Russia could have spent up to €70 million on propaganda in Bulgaria and Romania

A group of Bulgarian cybersecurity experts BG Elves has found that the Russian Federation has spent €69 million on financing a large-scale propaganda campaign targeting Bulgaria and Romania.

This is reported by Novinite.

According to BG Elves, the funds were channeled through small, hard-to-detect transactions of €5,000 each. The goal was to spread Russian influence and promote far-right narratives in these two countries. BG Elves claims to have received documents linking this money to companies and individuals operating in both Bulgaria and Romania, with the express purpose of manipulating public opinion.

BG Elves added that they shared this information with investigative journalists and services in Romania, Great Britain and Ukraine.

Experts said the complex scheme had been in place for years, with its origins dating back to 2010. Traces of Russian domains with rented servers in the Netherlands and Germany were found, which were used to create manipulation schemes. Experts pointed to Adnow, a company that plays a significant role in spreading propaganda and advertising of controversial content. This advertising often promoted sensational and misleading health claims, and was aimed at influencing the public through sophisticated algorithms and tracking tools. BG Elves found that the systems used by Adnow collect and segment users based on the content they consumed, creating very detailed profiles with information such as gender, location and even a «cruelty rating» (show_brutal_rate) to better tailor advertising to specific people.

The ultimate goal of this operation, according to BG Elves, is to manipulate users into providing personal information through fake offers and prize schemes. Once obtained, the data is allegedly sent to Russia, where it is used for further targeted attacks. According to BG Elves, the mobile game company used this personal information to install malware on users' devices. This malware, known as a RAT (Remote Access Trojan), allows attackers to monitor victims’ private messages and use their contacts, potentially allowing attackers to manipulate and spread disinformation.

BG Elves estimated that Adnow, which generates millions of impressions each month, could have infected thousands of users, allowing the attackers to reach a significant audience. They also noted that the activities of these Russian-backed organizations have expanded significantly to include a wide range of services, such as bot farms and VPNs, aimed at supporting the spread of propaganda.