Kremlin networks targeted Bulgarian elections with EU censorship claims
Russian-aligned disinformation networks conducted multilingual information operations ahead of Bulgaria's April 2026 elections, promoting false narratives of EU interference and framing election-security mechanisms as censorship tools.
Sourcedfrlab.org — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
Between March and April 2026, Kremlin-aligned actors orchestrated coordinated information manipulation targeting Bulgaria's parliamentary elections through multiple networks including RT, Pravda Network, Node of Time, Big News Network (BNN), InfoDefense, and the Australia National Review (ANR) network. The campaign pushed narratives claiming EU interference and censorship, specifically targeting Bulgaria's activation of the EU's Rapid Response System (RRS) under the Digital Services Act following the government's counter-disinformation mechanism. Key messaging promoted a "Romanian scenario" narrative, drawing parallels to Romania's 2024 presidential election annulment due to Russian interference, and framed legitimate election-security measures as democratic manipulation.
Operations leveraged multiple distribution channels including websites, social media (Facebook, Telegram, X), and content laundering networks. The BNN network alone republished RT's "Battle for Bulgaria" series across 416–417 domains to circumvent EU sanctions against RT. Trigger events included RT's dedicated "Battle for Bulgaria" webpage (April 4), candidate Rumen Radev's accusations of EU election hijacking (April 7), and French far-right politician Florian Philippot's amplified tweet (April 8). Domestic Bulgarian media outlets flagged for pro-Kremlin bias independently amplified identical narratives, creating overlapping foreign and domestic information environments that reinforced one another.
The campaign's strategic objective was to pre-emptively delegitimize counter-disinformation enforcement by framing the RRS and national coordination mechanisms themselves as censorship tools. By the time any enforcement action could be taken, the narrative was seeded to portray such actions as confirmation of the original censorship claims, effectively neutralizing the defensive mechanism before use. Content was distributed in Bulgarian, Russian, English, French, German, and Italian across 1,112 identified messages.
Mentioned in this report
Source reporting: https://dfrlab.org/2026/06/09/kremlin-aligned-actors-targeted-bulgarian-vote-with-eu-interference-claims
Free public brief. The indicators are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators and live profiles of the actors and campaigns it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs