BELGRADE -- It was midnight in Tehran and 10 in the evening in Belgrade on April 13 and a massive disinformation campaign was about to be launched.
At the time, Iran was just starting to unleash one of its biggest ever drone and missile attacks against Israel, ratcheting up already heightened tensions in the Middle East.
With a jittery globe closely following the news, an obscure Serbian-language media outlet began churning out articles on the Iranian attack at breakneck speed -- more than 100 stories every hour -- even though facts and details were few and elusive.
Much of the information appeared sourced to nothing more than Russian-language Telegram channels, the Kremlin-funded RT network, or other Russian-state-run media.
A monthslong investigation by RFE/RL's Balkan Service determined that it was part of a wider pro-Kremlin disinformation network, which uses automation to rapidly create hundreds of news articles, often based on content from Russian media outlets banned by the EU.
How Does The Network Work?
In February, VIGINUM, the French government body that monitors foreign digital interference, released a report on a pro-Russian propaganda network it called "Portal Kombat."
It identified some 193 websites that aimed to broadly spread information from pro-Russian sources as well as Russian news outlets and institutions.
For four months, RFE/RL tracked websites in multiple languages targeting audiences in Bosnia-Herzegovina, Albania, North Macedonia, and Serbia, the undisputed lead target of the propaganda during the period RFE/RL monitored.
The RFE/RL investigation shed light on the global operation, showing how "articles" were automatically generated and released in waves, ending up on local-language websites masquerading as legitimate news sources -- a growing trend in the worldwide disinformation war.
Sympathies With Russia
The Balkans have long proved fertile ground for pro-Russian narratives, especially in Serbia whose President Aleksandar Vucic has courted friendly relations with Russian President Vladimir Putin while also pursuing EU membership.
A poll across the Western Balkans by the International Republican Institute (IRI) released on May 14 showed that, while a majority of respondents from Albania, Kosovo, Bosnia, Montenegro, and North Macedonia denounced Russia's aggression in Ukraine, 49 percent of Serbs viewed it as "justified."
The Balkan versions of Portal Kombat websites were strikingly similar across different languages. All the bogus news websites targeting the region that RFE/RL monitored had the same layout, structure, and even name: Pravda, or truth.
Digital forensics show just how quickly the websites were created. The first Pravda website, in Serbian -- Pravda-rs.com-- was registered on March 20. A few days later -- and within seconds of each other -- another three Pravda domains were registered: in Bosnian, Macedonian, and Albanian.
Automated Fake News: How The Content Spreads So Quickly
From March 22 to July 20, a total of 70,719 news items were published across those four websites. But the bulk of the articles, more than 67,000, appeared on the Serbian-language site.
Focusing on the Serbian-language website allowed RFE/RL to track how pro-Russian content spreads across multiple platforms within just minutes.
Most content appearing on the four websites appears to have been taken from pro-Kremlin Telegram channels. The network's automation process is so efficient that the time between posting on a Telegram channel and appearing on the Pravda sites ranges from just three to 12 minutes.
The disinformation operation also utilizes Russian platforms such as VK Video and Yandex to translate, produce, and distribute the content.
Low-Cost Russian Propaganda
Despite all the operation's apparent sophistication, VIGINUM notes in its recent report that the websites in the Portal Kombat network it investigated do not generally attract high readership.
For the sites targeting the Balkans, Similarweb, a service that tracks visits to registered websites, reports that the most active site, Pravda-rs[.]com, had fewer than 5,000 visits in June.
Whether the campaign was effective, however, almost doesn't really matter, argues disinformation expert Peter Benzoni, given the negligible costs to generate the disinformation.
"For Russia, this is information warfare. Just as with drones, low-cost attacks that fail 99 percent of the time are justified by the 1 percent that succeed. These sites are the drones of information warfare," Benzoni, an investigative data and research analyst at the Washington-based German Marshall Fund's Alliance for Securing Democracy, told RFE/RL.
Disinformation About Ukraine
Russia's war against Ukraine is the most popular topic on the Serbian website, with hundreds of unverified battlefield reports, often labeling Russian soldiers as "ours" and those fighting on the Ukrainian side as "enemies."
While international news generally doesn't feature prominently, as there are fewer dedicated Telegram channels, the events in the Middle East on April 13 proved an exception, RFE/RL found.
During the night of April 13-14, Iran's attacks on Israel not only "exploded" on the Serbian site but also on those in the Albanian, Macedonian, and Bosnian languages.
The number of articles, which on the Serbian site was usually around 500-600 per day, surged to more than 1,000 on April 14. Even higher activity was observed on the remaining three sites in the Balkans.
The network took content from popular and prominent Russian bloggers, and their posts were synchronously published on all four Balkan language sites.
In addition to numerous video clips of questionable authenticity, many articles were published justifying Iran's attack, as well as various unsubstantiated claims about what Washington allegedly knew in advance.
RT, which the U.S. State Department describes as a key player in the Kremlin's disinformation and propaganda apparatus, has been blocked in the European Union, Canada, and other countries since Russia's full-scale invasion of Ukraine in February 2022. In May, the bloc suspended four other Russian media outlets from broadcasting.
But Russian media, using bogus news websites, such as those investigated by RFE/RL, have found a backdoor to European audiences, with much of the banned media content uploaded to these sites, Benzoni explains.
"Whether or not it's collusion doesn't really matter -- they see more viewers of Russian state media content as a net benefit, no matter the vector," Benzoni adds.
