This article is part of CIVIL’s Hybrid Warfare Early Warning Report Series, produced within the Democracy Navigator project.

1. Introduction: A Quiet Frontline in the Shadow of Europe

North Macedonia may never draw headlines like Kyiv or Vilnius, yet it stands on one of Europe’s subtler, more vulnerable frontlines of hybrid warfare. Here, the battles are fought with narratives more than bullets, with loyalties more than land. In recent years, particularly since end of 2016, Russia — often working through proxies and local vectors — has adapted its playbook to exploit political and ethnic fragmentation and polarization, institutional weak spots, linguistic cleavages and historical grievances in North Macedonia.

This report maps that evolving threat, identifies its vectors, and points toward indicators that require urgent action.

2. The Russian Influence Footprint in North Macedonia

2.1 Strategic Context

North Macedonia is under siege — not by armies, but by narratives. The country faces a coordinated hybrid assault from Serbia and Russia, designed to erode democratic institutions, undermine and possibly paralyze Euro-Atlantic integration, and reshape national identity through cultural, political, and psychological means.

An analysis published earlier on CIVIL Today draws on on-the-ground reporting, personal experience, and exclusive expert insights, as well as testimony from both public figures and anonymous insider sources in the fields of intelligence, politics, and civil society. It exposes how foreign propaganda, clerical influence, and media manipulation work in concert to normalize authoritarianism and discredit democratic resilience.

Unless urgent countermeasures are taken, North Macedonia may become the next casualty in a regional authoritarian surge turned into another proxy state on Moscow’s map of influence and domination — one with profound consequences for the democratic future of Europe’s southeast. (No Bullets, No Borders, Conquered by Narrative: The Silent Conquest of North Macedonia – CIVIL Today, September 11, 2025)

Prof. Dr. Oliver Andonov, a veteran of the ruling party VMRO-DPMNE and professor at the Military Academy in Skopje, goes even further, writing for CIVIL Today that:

“It is extremely visible that the war for North Macedonia and its alienation from NATO and the EU is crucial for Russian geopolitics as a starting base for active actions and creating conflicts in the region. The success that the Kremlin has achieved at this current moment by turning North Macedonia into a proxy state that publicly talks about NATO and the EU, concludes strategic agreements with the United Kingdom and the United States, but in fact constantly watches and waits for signals from Moscow through Belgrade and Budapest. However, it does not have the potential to develop to the extent of completely alienating Macedonia from NATO.”

According to the European Parliamentary Research Service, North Macedonia displays among the lowest vulnerability to foreign influence in the Western Balkans, yet it remains exposed owing to unresolved institutional reforms and delays in Euro-Atlantic integration. (European Parliament)

With limited direct economic leverage compared to Serbia or Bosnia, Moscow’s influence in North Macedonia is structural and narrative, not transactional — but it is decisive. Russia’s objective is not domination, but destabilisation of alignment: keeping North Macedonia’s Western orientation fragile and its integration path uncertain.

2.2 Political and Media Vectors

CIVIL’s monitoring and other local studies identify a network of media and political actors in North Macedonia that echo “Serbian World” and “Russian World” narratives: anti-Western, anti-NATO, sceptical of EU reform.

Waves of direct or indirect Russophile messages and media contents through Serbian-language outlets, Orthodox Church channels and social-media proxies act as decisive conditioning of public opinion.

While Russia has not established large economic footholds, one Russian-origin businessman (Sergey Samsonenko) serves as an example of how informal networks provide access and influence. However, many other companies, including Lukoil with major presence in the country’s market, operate for years, providing an economic platform that play important – though not direct – role in the political and media sphere.

Still, some smaller political parties, including one mayoral candidate, gained prominent media attention at the local elections in October 2025, by promoting investments from Russia and Belarus.

2.3 Soft Power and Identity Instruments

Russian cultural centres, language institutes and ecclesiastical ties through the Russian Orthodox Church (RPC) and Serbian Orthodox Church (SPC) provide ideological cover. (New Geopolitics Research Network)

The narrative of “Slavic brotherhood,” “Orthodox values,” and “Western interference” are narratives that are deeply entrenched in North Macedonia’s political scene, as well as institutions, including academic circles and universities, as extensions of foreign control rather than domestic self-determination.

3. Proxy Networks and Local Enablers

The defining feature of Russia’s approach in North Macedonia is information-dominant hybrid warfare — shaping institutions, media narratives, and collective identities long before any potential kinetic action.

Although the country has not yet become a theatre of large-scale sabotage operations attributable to Russia (as seen in Poland or the Baltic states), the architecture of influence is already visible and steadily deepening. As one analysis published by CIVIL Today aptly notes, “there is no need for sabotage in a country that has already shifted from being a target to becoming a proxy.”

Local political parties, business networks, and media outlets serve as proxies and amplifiers of Russian narratives. They host Moscow-aligned figures, oppose Western reforms, and systematically erode institutional resilience. This reflects the broader model observed across the Balkans — a “low-cost, high-deniability” operation that thrives on weak governance and fragmented public trust.

Even within the government, officially pro-EU in stance, pro-Russian alignment is unmistakable. The Deputy Prime Minister, Ivan Stoiljkovic, maintains openly close ties with Belgrade and Moscow. Likewise, Maksim Dimitrievski, leader of the coalition partner ZNAM and mayor of Kumanovo, sustains a visible friendship with Russian Ambassador Sergey Bazdnikin. Under his mayoral administration, studying Russian language was promoted in local primary schools — a symbolic yet strategically significant gesture reinforcing both cultural and political alignment with Moscow.

While major Russian energy or gas infrastructure is limited here, except for Lukoil, Russia uses cultural-educational, media, and religious channels as vectors of influence. These vectors provide longevity: the covert structure remains even when headlines shift elsewhere.

4. Strategic Vulnerabilities in North Macedonia

North Macedonia remains one of the most exposed environments in Southeast Europe to non-military hybrid interference. While its Euro-Atlantic alignment is formally secured, its institutional fragility, polarized politics, and contested identity landscape continue to provide fertile ground for influence operations. The Kremlin and its regional proxies exploit these structural gaps — not to conquer territory, but to erode confidence in democracy, Western integration, and social cohesion from within.

• Delayed EU accession and reform stagnation create vacuums that hybrid actors exploit. Even more, ethnic/linguistic divisions (Macedonian vs Albanian, Slavic vs non-Slavic) are being extensively used to manipulate by both domestic and Russian actors via narratives of exclusion and grievances, and often with explicit hate campaigns, and open calls to violence.
• Media ecosystems lacking transparency allow amplification of pro-Russian and anti-Western narratives disguised as local authenticity or even as “professional balance” and “neutrality.”
• Finally, weak institutional capacity in areas like civic oversight, intelligence coordination and media regulation opens the door for persistent hybrid penetration.

5. Indicators & Early-Warning Signals for North Macedonia

Hybrid threats rarely appear suddenly—they accumulate beneath the surface, evolving through narratives, networks, and influence channels long before becoming visible crises. For North Macedonia, where geopolitical and internal polarization, and information manipulation converge, early detection depends on vigilance across social, political, economic, and cultural domains. CIVIL’s Hybrid Threats Monitoring Team recommends close attention to the following signals (the list is not exhaustive):

• Information space: Unusual uptick in social-media activity promoting anti-EU or anti-NATO narratives, particularly through newly created or coordinated pages and Telegram channels.
• Cultural and diplomatic presence: Visits by Russian or Serbian business, cultural, religious, or educational delegations to Skopje or regional cities under ambiguous or informal mandates, as well as frequent visits by local clerics, businesspeople, and politicians to Belgrade, Moscow, or Budapest that coincide with political or media escalations.
• Economic infiltration: Emergence of new business entities or off-shore firms with opaque Russian ownership or financing, especially in media, energy, construction, and real-estate sectors. CIVIL has already revealed a number of suspicious business moves, including the entry of Serbia’s Alta Banka into North Macedonia’s banking system and activities of certain business chambers currently under investigation for possible influence operations and illicit financial linkages.
• Political Messaging: Local political figures or parties adopting or amplifying pro-Russian rhetoric, often framed around sovereignty, national identity, or historical revisionism, and frequently interwoven with nationalistic anti-Albanian or anti-Bulgarian sentiments. Such narratives are often mirrored by reactionary anti-Macedonian rhetoric from certain ethnic Albanian actors, creating a cycle of mutual mistrust and identity-based confrontation. This polarization serves the interests of external actors—chiefly Russia and Serbia—by deepening internal divisions, weakening social cohesion, and diverting attention from governance failures, corruption scandals, and the country’s Euro-Atlantic obligations.
• Disinformation Campaigns: Coordinated propaganda bursts tied to symbolic or politically sensitive dates (NATO anniversaries, EU summits, national holidays) aimed at undermining institutional trust and social cohesion.

Hybrid warfare thrives in the grey zones of perception and passivity. Identifying these signals early allows for institutional response and for civic resilience—the capacity of citizens, journalists, and educators to recognize manipulation before it shapes reality.

6. Outlook: Risk Trajectory for the Next 3–6 Months

In the months ahead, North Macedonia’s hybrid threat landscape is expected to remain volatile and multidimensional. The main danger lies not in open conflict but in the convergence of external manipulation and domestic instability. Moscow and its regional enablers—primarily through Serbian political, clerical, and media networks—will continue to exploit every form of polarization: political, ethnic, and ideological. The objective is to keep the country internally preoccupied, institutionally weak, and externally uncertain.

Projected Trends

• Low probability of major kinetic sabotage, but a high risk of cumulative influence operations—via information manipulation, targeted corruption, and political co-option of elites or institutions.
• Intensification of information and psychological operations, including amplified disinformation campaigns, social-media provocations, and coordinated narratives portraying Western partners as unreliable or manipulative.
• Possible political crisis emerging from interethnic tensions and the fading legitimacy of the current government led by Hristijan Mickoski, particularly if power-sharing principles under the Badinter framework are further strained.
  Growing interethnic tensions, legitimacy issues, as well as possible public frustration over weak EU-integration performance and stalled reforms could increase the likelihood of high-stakes early parliamentary elections, creating a window of opportunity for malign actors to test social cohesion and institutional endurance.
• Potential trigger events include shifts in Western policy—such as expanded NATO exercises in the region, Ukraine-aid or sanctions summits, or EU measures perceived as “exclusionary”—that could prompt Russian-proxy networks to activate synchronized “staking” campaigns in media and political discourse.
• If North Macedonia continues to delay reforms or falters in its Euro-Atlantic alignment, it may remain “safe” from overt hybrid attacks—not due to resilience, but because it has been rendered strategically neutralized, a silent victory for the Kremlin’s long game.

The next six months may prove decisive in determining whether North Macedonia sustains its democratic trajectory or succumbs to a cycle of distraction and decay. As analysts and observers have concluded many times before, hybrid warfare does not rely on armies—it feeds on confusion, cynicism, and fatigue. It thrives when citizens lose faith, when institutions are captured, and when truth becomes negotiable. Recognizing this—and responding before disinformation turns into disintegration—is not just a matter of security; it is a matter of survival for democracy itself.

The most serious threat is not a single act of sabotage but a slow erosion of legitimacy, where institutions lose authority, communities lose trust, and citizens lose faith that democracy can deliver.

CIVIL’s Hybrid Threats Monitoring Team will therefore focus its forthcoming reporting on early indicators of political destabilization, interethnic polarization, and narrative escalation—factors that, if combined, could transform latent hybrid pressure into a systemic national crisis.

7. Recommendations: Strengthening Institutional and Civic Resilience

Hybrid warfare thrives where governance is weak, journalism is intimidated, and citizens are disoriented. Preventing the normalization of manipulation requires coordinated action among institutions, media, and civil society.

Yet in times when institutions are captured or paralyzed by political influence, it falls upon civil society, independent media, and intellectuals to take the lead in restoring societal trust and democratic resilience. But this effort cannot succeed in isolation — it demands strong, sustained, and principled support from international and European democratic partners who share responsibility for defending the continent’s values and stability.

Drawing on CIVIL’s extensive fieldwork and the Defending Democracy Global Initiative’s (DDGI) international partnerships, the following strategic recommendations aim to strengthen North Macedonia’s resistance to hybrid threats over the next 6–12 months.

7.1. Institutional Integrity and Accountability

Institutional resilience begins with integrity. Hybrid threats exploit opacity, weak governance, and divided authority — often turning bureaucratic inertia into a weapon. To counter this, North Macedonia must strengthen its systems of transparency, accountability, and coordination. The following measures outline urgent steps to safeguard institutions from foreign penetration, political capture, and corruption.

• Create a Hybrid Threat Coordination Mechanism connecting professionals from state institutions, academia, and civil society for joint analysis, early warning reports, and rapid response.
• Demand full transparency in political financing, lobbying, and foreign donations, ensuring that Russian- and Serbian-linked funding and influence channels are publicly traceable.
• Audit strategic sectors—media, energy, banking, real estate—for opaque or offshore ownership structures, including networks linked to Alta Banka and other regional intermediaries.
• Introduce integrity testing and vetting for high-level officials and regulators, modelled on NATO and EU anti-corruption frameworks.

7.2. Information Resilience and Media Freedom

Information resilience is the first line of defense in modern hybrid warfare. When truth becomes contested, transparency, education, and professional journalism form the core of societal protection. Building a media environment resistant to manipulation requires structural safeguards, media literacy, and unwavering support for free, independent reporting.

• Promote integration of media-literacy education into public and higher education to enhance critical thinking and digital discernment.
• Enforce transparency in media ownership and funding, particularly concerning political advertisers or foreign sponsors.
• Provide targeted international donor support for independent journalism exposing hybrid-influence and corruption networks, with legal and security protections for reporters.
• Establish a cross-platform rapid-alert system to coordinate fact-checking and response to disinformation spikes around elections or sensitive geopolitical, regional, and national events.

7.3. Civil Society and Public Awareness

Civil society remains democracy’s most adaptive shield. In moments when institutions hesitate or are captured, civic organizations, educators, and journalists preserve the democratic spirit. Strengthening their capacity to detect, expose, and explain hybrid operations is vital to maintaining public trust and countering polarization at the community level.

• Empower civic organizations and watchdogs to document and publicly expose Russian- and Serbian-linked actors in politics, culture, and business.
• Support local journalists and community initiatives capable of detecting hybrid manipulation at the grassroots level.
• Foster civic-dialogue platforms that bridge ethnic and political divides and counter polarization through inclusive public debate.
• Integrate hybrid-threat awareness into civic education and leadership programmes, framing democracy, human rights, and security as interdependent values.

7.4. Regional, International, and Donor Engagement

No democracy can confront hybrid warfare in isolation. Regional coordination and sustained international support are indispensable for resilience. By aligning national efforts with EU and NATO frameworks and engaging trusted partners and donors, North Macedonia can transform solidarity into a practical, long-term defense strategy against malign influence.

• Deepen cooperation with EU, NATO, OSCE, and democratic governments to align with the EU’s Foreign Information Manipulation and Interference (FIMI) framework.
• Encourage international donors and European governments to prioritize long-term, flexible, and strategic funding for civil society and independent media rather than short project cycles that limit sustainability.
• Strengthened through partnerships with the Defending Democracy Global Initiative (DDGI) and its co-founders and partners — including Media Dialogue, Youth4Media, and the New European People’s Forum (Germany), as well as the Jean Monnet Association (France), Centro Studi Internazionali (Italy), and others — CIVIL is positioned to coordinate AI-enhanced monitoring, share verified intelligence, and produce multilingual counter-disinformation content across Europe and the Western Balkans.
• Promote civic-diplomatic campaigns across Europe that highlight the human, societal, and economic cost of hybrid aggression — turning awareness into actionable solidarity.

The Last Line of Defense: Civic Courage and Democratic Responsibility

Resilience begins where institutions end and civic responsibility begins.

When institutions are captured or compromised, civil society and the media become the last line of democratic defence. But resilience cannot depend solely on their courage — it must be reinforced by the moral and material support of Europe’s democratic governments, institutions, and donors, whose credibility rests on defending those who defend democracy.

CIVIL’s Hybrid Threats Monitoring Team, together with the Defending Democracy Global Initiative and its partners, will continue to track, expose, and counter malign influence operations — working with allies across Europe to uphold truth, transparency, and solidarity as the continent’s most powerful defense.

Read More:

• European Parliament Research Service (EPRS): Russia and the Western Balkans (briefing) (LINK)
• OSCE/ODIHR: North Macedonia 2024 Presidential & Early Parliamentary Elections—Final Report (media & online environment) (LINK)
• OSCE/ODIHR: Local Elections 19 Oct 2025—Interim Report (campaign context, information space) (LINK)
• U.S.–North Macedonia: MoU on a Strategic Counter-Disinformation Partnership – State Dept. (LINK)
• U.S.–EU: Coordination Mechanism on Information Integrity in the Western Balkans (LINK)
• European Parliament (AFET): 2023 and 2024 Commission reports on North Macedonia (LINK)
• Russia’s influence in the Balkans: Challenges for supporting Ukraine in countering Russian armed aggression – Kateryna Shymkevych (LINK)
• Disinformation in the Western Balkans – Daniel Sunter, NATO (LINK)
• Information Integrity and Countering Foreign Information Manipulation & Interference – FIMI (LINK)
• Presidential and Parliamentary Elections, 24 April and 8 May 2024, Interim Report – ODIHR (LINK)
• Mapping Fake News and Disinformation in the Western Balkans and Identifying Ways to Effectively Counter Them – Samuel Greene, Gregory Asmolov, and others, AFET, European Parliament (LINK)
• Russia and the Western Balkans Geopolitical confrontation, economic influence and political interference – European Parliament (LINK)
• How the Renaming of a Country Became a Battleground Between Russia and the West – Billy Perrigo, TIME (LINK)

House Reading:

• No Bullets, No Borders, Conquered by Narrative: The Silent Conquest of North Macedonia – Jabir Deralla, CIVIL Today (LINK)
• THE HYBRID THREATS FROM RUSSIA (2): From Victim to Proxy State – Prof. Dr. Oliver Andonov, CIVIL Today (LINK)
• Analysis Section of CIVIL Today [English] (LINK)
• Analysis Section of CIVIL Media [Macedonian] (LINK)

Prepared by: Jabir Deralla and the CIVIL Hybrid Threats Monitoring Team, in cooperation with partners within the Defending Democracy Global Initiative

Date/Place: 28 October 2025, Skopje

Project note: Produced within Democracy Navigator – Strategic Response to Disinformation and Hybrid Threats (2025), led by CIVIL – Center for Freedom and supported by the Federal Foreign Office of the Federal Republic of Germany.

Editorial independence & responsibility: The analysis, findings, and conclusions presented in this report are those of the authors and do not necessarily reflect the views of partners or supporters. CIVIL retains full editorial independence. Any errors remain the sole responsibility of the authors.

Use of AI (methods note): Research, drafting, structuring, and translation support were assisted by ChatGPT (OpenAI) under the authors’ direction. All AI-assisted outputs were reviewed, verified, and edited by humans. Responsibility for the content rests solely with the authors.

Sources & methodology: Open-source intelligence (OSINT), CIVIL monitoring logs, partner briefings, media analyses, and public records. Sensitive sources are anonymized for safety.

Corrections & contact: Please send corrections or comments to the CIVIL editorial team.

License: CC BY 4.0 — attribution required.