Russia has spent 69 million euros to fund a large-scale propaganda and disinformation campaign targeting Bulgaria and Romania, Bulgarian cybersecurity experts said.
BG Elves reported the funds were channeled through small, difficult-to-detect transactions as low as 5,000 euros each. The aim was to spread Russian influence and promote far-right narratives within the two countries.
BG Elves claims it obtained documents linking the cash transaction to companies and individuals operating in Bulgaria and Romania, with a clear goal of manipulating public opinion, Novinite reported.
BG Elves, a group focused on combating disinformation and hybrid threats, said they’d shared the information with investigative journalists and intelligence services in Romania, the UK, and Ukraine.
The campaign was vast, they said, and had been operating since at least 2010.
During their investigation, BG Elves detected Russian domains behind systems which were used to manipulate the general public, many of which had been rebranded to appear legitimate. Despite this, old Russian domains remained in some places.
BG Elves said there were rented servers in the Netherlands and Germany supporting them. One particular company, Adnow, played a significant role in distributing propaganda and advertisements with misleading content. The ads often promoted sensational and fake health claims, aimed at influencing the public by the use of complex algorithms and tracking tools.
BG Elves uncovered the systems used by Adnow collect and profile users based on the content they consume, creating highly detailed profiles with information such as gender, location, and even “brutality ratings” (show_brutal_rate) to tailor the ads to individuals more effectively.
The ultimate goal of the operation, BG Elves reported, was to manipulate users into providing personal information through false offers and prize schemes. Once obtained, the data was allegedly sent to Russia, where it was used to launch more targeted attacks.
BG Elves detailed how a mobile game development company used personal information to install malicious software on users’ devices, giving them full remote access. This malware, known as RAT (Remote Access Trojan), allows attackers to monitor victims’ personal communications and exploit their contacts, potentially enabling the perpetrators to manipulate and spread disinformation.
BG Elves said that Adnow, which generates millions of impressions every month, could have infected thousands of users, allowing attackers to reach a substantial portion of the Bulgarian population.
They further pointed out that the activities of these Russian-backed entities have expanded significantly and now include a wide array of services such as bot farms and VPN networks, all aimed at supporting the distribution of propaganda.
This investigation highlights a disturbing breach of national security, and BG Elves said the threats should be addressed, as they continue to investigate the full extent of the operation.
BG Elves which focuses on combating disinformation and hybrid threats, and has previously gained attention for their fact-checked publications aimed at revealing data about abuses in both public and political spheres.
A war on many fronts. Unpicking disinformation about Ukraine and other conflicts
