Investigation Reveals Extensive Russian Disinformation Networks

Russian Disinformation Network Exposed Across Europe by Investigative Journalists

Bulgarian investigative outlet Bird.bg, in partnership with EUalive, has uncovered an extensive network of Russian propaganda and disinformation campaigns operating throughout Europe. The investigation, conducted alongside international media organizations under the Organized Crime and Corruption Reporting Project (OCCRP), reveals how Kremlin-linked actors systematically spread falsehoods designed to erode trust in Western institutions.

The recently published report, “Spies, lies and clicks: the wicked world of pro-Russia disinformation in Europe,” details how Russia-aligned operatives have established sophisticated channels to disseminate propaganda across digital platforms, particularly following Russia’s 2022 invasion of Ukraine.

At the center of this investigation is the German-language website Anonymous News, which attracts approximately 100,000 monthly visitors. The site regularly publishes pro-Kremlin and anti-Western narratives, including fabricated stories linking French President Emmanuel Macron to Jeffrey Epstein’s criminal enterprises—allegations that investigators confirmed have no basis in official U.S. records.

Bird.bg and its partners have traced these operations to Russia’s broader disinformation apparatus, specifically to an operation codenamed Storm-1516. French cybersecurity agency Viginum previously identified this campaign as the work of GRU Unit 29155, a Russian military intelligence division known for conducting covert operations abroad.

“What makes these operations particularly effective is not necessarily their sophistication, but their persistence,” said one investigator involved in the project. “Repeated exposure to propaganda, even when modest in scale, can normalize fringe viewpoints in public discourse.”

The investigation employed a multi-faceted approach combining digital forensics with traditional on-the-ground reporting. Researchers analyzed website traffic patterns, server infrastructure, and hyperlink networks, discovering that Anonymous News shares Russian servers with several predecessor sites. Financial investigations followed donation trails through platforms like PayPal to a Czech company, AN Média a Platební Služby s.r.o., nominally owned by a Bulgarian national named Ivelin Borisov.

When journalists visited Borisov at his remote village home, he admitted to signing documents for minimal payment but denied any involvement in content creation—suggesting he was used as a front for the operation’s true administrators.

The journalists also examined leaked phone data, court records, and social media analytics. Their research uncovered connections between Telegram channels like Corob_12, operated by Russian national Alexey Bashilov, and Russia’s Federal Security Service (FSB). Phone registrations linked to these accounts were traced to locations near FSB headquarters in Moscow.

Among the key figures identified in the report is Mario Rönsch, who presents himself as the editor of Anonymous News. Rönsch, a German far-right activist with a criminal history including arms trafficking, reportedly shifted toward pro-Russian positions after 2014. Investigators found evidence of his trips to Moscow, and he is now believed to be based in Russia.

Other figures in this network include Magdalena Prusova, a Czech administrator, and Bashilov with his apparent FSB connections. The investigation also highlights how high-profile Kremlin propagandists like Vladimir Solovyov amplify these narratives through channels with over 76,000 subscribers and millions of YouTube views.

“What we’re seeing is a hybrid threat that operates below the threshold of traditional warfare,” explained a disinformation analyst consulted for the investigation. “These operations cost relatively little to maintain but can significantly impact public opinion and democratic processes.”

The collaborative investigation has already produced tangible results. Following journalistic inquiries, AN Média entered liquidation proceedings, and several implicated social media accounts were deleted, suggesting awareness of exposure.

By connecting seemingly independent news outlets to Russian intelligence agencies like the GRU and FSB, Bird.bg and its partners have demonstrated the vulnerability of European information spaces to coordinated influence operations. The investigation highlights how even small-scale disinformation efforts can threaten democratic institutions when strategically deployed.

This cross-border journalism initiative represents a growing counterweight to authoritarian influence operations, with media organizations increasingly collaborating to expose threats that no single newsroom could fully uncover alone.