"Not just import, but a joint venture": why the Balkans became a testing ground for foreign information manipulation

Українською читайте тут.

Detector Media looks at who amplifies disinformation narratives across Balkan countries, how researchers detect and counter coordinated information operations — and why state institutions there largely fail to keep pace.

On August 4, 2026, Osavul — a company building software for information-space analysis, fake detection, and countering security threats — held an online webinar, "Balkans FIMI: Actors & Narratives," on foreign information manipulation and interference in the region.

The session was moderated by Andrew Bevz of Osavul, who kept the panel focused with pointed follow-up questions drawn from his own reading of the region and the live chat — including whether Mikhail Zvinchuk, the sanctioned founder of pro-Russian Telegram channel Rybar who has been opening "media schools" in Republika Srpska, counts as FIMI, and whether Balkan states run information operations against each other the way outside powers do against the region as a whole. Both questions drew some of the panel's sharpest answers.

Four researchers working directly on the region joined the discussion: Gloria Trifonova, analyst of Sofia's Center for the Study of Democracy (CSD); Andreas C. Hatzidiakos co-director of the European War Institute (OPEWI), a former EU External Action Service official; Eleni Kapsokoli, an appointed Lecturer Strategic Studies at Panteion University in Athens; and Matei Vrabie program manager of the Romanian civil-society group Funky Citizens.

The Balkans remain one of Europe's least understood information spaces: unresolved historical disputes, ethnic divides, and weak media ecosystems overlap with an ongoing EU accession process, opening the door to foreign interference — and tactics tested here, the panel noted, often resurface elsewhere in Europe.

Foreign influence operations need local amplifiers everywhere in Europe, Hatzidiakos said — what sets the Balkans apart is who that amplifier is. In France or Germany, Russian disinformation has to "rent" an audience, building fake sites and bot networks from scratch. In the Balkans, nothing needs renting — the audience and platforms already exist locally, and much of the media infrastructure is already funded from sources tied to the state itself, as the EU's November 2025 Enlargement Package documented, finding the media sector in most Balkan candidates marked by "concentrated political influence."

Andreas C. Hatzidiakos (OPEWI, ELIAMEP)

The dominant regional practice, he said, is narrative "laundering": claims no accountable outlet would publish under its own name first surface on sites with no legal entity attached, before a more credible outlet picks them up as fact — until, a few steps later, they're cited by portal name with no author at all. FIMI here isn't just an "import" but a "joint venture" of external and internal players.

Gloria Trifonova called this a "domestic amplification model": half the job is done before a foreign actor even shows up, which is why large operations like Doppelganger aren't even necessary in Bulgaria — domestic actors spread the narratives on their own. Vrabie framed FIMI as an ecosystem rather than isolated fakes: anonymous Telegram channels produce content, unregistered sites republish it onto platforms like Facebook, and local opinion leaders carry it into mainstream political debate.

Gloria Trifonova (CSD, Sophia)

All four converged on similar recommendations: media-ownership transparency and regulators able to withstand political pressure; timely, honest state communication during crises, since a vacuum — as after Romania's drone incidents — gets exploited almost instantly; and continuous monitoring built on cooperation between the state, civil society, and the private sector, since Balkan governments mostly don't monitor the information space themselves. Eleni Kapsokoli added platform accountability: synchronized, inauthentic account networks need a faster response, and researchers need better data access.

Eleni Kapsokoli, Panteion University, Athens

The panel warned, though, against leaning on anti-falsehood laws. Hatzidiakos cited Bosnia and Herzegovina and Albania, where election commissions have begun fining parties for "false statements" — a precedent, he argued, that hands a state body the power to rule on what's true in political speech, a power that passes intact to whoever wins the next election. It's the fastest way, he said, to turn a resilience tool into an instrument of repression.

Kapsokoli mapped the region's sensitive topics: national identity and the Prespa Agreement with Greece in North Macedonia; campaigns casting NATO and the EU as hostile in Bosnia and Herzegovina; recurring exaggeration or fabrication of claims about the persecution of Serb military personnel in Kosovo. Greece sees fewer direct operations than most of the region but isn't immune — after Russia's state media were curtailed in spring 2022, narratives simply migrated to proxy sites, anonymous blogs, and ideologically aligned local media.

Bulgaria. Trifonova traced the rise of the openly pro-Russian party Vazrazhdane, parliament's third-largest force after 2024 and a signatory of a cooperation agreement with United Russia; its seats fell sharply in April 2026 but it still cleared the threshold, and some of its messaging was picked up by the election's winner, now-PM Rumen Radev, a former military pilot who spent years as president echoing Kremlin lines on Crimea and Ukraine aid. Since he took office, Bulgaria has officially wound down its aid to Ukraine and now has among the EU's lowest NATO-support levels. Former military officers, she added, became influential pro-Russian YouTube voices after the full-scale invasion.

She also detailed roughly 400 near-identical "mushroom websites" created after February 2022 to mass-reprint Kremlin narratives; the Bulgarian node of the Pravda network alone produces up to 6,000 articles a month, feeding pro-Kremlin content into "small-language" search results and AI training data. CSD found only three people officially listed as responsible for hundreds of these sites — a signal of automation over real newsrooms — though such findings, she said, rarely lead anywhere.

Romania. Vrabie described an ecosystem in which local politicians, commercial networks, and influencers adapt pro-Putin content for money, popularity, or electoral gain — most visibly around Călin Georgescu's TikTok-fueled surge in the 2024 presidential race. Funky Citizens' "Komanda Kremlin" investigation traced how pro-Russian sites and Telegram channels promoted him as a "sovereigntist alternative"; after the election was annulled, the same network reframed the cancellation as proof "Western democracy" had betrayed voters. The findings fed a criminal case against Georgescu and 21 others, and new elections followed.

Matei Vrabie, Funky Citizens, Bucharest 

He also detailed two 2026 drone incidents, in Galați and Constanța, where, before official details were confirmed, dozens of Facebook pages published identical alarmist posts within minutes, reaching millions of followers and keeping each topic alive for days with narratives about Ukraine's guilt and possible "false flags" — roughly 14,000 coordinated posts in the first 35 hours after Constanța alone.

Greece. Kapsokoli focused on FIMI's religious dimension: Orthodox identity merges with national identity in parts of the region, and the Kremlin leans on that shared heritage through transnational networks and a narrative casting Moscow as "defender of Christianity" against a "morally declining" Europe — with Mount Athos, and Putin's publicized ties to its monasteries, carrying particular symbolic weight.

Bosnia and Herzegovina. Panelists returned to Zvinchuk, who regularly visits Republika Srpska presenting himself, per Hatzidiakos, as a "neutral media trainer," meeting local officials in 2024 with plans for a "media school." In reality, he said, local authorities are giving a sanctioned propagandist access and legitimacy, embedding him in the region's own information ecosystem and making his narratives feel more authentically local.

Serbia. Asked directly how Serbia shapes its neighbors, Hatzidiakos didn't hedge: one of the region's most important external actors is itself part of the region. "Russia rents its influence here, China is trying to buy itself a reputation, but Serbia really owns it," he said, pointing to Serbian-language media, church funding, and diaspora networks across the former Yugoslav states. Because Serbia is an EU candidate rather than a rival like Russia or China, its influence on neighbors gets discussed as regional politics or diplomacy — never as a hybrid threat — letting it escape the scrutiny the EU reserves for Moscow and Beijing. China, he added, plays a secondary role, building leverage through infrastructure investment and academic and business ties rather than political narratives.

In Bulgaria, Trifonova said, Telegram remains the most visible channel — around 30 channels, some posting directly in Russian, that drew a combined 180 million views in the year before the April 2026 election and are cross-linked with Pravda. Facebook remains dominant among older audiences: one CSD study found disinformation targeting Ukrainian refugee women surfacing not in political groups but in ordinary ones about knitting or fashion, with no reliable way yet to get Facebook to respond more actively.

Vrabie noted that Romanian FIMI activity systematically spikes around elections, crises, and international summits, citing Funky Citizens' own research into an anti-NATO campaign timed to the NATO summit in Ankara. Kapsokoli summed up the regional picture: Telegram and TikTok are both heavily used to spread unverified information about the Russia-Ukraine war, with no agreed way yet to separate the manipulation from the technology that spreads it.

All the speakers agreed the field has shifted focus from individual posts to the behavior and infrastructure behind them — synchronized publishing, automated content volumes, accounts pivoting overnight from entertainment to politics. Balkan governments largely don't monitor the information space themselves, relying instead on civil society or international partners, and typically act only once something crosses into an actual legal violation.

Vrabie pointed to the lack of fast communication around Romania's annulled 2024 election as a case in point — a gap that still leaves deep public distrust two years later. Kapsokoli stressed coordination between regional fact-checking organizations. Hatzidiakos laid out three steps for the EU: turn the European Commission's annual reports into actual recommendations rather than mere fact-finding; prepare candidate states to adopt the EU's Digital Services Act before accession; and — hardest to apply — hold candidates to real conditionality, downgrading contacts and suspending assistance when a government is found systematically spreading anti-European rhetoric, as with Georgia in late 2024. That tool can't be transplanted mechanically country to country, he cautioned, but the precedent exists — what's missing at the EU level is the political will to apply the same logic consistently.

The discussion closed without a single formula for countering FIMI in the region. Every speaker agreed that resilience to outside influence — in the Balkans, at least — isn't something one law or agency can deliver alone. It takes media-ownership transparency, independent regulators shielded from political pressure, and politicians and institutions willing to speak honestly and on time, even before all the answers are in.