A group of Bulgarian cybersecurity experts, known as BG Elves, has revealed that the Russian Federation has spent 69 million euros to fund a large-scale propaganda and interference campaign targeting Bulgaria and Romania, novinite.com writes.

According to BG Elves, the funds were channeled through small, difficult-to-detect transactions, with amounts as low as 5.000 euros each. The aim was to spread Russian influence and promote far-right narratives within the two countries.

BG Elves claims to have obtained documents linking these cash flows to companies and individuals operating both in Bulgaria and Romania, with a clear goal of manipulating public opinion.

BG Elves stated that they had shared this information with investigative journalists and services in Romania, the UK, and Ukraine. The exchange of details, they claim, has been vast and surpassed their expectations. They further highlighted the complexity of the scheme, which has been operating for years, with its origins traceable back to 2010. During their investigation, BG Elves discovered traces of Russian domains behind systems used for manipulating society, many of which had been rebranded and redirected over time to appear legitimate. Despite this, old Russian domains still remain in some places.

BG Elves detailed how these systems were structured, with rented servers in the Netherlands and Germany supporting them. They pointed to one particular company, Adnow, which has played a significant role in distributing propaganda and advertisements with controversial content. The ads in question, often promoting sensational and misleading health claims, are aimed at influencing the public by leveraging complex algorithms and tracking tools. BG Elves uncovered that the systems used by Adnow collect and profile users based on the content they consume, creating highly detailed profiles with information such as gender, location, and even "brutality ratings" (show_brutal_rate) to tailor the ads to individuals more effectively.

The ultimate goal of this operation, according to BG Elves, is to manipulate users into providing personal information through false offers and prize schemes. Once obtained, the data is allegedly sent to Russia, where it is used to launch further targeted attacks. BG Elves detailed how a mobile game development company has been using this personal information to install malicious software on users’ devices, giving them full remote access. This malware, known as RAT (Remote Access Trojan), allows attackers to monitor the victims' personal communications and exploit their contacts, potentially enabling the perpetrators to manipulate and spread disinformation.

BG Elves also explained how vast the scale of the operation is. They estimated that Adnow, which generates millions of impressions every month, could have infected thousands of users, allowing attackers to reach a substantial portion of the Bulgarian population. They further pointed out that the activities of these Russian-backed entities have expanded significantly and now include a wide array of services such as bot farms and VPN networks, all aimed at supporting the distribution of propaganda.

This investigation highlights a concerning breach of national security, with BG Elves stressing the importance of addressing these threats. They are continuing to investigate the full extent of the operation, promising more updates in the future. BG Elves, a group focused on combating disinformation and hybrid threats, has previously gained attention for their fact-checked publications aimed at revealing data about abuses in both public and political spheres.