BANNER: A voting machine is set up at a polling station in Sofia, Bulgaria on April 19, 2026. The device is used for machine voting during the parliamentary elections to elect members of the National Assembly. (Source: Daniel Yovkov / Hans Lucas via Reuters Connect)

Kremlin-aligned online networks sought to undermine the April 19 Bulgarian parliamentary elections with accusations of EU interference. The narrative was built upon two actions that sought to secure the vote: first, on March 23, Bulgaria’s Foreign Ministry established a temporary national coordination mechanism to counter disinformation and combat hybrid threats. The next day, the European Commission activated its Rapid Response System (RRS) under the Digital Services Act (DSA), following a request from Bulgaria’s caretaker government. RRS intends to facilitate cooperation between regulators, member states, and major online platforms regarding election-related disinformation and foreign interference risks.

On April 19, Bulgaria held its seventh snap election in five years, which resulted in a victory for Rumen Radev, the Moscow-favored candidate who resigned the presidency in January 2026 to enter parliamentary elections with his newly created political bloc Progressive Bulgaria. In his campaigning, he criticized EU sanctions against Russia and opposed military aid to Ukraine. His past statements and Bulgaria’s unique geographic positioning raised questions about whether Radev would replace ousted Hungarian Prime Minister Viktor Orbán as Russian President Vladimir Putin’s new proxy and ally within the EU.

The activation of RRS  triggered several waves of online operations in April framing the EU’s support as a censorship and influence mechanism. The campaigns pushed a so-called “Romanian scenario,” claim to suggest that the EU and the Bulgarian caretaker government were preparing to interfere in Bulgaria in the event of a Radev victory. These messages referred to the 2024 presidential elections in Romania, which were annulled by the Constitutional Court on December 6, 2024, citing credible allegations of Russian interference benefiting far-right candidate Călin Georgescu. Georgescu, who unexpectedly led the first round, was later barred from the 2025 race due to suspected electoral violations. Operations targeting the Bulgarian vote ran in multiple languages and proliferated mostly via laundering websites and known Kremlin-aligned disinformation networks such as Node of Time, Pravda Network, RT amplification domains, and more.

The coordinated cross-platform amplification of narratives about censorship, EU interference, and parallels with Romania pre-emptively shaped the post-election information environment. At the same time, as the Center for the Study of Democracy (CSD) noted in their “Defending the Vote” report, by casting the counter-disinformation mechanism itself as censorship, the campaign undermined its legitimacy before it could even be used, ensuring that any later enforcement action could be presented as confirmation of the original claim.

To understand the spread of the EU interference claims, multilingual monitoring was employed using the social media analysis tool Osavul between April 1 and April 19. The monitoring was based on the keywords “Bulgaria” and “elections.” Results were first filtered for EU related keywords (EU, European Commission, Brussels), then a second filter was applied to identify explicit anti-EU framing related to EU interference, censorship, and the so-called “Romanian scenario.” In the end, 1,112 messages were analyzed across web, Facebook, Telegram and X in multiple languages including Bulgarian, Russian, English, French and German.

Based on these results, we also carried out manual searches to verify and supplement cases where the data detected by Osavul appeared inconsistent. Combining automated monitoring with manual verification allowed us to build a more comprehensive picture of how the EU interference and Romanian scenario narratives evolved in the month of Bulgaria’s election.

Between April 1 and April 19, we identified 570 domestic and 542 foreign-originated messages. This categorization was based on a mixed approach of relying on the “country of origin of actor” as it appeared in Osavul, corroborated against language and prior knowledge of the actor. For example, if the monitoring platform labeled Pravda’s Bulgaria website as a Bulgarian website, we amended this to attribute it to an external foreign actor given Pravda’s association with Russia.

While Kremlin-aligned networks operated through foreign channels and laundering websites and were triggered by specific events and statements (as discussed below), the same narratives circulated simultaneously within Bulgaria’s domestic information environment throughout April. The overlap in domestic and foreign information campaigns signifies a shared information environment, running as parallel and overlapping tracks that either responded to the same trigger events or reinforced identical framing of EU mechanisms independently of each other’s operations.

The mixture of foreign and domestic actors pushing EU messaging in the election month demonstrates the vulnerability of Bulgaria’s information environment. Of domestic Bulgarian content, 43 percent originated from Bulgarian websites and news outlets, including those that have been flagged and documented by research organizations (including the DFRLab) as primary sources of pro-Russian narratives in Bulgaria, for example Pogled Info, Glasove, Epicenter.bg and others. These outlets have also been involved in evading EU sanctions against Russian state and state-affiliated media by redistributing banned content in the Bulgarian language, effectively operating a backdoor for sanctioned content to enter the EU via Bulgaria.

Websites accounted for the largest share of content (42 percent), primarily driven by domestic Bulgarian media and the websites distributing and laundering foreign information manipulation and interference. Facebook followed at 28 percent, playing a particularly leading role in domestic discussions in Bulgarian. Telegram (20 percent) and X (6 percent) were used primarily to amplify foreign information manipulation and interference (FIMI) operations across multiple languages. Bulgarian was the dominant language of content overall, followed by English, Russian, French, German, and Italian. This distribution is consistent with the multilingual coordinated amplification and laundering networks.

By analyzing spikes in EU-related messaging, it was possible to identify the events and statements that triggered the activation of FIMI actors in April.

On April 4, RT launched a dedicated “Battle for Bulgaria” webpage about the Bulgarian elections, publishing six articles between April 4 and April 20. We examined three that appeared in our dataset and had explicit “Battle for Bulgaria” branding. The first, “The EU opens a new front in its election war” (April 4), pushed the EU censorship narrative. The second, “Why Ukraine is so important to Sofia” (April 15), framed the caretaker prime minister’s last-minute trip to Kyiv (to sign a ten-year military cooperation agreement covering arms production, troop training, sanctions alignment, and reconstruction funding) as an act of democratic sabotage that bound the country to a decade of commitments without an electoral mandate. The third, “RT’s definitive guide to the Bulgarian election” (April 17, two days before the vote) also accused the EU of influencing Bulgaria’s election through its institutions and portrayed the EU’s RRS as a censorship tool.

The original Battle for Bulgaria series was published on the main RT domain – rt.com, which is not available in the EU. To circumvent this ban, articles were republished on RT mirror websites. Four such domains and subdomains were identified and found to be republishing RT’s content in Bulgaria, thereby making the banned content accessible in the EU (rurtnews.com, freeder.online, swentr.site, and kazan2024-en.rt.com).

On April 6, after the first “Battle for Bulgaria” article appeared on RT, the Bulgarian cyber collective BG Elves documented on Facebook how the content was being republished by English-language websites.

The DFRLab worked with the BG Elves to further examine this activity. The part of the network they identified was attributed to the Big News Network (BNN) distribution network. BNN’s main domain lists the websites operating under its umbrella; by scraping and collecting these, we identified 430 domains. Their naming patterns were consistent, with the majority combining a geographical name with a journalism-related suffix, the most common being “news,” followed by “sun,” “star,” “herald,” “times,” and “telegraph.” Geographically, the largest category was Country/Territory  with 123 domains (e.g. brazilsun.com, chinanews.net, germanynews.net), followed by US States with 80 domains (e.g. arizonaherald.com and texasguardian.com), US Cities  with 94 domains (e.g. chicagonews.net, houstonnews.net, miaminews.net), International Cities with 65 domains (e.g. tokyonews.net, parisnews.net, dubainews.net), Topical/Other with 33 domains (covering areas such as sports, business, and travel), and Regional/Continental with 13 domains (e.g. europenews.net, asiapacificnews.net, middleeastnews.net).

Across all domains, content IDs and article slugs were identical to the original RT content. Based on the assumption that all websites in the network would automatically publish RT content with identical slugs, we constructed a list of article URLs for the three “Battle for Bulgaria” pieces we analyzed. Running an automated script to check each URL, we confirmed that “Battle for Bulgaria: The EU opens a new front in its election war” was published on 416 BNN websites; “Battle for Bulgaria: Why Ukraine is so important to Sofia” on 417 websites; and “Battle for Bulgaria: RT’s definitive guide to the Bulgarian election” on 416 websites.

BNN is not a newly identified actor. The Alliance for Securing Democracy previously documented it for laundering RT content in English, and as the single largest source of banned RT content in UK-based search results on Google and Bing News when searching the Russian spelling of Ukraine’s capital city (Kiev).  ASD and the Brookings Institution also found BNN reposts of Chinese state media regularly surfacing in top search results when users searched Xinjiang-specific keywords such as “Xinjiang,” “Xinjiang terrorism,” “Urumqi,” “Kashgar,” and “Xinjiang debunked,” on Google and Bing. Through mass replication across hundreds of domains, BNN ensures the persistence and search discoverability of content that has been banned or deplatformed elsewhere.

Besides the BNN network, RT’s Battle for Bulgaria stories were pushed by the Australia National Review (ANR) network, specifically by its three domains London Times, cnbs.news and goldcoastreview. Past ANR domains, including London Times and CNBS, amplified Storm 1519 operations that targeted Armenia and France. Storm 1519 is a Russian Information Manipulation Set (IMS) operating at least since August 2023 and responsible for dozens of information operations primarily targeting Ukraine and the West. The Battle for Bulgaria RT article was republished on at least eleven Pravda Network domains in multiple languages.

RT’s Battle for Bulgaria series triggered several waves of amplification between April 4-5 and then April 14-17. The RT links were amplified together with a statement by Russian Foreign Minister Sergey Lavrov that “the West is using so-called observers to meddle in voting around the globe,” and narratives that the defeat of Orbán was the result of coordinated EU interference involving intelligence services and opposition-aligned media. These messages also framed EU mechanisms such as the RRS as tools used to suppress unfavorable narratives and influence electoral outcomes across multiple European countries.

On April 7, then-candidate Rumen Radev shared his interview with journalist Marin Karbovski on his Facebook page, with a caption that accused the caretaker government of attempting to hijack the elections. “Their plan is in motion with formally requested EU assistance, with a hint of alleged hybrid external influence on the elections… I appeal to all Bulgarian citizens not to allow this brutal and ridiculous attempt to steal the elections,” Radev wrote. The post also repeated the “Romanian model” narrative with Radev claiming that this was the template his opponents intended to deploy against him.

Radev’s post was immediately picked up by domestic actors. Within hours, Bulgarian outlets,  including dir.bg, glasove.com, and epicenter.bg, published articles on Radev’s Romanian model accusation and targeting of RRS. These outlets have consistently been flagged by research organizations for amplifying pro-Kremlin narratives in Bulgaria.

Telegram channel БАЛКАНАРЬ, a Balkan-dedicated channel associated with the UK-sanctioned Rybar project, amplified Radev’s post on April 7. The post was also republished across several Pravda Network websites (kiev-news.ru, newskiev.ru, and zov-news.ru). On April 8, the Банкста Telegram channel, known for frequently amplifying Kremlin-aligned narratives, published a post that received at least 95,900 views. The text stated that the Bulgarian government had requested DSA activation to “impose censorship on Meta, Google and TikTok,” and that Radev had warned his victory might be annulled “by the Romanian model, where the court later acknowledged there had been no Russian influence.”

Another well-known Russia-aligned disinformation network, InfoDefense, added another layer of amplification. On April 7, infodefPORTUGAL claimed, in Portuguese, that it was the EU itself suppressing popular and dissident voices under the pretext of fighting disinformation. The next day, on April 8, @InfodefBULGARIA published in Bulgarian, accusing the caretaker government of pushing Romanian scenario to “steal Bulgarian elections.”

The third trigger event was an April 8 tweet by French politician Florian Philippot, leader of the far-right Patriots Party. Philippot framed Bulgaria’s legitimate request for EU election support as evidence of Brussels meddling in a sovereign national vote. It was reposted at least 1,310 times on X, with a simultaneous Facebook post garnering 1,665 shares. Within the hour, verbatim messages were spreading across the Patriots network. Across at least seventeen accounts over 24 hours, the text accumulated over 10,250 reposts and shares, with 8,586 on X, and 1,665 on Facebook.

Three days later, on April 11, the pro-Russian disinformation network Node of Time published the article “The EU Interferes Again in National Elections – This Time in Bulgaria” simultaneously in English and German on its Telegram channels. The article was also published on Node of Time’s German-language website nodeoftime.de. The same day, the Node of Time post appeared on the Pravda Network websites in German, Romanian, Bulgarian, French and English, all citing Node of Time English Telegram as the source. Philippot’s X post saw coordinated amplification by FIMI actors as part of a tactic to utilize Western politicians and official voices to add credibility to the narrative they push.

The largest spike of foreign activity in the dataset occurred on election day, April 19, with 104 messages. The spike was concentrated around the repackaging of RT’s “Battle for Bulgaria” series, when an AI-generated visual RT had used throughout its Bulgaria coverage was revived under the framing “EU Waging War on Democracy in Bulgaria.” The content was amplified on X across multiple accounts, and redistributed via Telegram (examples here, here, here, and here) and Pravda Network websites in multiple languages across several editions. The remaining operations identified in the dataset, including the BNN laundering cluster, InfoDefense, and the Pravda Network, contributed to the election day spike primarily by repackaging and aggregating live coverage throughout the day, from a morning turnout update and an exit poll update to a preliminary results update published as counting concluded.

The domestic discussion on EU mechanisms began immediately after the foreign ministry established the national coordination mechanism on March 23 and the RRS was activated on March 24. CSD identified a cluster of coordinated amplification originating from a Facebook post by commentator Viktor Blaskov. He framed the activation of the foreign ministry’s coordination mechanism as “mass censorship.” Blaskov’s Facebook post was republished across fourteen online articles and fourteen social media posts between March 24–29, 2026 with a combined potential reach of 3.06 million.

Throughout April, Bulgarian media outlets were central to pushing and repackaging materials from other websites, politicians, and commentators. One such website is Pogled Info, which systematically redistributes sanctioned Russian media content in the Bulgarian language. On April 1, Pogled published an interview with Anastasia Gesheva, a Bulgarian commentator who frequently promotes Kremlin-aligned narratives, titled “Bulgaria under siege — the war entered through the cabinet! Ukrainization, censorship, substitution.” In the interview, she framed the caretaker government’s Ukraine agreements as attempts to drag Bulgaria into war and the actions to counter hybrid threats and disinformation as an attack on democratic freedoms and citizens’ will. On April 3, Pogled also republished a piece by the chair of the Bulgarian Journalists’ Union under the headline “Between two wars, too many lies and a padlock prepared for the truth — is it not time to be outraged?” framing the foreign ministry’s counter-disinformation mechanism as a censorship tool disguised as election protection (the piece also casts the DFRLab’s reporting on Bulgarian websites distributing content from EU-sanctioned Russian outlets as an attack on media freedom). This is yet another instance of how official voices, in this case a journalist, are utilized in such operations to justify and increase the credibility of the claim.

The highest peak in domestic amplification content occurred in two waves, immediately after Radev’s April 7 interview and again on April 14. The coordinated campaign on April 14 centered on referendum mobilization around the “Referendum for the Bulgarian Lev,” the Bulgarian currency used until Bulgaria joined the Eurozone on January 1, 2026. The campaign was organized by the civic association Дойран 2025 (Doyran 2025), which had been calling for a parliamentary vote on eight questions covering Bulgaria’s EU membership and potential exit from the Eurozone. In February 2026, Doyran 2025 reported that Bulgaria’s Civil Registration and Administrative Services (GRAO) validated 267,484 of the more than 300,000 signatures the association had collected. Five days before the election, the campaign distributed identical content across Facebook and Telegram, listing the parties that had committed to bringing the referendum to a parliamentary vote. The amplifying network included Bulgarian Z-branded Telegram channels (ZOV.България🇧🇬, България Z, ZOV~ЗАедно, 🇧🇬Братя завинаги🇷🇺) alongside channels presenting as civic engagement platforms (WAKE UP!, Народна мрежа, Свободна и мирна България, and Всички за България). On April 15, the same content spread into Bulgarian diaspora Facebook groups in the United Kingdom (here, here and here) and was picked up by the Bulgarian edition of the Pravda Network. Distribution continued through April 16–17 via efir.info, local Facebook groups, and TikTok.

The campaigns targeting Bulgaria’s April 2026 elections demonstrate how influence operations can neutralize counter-disinformation mechanisms before they begin. By framing the EU’s Rapid Response System as a censorship tool and pre-seeding the “Romanian scenario” narrative, the campaigns pre-emptively undermined subsequent enforcement action. At the same time, these campaigns showed that the domestic and external amplification did not always require coordination to be mutually reinforcing, shared trigger events and identical framing produced overlapping amplification that collectively shaped the information environment before the vote was cast.

The BG Elves organization contributed to this research.

Sopo Gelava, “Kremlin-aligned actors targeted Bulgarian vote with EU interference claims,” Digital Forensic Research Lab (DFRLab), June 9, 2026, https://dfrlab.org/2026/06/09/kremlin-aligned-actors-targeted-bulgarian-vote-with-eu-interference-claims/.