# Kremlin networks targeted Bulgarian elections with EU censorship claims

Published: 2026-06-09 · Severity: routine · Sectors: government-national
Canonical: https://vorant.io/reports/ddafd47c-cd7c-51c8-9301-0bdee924cd50/kremlin-networks-targeted-bulgarian-elections-with-eu-censorship-claims

> Russian-aligned disinformation networks conducted multilingual information operations ahead of Bulgaria's April 2026 elections, promoting false narratives of EU interference and framing election-security mechanisms as censorship tools.

Between March and April 2026, Kremlin-aligned actors orchestrated coordinated information manipulation targeting Bulgaria's parliamentary elections through multiple networks including RT, Pravda Network, Node of Time, Big News Network (BNN), InfoDefense, and the Australia National Review (ANR) network. The campaign pushed narratives claiming EU interference and censorship, specifically targeting Bulgaria's activation of the EU's Rapid Response System (RRS) under the Digital Services Act following the government's counter-disinformation mechanism. Key messaging promoted a "Romanian scenario" narrative, drawing parallels to Romania's 2024 presidential election annulment due to Russian interference, and framed legitimate election-security measures as democratic manipulation.

Operations leveraged multiple distribution channels including websites, social media (Facebook, Telegram, X), and content laundering networks. The BNN network alone republished RT's "Battle for Bulgaria" series across 416–417 domains to circumvent EU sanctions against RT. Trigger events included RT's dedicated "Battle for Bulgaria" webpage (April 4), candidate Rumen Radev's accusations of EU election hijacking (April 7), and French far-right politician Florian Philippot's amplified tweet (April 8). Domestic Bulgarian media outlets flagged for pro-Kremlin bias independently amplified identical narratives, creating overlapping foreign and domestic information environments that reinforced one another.

The campaign's strategic objective was to pre-emptively delegitimize counter-disinformation enforcement by framing the RRS and national coordination mechanisms themselves as censorship tools. By the time any enforcement action could be taken, the narrative was seeded to portray such actions as confirmation of the original censorship claims, effectively neutralizing the defensive mechanism before use. Content was distributed in Bulgarian, Russian, English, French, German, and Italian across 1,112 identified messages.

## Mentioned in this report

- Threat actors: Australia National Review, Big News Network, InfoDefense, Kremlin-aligned disinformation networks, Node of Time, Pravda Network, Rybar project, Storm 1519
- Campaigns: Battle for Bulgaria, Referendum for the Bulgarian Lev

## Detection guidance (public sample)

### Credential Phishing via Spearphishing Link to Cloud Account Portal

ATT&CK: T1598.003

Detects phishing emails or messages containing URLs to fake cloud authentication portals (Office 365, Google, social media login pages) designed to harvest cloud account credentials — precursor to T1078.004. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Credential Phishing via Spearphishing Link to Cloud Account Portal
description: Detects emails or instant messages containing malicious links to credential-harvesting
  pages impersonating legitimate cloud account login portals (Office 365, Google,
  Facebook, Telegram, X/Twitter). Rules on URL structure patterns and suspicious redirects,
  not specific campaigns.
tags:
- attack.initial-access
- attack.t1598.003
- attack.t1589.001
logsource:
  category: network_connection
  product: windows
detection:
  selection_office365:
    DestinationHostname|contains:
    - login.microsoftonline
    - account.microsoft
    - offices365-
    - office365-
  selection_google:
    DestinationHostname|contains:
    - accounts.google
    - gmail-login
    - myaccount-google
  selection_social:
    DestinationHostname|contains:
    - facebook-login
    - telegram-auth
    - twitter-verify
    - x-verify-account
  filter_legitimate:
    DestinationHostname|startswith:
    - login.microsoft.com
    - accounts.google.com
    - www.facebook.com
    - web.telegram.org
    - twitter.com
    - x.com
  condition: (selection_office365 or selection_google or selection_social) and not
    filter_legitimate
falsepositives:
- Legitimate account recovery workflows
- Company single-sign-on systems with similar naming patterns
level: high
id: e7de28ea-a9f6-5467-918e-06fb575f7350
status: experimental
author: Vorant
```

### Deletion of Web Application Logs or Content Management System Records

ATT&CK: T1070.004

Detects file deletion events targeting CMS log directories, audit trails, or metadata files — forensic cleanup following content injection or defacement attacks. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Deletion of Web Application Logs or Content Management System Records
description: "Detects deletion of log files, audit trails, or metadata within web\
  \ application and content management system directories \u2014 typical cleanup after\
  \ unauthorised content injection or defacement (T1491.002). Targets common CMS log\
  \ structures (WordPress, Drupal, Joomla) and Apache/IIS audit logs."
tags:
- attack.defense-evasion
- attack.t1070.004
- attack.t1491.002
logsource:
  category: file_event
  product: windows
detection:
  selection_wordpress:
    TargetFilename|contains:
    - \wp-content\plugins\
    - \wp-admin\includes\
    - \wp-content\themes\
    EventType: Deleted
  selection_cms_logs:
    TargetFilename|contains:
    - \logs\
    - \log\
    - audit
    TargetFilename|endswith:
    - .log
    - .archive
    - .bak
  selection_iis_logs:
    TargetFilename|contains: \LogFiles\
    EventType: Deleted
  selection_apache_logs:
    TargetFilename|contains:
    - \apache2\logs\
    - \apache\logs\
    EventType: Deleted
  filter_admin_maintenance:
    User|contains:
    - SYSTEM
    - Administrator
    CommandLine|contains: cleanup
  condition: (selection_wordpress or selection_cms_logs or selection_iis_logs or selection_apache_logs)
    and not filter_admin_maintenance
falsepositives:
- Legitimate log rotation and archival by system administrators
- Scheduled maintenance tasks purging old logs as part of retention policy
level: medium
id: aa49b34c-ee32-5cc0-b6d9-7b1ca5d8adfc
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://dfrlab.org/2026/06/09/kremlin-aligned-actors-targeted-bulgarian-vote-with-eu-interference-claims

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/ddafd47c-cd7c-51c8-9301-0bdee924cd50/kremlin-networks-targeted-bulgarian-elections-with-eu-censorship-claims.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup