Moscow financed a vast propaganda campaign and large-scale interference in Bulgaria and Romania with 69 million euros, revealed a group of Bulgarian cybersecurity experts.
Russia spent 69 million euros to fund a large-scale propaganda campaign and interference targeting Bulgaria and Romania, disclosed BG Elves, a group of Bulgarian cybersecurity experts, as reported by the Bulgarian website novinite.com.
The funds were transferred through small, hard-to-detect transactions of up to 5,000 euros each. The goal was to spread Russian influence and promote far-right speeches in both Bulgaria and Romania, according to the cited source.
The plot started 14 years ago
BG Elves claims to have obtained documents linking these sums of money to companies and individuals operating in both Bulgaria and Romania, with the clear purpose of manipulating public opinion.
The group announces that in the last 48 hours, they have shared this information with journalists and investigative services from Romania, the United Kingdom, and Ukraine. According to them, the exchanged information was numerous and exceeded expectations.
The experts emphasize the complexity of the "plot," designed for years and dating back to 2010.
During the investigation, BG Elves discovered traces of Russian domains behind the "systems" used in manipulating society, many of which have been renamed and redirected over time to appear legitimate.
Despite these operations, Russian domains are still present in certain places.
BG Elves details how these systems were structured, using servers rented in the Netherlands and Germany to support them.
Personal data collected through ads ends up in Russia
The group identified a company - Adnow - that played a significant role in distributing propaganda and advertising with controversial content. The respective ads - often promoting sensational and misleading health claims - aimed to influence the public through the use of complex algorithms and tracking tools.
BG Elves found that the systems used by Adnow collect and profile users based on the content they consume, creating highly detailed profiles with information such as gender, location, and even "brutality ratings" (show_brutal_rate), in order to more efficiently adapt advertising to targets.
The ultimate goal of this operation, according to BG Elves, is to manipulate users into providing personal information through false offers and rewards systems.
Once obtained, the data is sent to Russia, where it is used for even more targeted attacks.
Traps-filled games
BG Elves reveals that a company developing mobile games used this personal information to install malware software on users' devices, gaining complete remote control.
This malware - known as Remote Access Trojan (RAT) - allows attackers to monitor users' personal communications and exploit their contacts, potentially enabling authors to manipulate and spread disinformation.
The group estimates that Adnow, which generates millions of impressions monthly, has infected thousands of users, allowing attackers to reach a "substantial" part of the Bulgarian population.
They emphasize that the activities of these Russia-backed entities have "significantly" expanded and currently include a wide range of services, such as "bot farms" and "VPN networks" aimed at supporting and distributing propaganda.
This investigation reveals a "disturbing breach" in national security, according to cybersecurity experts at BG Elves, who emphasize the importance of responding to these threats.
They continue to investigate the extent of this operation and announce that they will provide new information in the future.
BG Elves - a group focusing on fighting disinformation and hybrid threats - has previously drawn attention through factual verification reports aimed at revealing abuses in the public sphere and political life, as noted by Novinite.