To global audiences, it suggested that NATO’s air policing mission was failing, that Ukraine’s military was operating beyond its borders, and that alliance solidarity was a fragile thing. Alongside the fake article, the architects of the campaign released an AI-manipulated video that appeared to show dramatic burning wreckage. The video had been assembled using genuine footage from the Estonian Defence Forces, then altered with a fabricated clip of burning aircraft remains. The presence of a video gave the rumor a sense of physical reality that written lies often lack. It was the kind of thing that could be watched, gasped at, and shared without any further thought.
But the initial Propastop analysis was only the beginning. In mid-September, the Atlantic Council’s Digital Forensic Research Lab, known as DFRLab, published a deeper study that connected the Ämari incident to something far larger than a single rogue website. DFRLab identified the campaign as part of a known Russian influence operation called Storm-1516, a network that has been publicly attributed to Russia’s military intelligence agency, the GRU. The case was also tied to earlier operations linked to Yevgeny Prigozhin, the late Russian businessman and Wagner Group founder whose methods of online disruption and deception set the standard for much of modern Russian disinformation. The DFRLab research revealed that the people who spread the Ämari story were not random internet troublemakers, but part of an organized ecosystem. Raphael Machado, the first person to post the rumor, was identified as the leader of Nova Resistência, a Brazilian organization that French authorities had already flagged as a known amplifier of Storm-1516 campaigns. Lucas Leiroz, who quickly picked up and amplified the story, was similarly linked to Nova Resistência and had worked for pro-Kremlin media outlets. In other words, the initial wave of posts was not a spontaneous eruption of suspicious curiosity. It was a coordinated release, carried out by known actors who are part of a broader network of influencers and accounts used to launch Russian messaging into foreign countries. By connecting Propastop’s specific discovery with DFRLab’s earlier research, it became clear that the fake Portuguese jet story was not an isolated hoax. It was a single branch of a much larger tree of influence operations, one that had already been mapped and traced back to the highest levels of Russian military intelligence.
The true scope of the operation became even clearer when DFRLab looked beyond Estonia and examined the wider Baltic region. Between 30 July and 17 August, the researchers identified no fewer than four separate disinformation campaigns targeting the Baltic states, all of them sharing common DNA. There was the Ämari incident, with its fabricated story of damaged Portuguese jets. There was a bizarre set of fabricated allegations linking the presidents of Estonia and Lithuania to Jeffrey Epstein, a name chosen for maximum sensationalism. There was a false report claiming that NATO soldiers had been killed during a military exercise in Latvia. And there was a misleading story suggesting that a large number of Latvians called up for military service had refused to report for duty. On the surface, these four stories look like very different pieces of content aimed at very different audiences. But when examined together, they reveal a coherent strategy: destabilize confidence in NATO, undermine trust in Baltic governments, exaggerate divisions within the alliance, and create general chaos. The campaigns shared a number of technical and stylistic features. They all misused the visual identity of well-known media outlets, either by cloning entire websites or by creating fake social media accounts that mimicked legitimate news organizations. They all used fabricated or manipulated videos. And they all relied on social media accounts that had already been associated with Storm-1516 activity in the past. In total, DFRLab identified 275 reports or posts connected to these campaigns across seven online platforms. The study also found that several accounts were responsible for amplifying more than one false story, which suggests that a relatively small group of operators can generate a disproportionately large amount of deceptive content by reusing the same networks again and again. The Baltic states, because of their location on NATO’s eastern flank and their particular sensitivity to Russian influence, appear to be an especially attractive target for this kind of hybrid warfare.
The broader importance of the Ämari case was highlighted in a later overview published in October by Refute, a disinformation research company. Refute pointed to Propastop’s investigation as an example of how the Baltic states have become surprisingly effective at quickly detecting and exposing influence operations. This is no small thing. For years, Russian-linked campaigns have been growing more sophisticated in their methods, relying on cloned news websites, AI-generated videos, and false claims spread in multiple languages all at once. These methods are cheap, reusable, and difficult to stop because they thrive on the very mechanics of social media: the speed of sharing, the emotional pull of outrage, and the human tendency to pass along something alarming before checking whether it is true. The Ämari case shows why it is not enough to debunk the content of a false report. To really understand an attack, you have to look at its technical structure, the timing of its spread, and the first accounts that shared it. The technical structure reveals whether the story was professionally manufactured. The timing reveals whether it was coordinated to coincide with a particular political moment or news cycle. And the first accounts reveal the human network behind the operation. Propastop’s original analysis did exactly that: it identified the forgery, traced how it spread, and documented the role of the first amplifiers. DFRLab’s study then placed the case within the larger international network, showing that the same patterns were appearing across Estonia, Latvia, and Lithuania. Refute’s overview, finally, highlighted the value of local investigative work in building wider resilience against hostile information campaigns.
What does all of this mean for the average person who simply wants to know what is true? The story of the Ämari false report is a reminder that disinformation is not a single lie told and then forgotten. It is a systematic effort to blur the line between fact and fiction, to make people suspicious of everything they read, and to drain the public’s emotional energy into constant outrage over events that never occurred. The fake Portuguese jet story was designed to make Estonians doubt the strength of their allies, to make Portuguese voters question the cost of their country’s commitments, and to make everyone else wonder whether the entire NATO alliance was on the verge of collapse. It did not succeed, largely because of the quick work of researchers who were willing to dig into the code of a fake website, examine the timing of a suspicious post, and link the dots between a Brazilian political organization and a French intelligence report. But the campaign also did not fail entirely. It forced journalists to spend time debunking it, distracted public attention into a defensive posture, and added one more layer of noise to an already chaotic information environment. The human lesson is that the struggle against influence operations is not a matter of building a single digital wall, but of developing a habit of curiosity, skepticism, and patience. It means asking who is speaking, why they are speaking now, and what structure is carrying their words. The Propastop investigation, DFRLab’s international mapping, and Refute’s synthesis all point in the same direction: the best defense against disinformation is not censorship or even necessarily technology, but a web of human analysts, researchers, and journalists who are willing to follow the threads no matter where they lead. In the end, the fake report about the Portuguese jets at Ämari Air Base was not a proof of NATO’s weakness or Ukraine’s recklessness. It was a proof of something far more reassuring: that a small group of determined truth-seekers, armed with careful eyes and the courage to question the story, can still pull off the mask of a global influence operation and strip away its power. That is the quiet human victory hidden inside the story, and it is worth remembering the next time an alarming headline appears in your feed, because the first question should always be the same: who made this, and why do they want me to believe it?