The National Security Agency of North Macedonia stated that it had uncovered a propaganda infrastructure consisting of portals, social media pages and individuals who, according to the NSA, were serving Russian interests.
Disinformation Network
On 18 September, as part of a coordinated operation by the National Security Agency, the Ministry of Interior and the Basic Public Prosecutor’s Office for Prosecuting Organised Crime and Corruption, the home of a Macedonian national was searched. The individual, whose name has not been disclosed, is suspected of three criminal offences:
• inciting national, racial and religious hatred, discord and intolerance;
• disclosure of an official secret;
• dissemination of racist and xenophobic material through computer systems.
According to the NSA, the “actual actors” behind the “propaganda network serving Russian interests are hiding behind cloned pseudo-portals registered under the Macedonian internet domain.”
The uncovered media infrastructure was used for
- the dissemination of fake news and disinformation,
- the manipulation of current issues by altering or reframing narratives about ongoing events,
- and the creation of content that undermines trust in institutions and incites ethnic and national intolerance.
The NSA links the network to regional pro-Russian political structures and claims that the network operated in the interests of Russia and that its activities were aimed at disrupting North Macedonia’s European integration processes. According to the National Security Agency, the Macedonian national disseminated Russian propaganda ahead of the recent visit to Skopje by European Commission President Ursula von der Leyen.
The NSA statement does not officially name either the individuals or the portals spreading disinformation and manipulation. However, the NSA stressed that “the aforementioned activities are a continuation of previously disrupted pro-Russian hybrid activities carried out by a Macedonian national linked to these propaganda networks, against whom a criminal case was also initiated for the dissemination of racist and xenophobic material through a computer system under Article 394-d of the Criminal Code.”
Combating Hybrid Influence
The current activity of North Macedonia’s security services and law enforcement agencies is viewed as a continuation of the previously launched fight against hybrid influence.
In March 2026, the NSA announced that it had disrupted the hybrid activities of certain individuals, noting that, together with the Public Prosecutor’s Office and the Ministry of Interior, organised measures and actions had been taken in a coordinated manner to prosecute individuals and seize propaganda materials intended to incite ethnic and national intolerance, hostility and hatred among citizens. “The individuals in question planned to incite hatred towards the Macedonian state and identity and create tensions through the printing and distribution of propaganda materials, while through the social network Facebook, on the ‘Historical Data for Macedonia’ page, they disseminated content that caused national and ethnic discrimination,” the Agency stated.
The Public Prosecutor’s Office then announced the criminal prosecution of one individual for disseminating racist and xenophobic material through a computer system under Article 394-d of the Criminal Code. “Through a specially created page on the social network Facebook, the suspect disseminated content that caused national and ethnic discrimination, thereby inciting hatred towards the Macedonian state and identity. According to preliminary information from the National Security Agency, police officers conducted a search and seized propaganda materials that the 30-year-old Skopje resident had printed with the intention of distributing them in the country,” the statement said. “The suspect was incited to engage in such activities by a Bulgarian national who, over a prolonged period, had published content on social media and other portals aimed at inciting hatred, intolerance and violence,” the statement said, the Public Prosecutor’s Office announced at the time.
Media later reported that the Ministry of Interior and the National Security Agency were investigating the activities of around twenty portals and social media pages over the dissemination of hate speech related to the dispute between North Macedonia and Bulgaria.
In July, the Macedonian outlet “360 Degrees” published its own investigation into a disinformation and propaganda media network.
Journalistic Investigation
The investigation by journalists from “360 Degrees” identified at least five Macedonian-language Facebook pages, managed from Bulgaria, which presented themselves as media outlets. They, in turn, published news from five websites registered in North Macedonia and one from abroad — Vestimak.mk, Vestimk.mk, 24mk.mk, Mk24.mk and Utre.mk. “360 Degrees” determined that the pages published almost identical content, while the portals had almost identical designs and copied one another’s texts.
According to data from the Bulgarian domain-name registrar MARNET analysed by the journalists, two portals — Vestimak.mk and Vestimk.mk — were registered by Aleksandar Smiljkov, while 24mk.mk, Mk24.mk and Utre.mk were registered by Asen Petrovski. The groups of portals used common contact addresses, and “360 Degrees” found that some of these addresses were linked to the Macedonia Foundation in Sofia, founded by Bulgarian politician Viktor Stoyanov. Stoyanov is banned from entering North Macedonia over accusations of inciting hostility and denying Macedonian identity.
According to the investigation, part of the network’s content concerned relations between Macedonia and Bulgaria, Macedonians and Albanians, as well as other issues that can easily provoke sharp political and identity-related divisions.
The purpose of the network of several online resources was to ensure that the content reached as many people as possible while at the same time appearing to be spontaneously generated public opinion. A publication from one website was republished by the other four and was then heavily amplified on Facebook through posts and short videos. The reader was given the illusion that there was some “current issue” being discussed by “dozens of independent sources,” whereas in reality the same manipulative message was simply circulating.
Nothing New
If one is to read the latest statement by the National Security Agency carefully, the methods used by the suspect and the network to which he belonged almost completely coincide with the methods used by the portals and Facebook pages discussed in the July investigation by “360 Degrees.” However, the security service now has evidence that the uncovered infrastructure operates in Russian interests.
Commenting on the NSA statement, the Macedonian human rights organisation CIVIL, which has been monitoring Russian propaganda and various forms of hybrid influence in the media, politics, civil society, the economy and public discourse for more than ten years, noted that the security service had not uncovered anything that had previously been unknown. In numerous special reports, studies and publications, CIVIL has accurately mapped the patterns that the National Security Agency is now describing: local intermediaries, media and digital channels, pro-Russian political and ideological narratives, and mechanisms for undermining trust in democratic institutions and the country’s European prospects. However, as the organisation notes, “for years, such warnings were met with minimisation, ridicule, pressure, threats and discrediting campaigns,” while “in political, media and parts of civil-society discourse, Russian influence was often presented as insignificant, marginal or fabricated.” “Today’s institutional actions do not automatically confirm every conclusion that CIVIL has published over many years. But they constitute strong institutional confirmation of the central warning: Russian hybrid influence in North Macedonia is a real threat to security and democracy, with domestic and regional channels and an organised information infrastructure,” the human rights organisation stresses.
The NSA’s assessment is also consistent with the official assessments of the European Union regarding the state of hybrid threats in North Macedonia. EU documents identify Russia as an actor in foreign information manipulation operations targeting North Macedonia, while in the 2025 North Macedonia Report the European Commission states that hybrid threats remain a risk, particularly through malign foreign interference, economic instruments of influence, operations in the information space and cyberattacks.
Despite this, North Macedonia still has no law regulating foreign influence and radicalisation in the online space. Such a law, Macedonian media report, is still being drafted: EU experts are involved, but domestic institutions have not yet managed to establish a working group.
Conclusions
The exposure of the disinformation network marks a qualitative transformation of the Russian Federation’s hybrid tools in the Western Balkans. After broadcasts by Russian propaganda channels, including RT (Russia Today) and Sputnik, were discontinued in some countries of the region, including North Macedonia, the Kremlin shifted to building decentralised proxy networks. This model combines the use of national domains, the technical cloning of resources and the involvement of actors from neighbouring countries.
The Macedonian case demonstrates that journalistic fact-checking and civil-society analysis are insufficient to counter hybrid threats. The current situation requires systematic countermeasures against information threats in cyberspace and coordination among all state bodies to protect against destructive foreign — Russian — influence.
CWBS Analytical Group
