Russia spent 69 million euros to finance a large-scale propaganda and interference campaign targeting Bulgaria and Romania, reveals a group of Bulgarian cybersecurity experts, BG Elves, reports the Bulgarian website novinite.com.
The funds were transferred in small, hard-to-detect transactions of up to 5,000 euros each, according to the group. The aim was to spread Russian influence and promote far-right discourse in both Bulgaria and Romania, according to the same source.
BG Elves claims to have obtained documents linking these sums of money to companies and individuals operating in both Bulgaria and Romania, with the clear aim of manipulating public opinion. The group announces that it has shared this information, in the last 48 hours, with journalists and investigative services from Romania, the United Kingdom and Ukraine.
The exchange of information has been consistent and exceeded expectations, according to it. They emphasize the complexity of the “plot” – which has been operating for years and whose origin dates back to 2010.
During the investigation, BG Elves discovered traces of Russian domains behind the “systems” used to manipulate society, many of which have been renamed and redirected – over time – in order to appear legitimate. Despite these operations, Russian domains are still present in some places. BG Elves details how these systems were structured, with servers rented in the Netherlands and Germany to support them.
The group names a company – Adnow – that played a significant role in distributing propaganda and advertising with controversial content. The ads – which often promoted sensational and misleading health claims – aimed to influence the public through the use of complex algorithms and tracking tools.
BG Elves discovered that the systems used by Adnow collect and profile users based on the content they consume, creating very detailed profiles, with information such as gender, location and even “brutality ratings” (show_brutal_rate), in order to more effectively tailor advertising to targets.
The ultimate goal of this operation, BG Elves claims, is to manipulate users into providing personal information through fake offers and rewards systems. Once obtained, the data is sent to Russia, where it is used for even more targeted attacks.
BG Elves reveals that a mobile game company used this personal information to install malware on users’ devices, thus gaining complete remote control. This malware – known as a Remote Access Trojan (RAT) – allows attackers to monitor users’ personal communications and exploit their contacts, potentially allowing the authors to manipulate and spread disinformation.
BG Elves stresses that the scale of this operation is “vast”. The group estimates that Adnow, which generates millions of fingerprints per month, has infected thousands of users, allowing the attackers to reach a “substantial” part of the Bulgarian population.
The group also explains that the activities of these Russian-backed entities have expanded “significantly” and now include a wide range of services, such as “bot farms” and “VPN networks” whose purpose is to support and distribute propaganda.
This investigation reveals a “worrying gap” in national security, according to cybersecurity experts at BG Elves, who emphasize the importance of responding to these threats. They continue to investigate the scope of this operation and announce that they will provide new information in the future.
BG Elves – a group that focuses on combating disinformation and hybrid threats – has previously attracted attention with fact-checking reports designed to expose abuses in the public sphere and political life, Novinite notes.