Russia’s disinformation network targets mainly the countries of Central Europe, the Balkans and the former Soviet Union, an analysis by the Bulgarian Centre for Information, Democracy and Citizenship and Sensika Technologies showed on April 14.

Since the start of Russian’s invasion of Ukraine, the network has been actively distributing Russian disinformation as part of Moscow’s arsenal against Europe, according to ‘The Pravda Ecosystem: An Analysis of the Kremlin’s Regional Disinformation Strategy’.

The authors analysed 643,601 publications in 45 countries between December 2024 and March 2025, focusing on the Pravda disinformation network of over 190 websites.

The analysis showed that the biggest share of publications – 24.4% – focused on former USSR countries, followed by Central Europe (13.9%) and the Balkan states (11.9%).

The top 15 countries targeted by the disinformation publications are Moldova, Latvia, Estonia, Serbia, Armenia, Lithuania, Georgia, Slovakia, Bulgaria, Czechia, Denmark, Portugal, Hungary, Greece and Ukraine.

“The former USSR and Balkans regions account for a disproportionately high percentage of publications,” the analysis noted.

Moldova, Latvia and Estonia – all from the former USSR – have the highest publication rates per person at 0.01125%, 0.0094% and 0.00728% respectively.

In terms of regions, the highest share of publications per person targeted former Soviet states (0.00622%), the Balkans (0.00163%) and Central Europe (0.0015%).

“The data suggests a targeted focus on specific regions, potentially indicating coordinated disinformation campaigns,” the analysis noted.

Publications targeting former Soviet and Balkan states account for 52% of all publications despite representing a disproportionately small fraction of the population.

“The intensity of publications per capita is as much as 56 times higher in the most targeted countries compared to Western democracies, which indicates a sophisticated approach to shaping information environments in geopolitically significant regions,” the analysis said.

It added that these regions were of geopolitical interest for Kremlin and the disinformation efforts could have implications for democratic processes, social cohesion and regional stability.

The analysed sites appeared to be fully automated, reposting content from Russian news sources, social media, and Telegram channels without original reporting. To reach local populations and avoid sanctions, the content is translated.

“Forensic analysis by DFRLab links the operation to TigerWeb, a Crimea-based IT company with documented connections to Russian occupation authorities and possibly to figures in [Russian President Vladimir] Putin’s inner circle (including links to businesses associated with oligarch Arkady Rotenberg),” the analysis said.

It added that by early 2025, the Pravda ecosystem has grown to several hundred news aggregators, 140 subdomains targeting over 83 countries and content in dozens of languages.

“According to a March 2025 report, the Pravda Network has added ‘LLM grooming’ – deliberately flooding the internet with millions of articles across 182 domains in 12 languages that are designed primarily for AI consumption, with the strategic objective of permanently embedding Russian narratives into AI systems’ knowledge base,” the report said.