Study: Lithuania’s infrastructure is a target of Russian information attacks
Russian information attacks against Lithuania have a clear target: infrastructure, above all energy, undersea cables and Kaliningrad transit. In every case the aim is to undermine trust in the state and in its ability to protect these sites. This is the main finding of the first study of its kind in Lithuania, carried out by Repsense for the Lrytas conference “Saugumo kodas 2026” (Security Code 2026).
Access the report:
We analysed 358,156 posts in Lithuanian, Russian and English about twelve Lithuanian infrastructure sites, from airports to undersea cables. The study also follows four crises of 2025–2026: smuggling balloons from Belarus, the Kapčiamiestis military training area, the Centre of Registers data leak and the August storm.
Most disinformation research measures how propaganda shifts public attitudes over months and years. This study looks at the days and hours after an incident and asks what would happen during a hybrid attack if several such incidents came at once.
“We usually study propaganda as a long-term effect on how we think: how an adversary interferes in elections or weakens our will to defend ourselves. But there is another kind of communication whose effect is counted in hours or even minutes. Its goal is very concrete: to cause panic, to stop the construction of a site important for defence, to make people doubt that the state works. This kind of communication accompanies hybrid attacks and plays on our most basic fears. If a hot hybrid war began, infrastructure would be the first target, so we wanted to see how prepared we are today,” says Mykolas Katkus, CEO of Repsense.
Lrytas, which organises Saugumo kodas, the largest public security conference in Lithuania, wanted to understand how information threats work around critical infrastructure, how fast they spread and which gaps in institutional communication they can exploit. “Concrete Lithuanian examples show where the public’s ability to recognise disinformation needs strengthening, and the data let us prepare for threats before they become a crisis,” says Greta Ališauskaitė-Bagušauskienė, head of the conference.
Energy and connections to the outside world draw the most attention
Russian sources do not watch all of Lithuania’s infrastructure equally. Energy gets the most attention: 54% of hostile content about Lithuanian energy was published by Russian sources. Its main theme is that leaving BRELL, the Soviet-era power system that linked the Baltic states with Russia and Belarus, was a costly mistake.
Kaliningrad transit and undersea cables come second. The Russian-language space writes more about these two sites than the Lithuanian one does: two thirds of all posts about Kaliningrad transit are in Russian, and more than half of those about undersea cables. Only one in twenty posts about airports is in Russian.
Finished projects with clear benefits, such as the Klaipėda LNG terminal or synchronisation with the European grid, get little coverage and less negative coverage. Attention gathers around sites that are still disputed or that can fail.
Kapčiamiestis: the distribution network was ready in advance
On 15 December 2025, Lithuania’s State Defence Council decided to build a brigade-sized military training area near Kapčiamiestis, in the Lazdijai district. The planned area covers 90 homesteads, and some residents would have to move. Local opposition quickly moved to social media and became the biggest crisis of the year in the information space: almost 18,000 posts in seven weeks, nine in ten of them on social media.
Russian Telegram channels wrote about the training area on the day of the decision. From 17 December, Russia-linked Telegram and TikTok accounts posted criticism: the training area was supposedly useless, would serve NATO and would threaten Kaliningrad. Public debate in Lithuania began only on 23 December, after residents met the Ministry of National Defence. According to an investigation by the public broadcaster LRT, the main Facebook groups that organised the opposition had been created back in 2024 and were run by fake profiles.
“Timing is what matters most here. Russian channels launched the talking points about the training area – that it is useless, will serve NATO and will threaten Kaliningrad – a week before Lithuania started discussing it at all. When the debate began, the same points appeared in Lithuanian comments almost word for word. This pattern is typical of planned information operations, not of spontaneous outrage,” says Katkus.
Residents’ questions went without an official answer for two weeks. On 8 January the army publicly named disinformation for the first time. Over the next three weeks, 28 identical texts appeared in dozens of Facebook groups, about 1,030 posts in total. One of them, repeating Russian Foreign Minister Sergei Lavrov’s claim of a “provocation”, was posted almost 90 times in two days.
The same groups were active well beyond Kapčiamiestis. Over the year, fifteen Facebook groups and accounts posted identical hostile texts on five unrelated topics: the training area, the balloons from Belarus, the Centre of Registers leak, the State Security Department and the Central Electoral Commission. The network was set up in advance, and only the occasion changes.
A slow-spreading narrative can still do damage
The attacks aim less at the sites themselves than at trust in the state responsible for them. Six in ten posts about Lithuania’s infrastructure discuss whether the state can protect and manage the power grid or the airport, rather than the grid or the airport as such.
Most hostile narratives do not reach a wide audience. Twelve of the sixteen narratives identified in the study stayed where they started, and national media repeated none of them as fact. They do not disappear, though. The claim that Lithuania is blackmailing Kaliningrad took three months to travel from the Russian-language space to Lithuanian Facebook. The narrative about the price of energy independence was repeated every month until, in August, it was attached to the storm.
What worked
The four crises ended very differently. After the first balloon closure of Vilnius Airport, the President, the Prime Minister and the National Crisis Management Centre attributed the launches to the Minsk regime the next day. In Kapčiamiestis, residents waited sixteen days for answers.
“We looked not only for mistakes but also for what works. In the balloon case, institutions named who was behind it the very next day and held that position to the end – that is where we found the least hostile content. In Kapčiamiestis we see the opposite: residents waited sixteen days for answers, and others filled that silence. The advice to institutions is also more than analysts’ opinion: we tested it with a model that shows how a narrative would spread in different scenarios. We hope the study will lead the defence sector to look more closely at how the country’s information space actually works,” says Katkus.
The report sets out three conclusions for institutions: keep watching hostile narratives even when they seem to go nowhere, communicate early rather than stay silent, and respond quickly and with one voice. Across all four cases, hostile content was lowest where the state spoke first.
About the study
The study covers 1 September 2025 to 31 August 2026. We analysed 358,156 articles, social media posts and comments in Lithuanian, Russian and English, collected and processed with the Repsense Narrative Intelligence platform. It covers five infrastructure areas and twelve sites, four separate cases (the Kapčiamiestis training area dispute, the Centre of Registers data leak, the balloon incidents near Vilnius Airport and the August 2026 storm) and the spread of 16 hostile narratives. The study was prepared for the Lrytas conference “Saugumo kodas 2026”.
