This Special Sub-Report, prepared by the CIVIL Hybrid Threats Monitoring Team in cooperation with the Defending Democracy Global Initiative (DDGI), examines the information-warfare ecosystem targeting North Macedonia. Drawing on three months of continuous monitoring, it maps the actors, channels, and narratives driving Russian and Serbian influence operations across the country’s media, politics, and cultural sectors. It exposes how clerical, political, and digital networks amplify pro-Kremlin frames during election periods, erode public trust, and paralyze reform. The report concludes with early-warning indicators and counter-measures to strengthen societal, media, and institutional resilience against hybrid threats.
1. Strategic picture (why this front matters)
North Macedonia’s primary hybrid-warfare exposure is informational: the contest to shape loyalties, identities, and trust in institutions. Moscow and aligned actors aim less to “flip” policy overnight than to paralyze it—keeping Euro-Atlantic alignment fragile by amplifying grievance, sowing cynicism about reforms, and normalizing anti-EU/NATO frames. This approach has been documented across the Western Balkans and fits the Kremlin’s broader regional playbook. (stratcomcoe.org)
Today’s EU framework treats Foreign Information Manipulation & Interference (FIMI) as a security issue, not merely “misinformation.” For North Macedonia, that means the informational domain is not adjunct to hybrid threats—it is the main battlespace. (European External Action Service)
2. How the ecosystem works (actors & channels)
The dissemination of pro-Kremlin narratives in North Macedonia and the wider Western Balkans follows a lattice-structure of actors and channels. CIVIL’s monitoring identifies four key categories through which this ecosystem functions:
2.1. Serbian-language media hubs aligned with or rebroadcasting Sputnik Srbija/RT content
These are national or regional outlets producing Serbian-language content that either originates in or is heavily influenced by Russian-state media. CIVIL’s 16 October 2025 article reports an increased frequency of Russian propaganda narratives in Macedonian-language media, but points out they often trace back to this Serbian-language hub layer. (CHTM: Increased frequency of Russian propaganda narratives in Macedonian media ahead of elections – CIVIL Today)
Example: An outlet publishes a piece framing NATO as hypocritical and corrupt, referencing RT content. This piece is then picked up locally in Macedonian translation.
2.2. Local internet media / Facebook pages that “translate & localize” narratives
Once the content is generated by the media hubs, smaller portals, Facebook pages or social media groups adapt and republish. These actors “translate & localize” — adjusting tone, identity cues, and cultural framing to fit the Macedonian context. As CIVIL notes, the media ecosystem in North Macedonia includes “click-bait-style ‘news’ sites with minimal editorial transparency” that recycle propaganda content.
Example: A Facebook page republishes a story originating in Serbia, changes the headline to emphasise an attack on “Macedonian identity” by the EU, and links to a local influencer’s commentary.
2.3. Clerical / “values” networks (religious, cultural identity-based channels)
These channels embed pro-Russian or pro-Serbian narratives inside frameworks of tradition, Orthodox Christianity, national identity or “values” discourse. CIVIL’s September 11 2025 article emphasises the role of the Serbian Orthodox Church in North Macedonia’s information space as “a hidden vector of power” for both Belgrade and Moscow.
Example: A church-affiliated web-portal publishes an article praising Russia as the protector of Orthodoxy and questioning the EU’s cultural compatibility with Macedonian identity.
2.4. Local influencer clusters (social-media personalities, politically connected figures, opinion-leaders)
These include editors-in-chief, prominent Facebook/Telegram influencers, politically connected bloggers or party-aligned media personalities who amplify narratives in their follower networks. CIVIL’s monitoring shows that before elections, Russian-propaganda narratives spike via convenient outlets — often fuelled by such local influencers.
Example: A local influencer publishes a mistranslated “leak” about European institutions undermining Macedonian sovereignty, shares it in Telegram channels, gets picked up by portals, and then referenced by a clerical network piece.
2.5. How the channels link and function in practice
These four layers do not work in isolation. The ecosystem is highly interconnected and relies on feedback loops:
- A Serbian-language hub publishes or amplifies a pro-Russian narrative.
- A local portal adapts it (language, context).
- It is then propagated through values-/religious networks to give it moral weight.
- Local influencers echo it, driving engagement and visibility in social media.
- The content then loops back into the hub or into other portals, reinforcing the narrative.
CIVIL documents this mechanism in its 11 September 2025 analysis: “Parallel to visible actors … there is a more concealed infrastructure: troll pages, bot-run accounts, anonymous meme channels … many click-bait-style ‘news’ sites, lacking editorial transparency, further recycle and remix propaganda content.”
3. Elections: nationalist narratives and metanarratives
Election periods in North Macedonia serve as high-intensity moments when key messaging is amplified, refined and distributed through the hybrid-influence ecosystem tracked by CIVIL. In these moments, a handful of master-frames emerge — cutting across party lines and aligning with the broader strategic interests of Moscow’s narratives in the region.
Key Frames Identified by CIVIL’s Recent Monitoring (Narratives & Metanarratives)
Elections in North Macedonia do not merely decide power — they test the nation’s democratic immune system. Each campaign season becomes an incubator for narratives designed to manipulate public sentiment, polarize communities, and redirect frustration away from governance failures toward imagined external enemies.
CIVIL’s monitoring over the past three years shows a recurring pattern: the same core storylines resurface in different forms, timed to coincide with sensitive political moments or geopolitical tensions. These narratives — carefully adapted from Kremlin and Belgrade playbooks — are calibrated to resonate with domestic anxieties while appearing “patriotically local.”
They fall broadly into four master-frames, each serving a specific psychological and political purpose:
Sovereignty vs. Subordination (EU/NATO = Control)
A dominant trope identified in CIVIL’s election-monitoring reports is the portrayal of Brussels and Western institutions as “foreign engineers” of reform. The narrative frames EU/NATO alignment as a loss of autonomy, foreign dictation, and erosion of sovereignty. CIVIL’s 24 April 2024 preliminary report on the presidential elections notes “elevated rhetoric about external actors infringing on national decision-making.”
Identity under Threat (Language/History/Church as Political Weapons)
CIVIL’s multilingual monitoring reveals persistent appeals to language, faith, and history as battlegrounds of national identity. EU integration is reframed as “cultural dilution,” with Russia positioned as the defender of Slavic heritage and Orthodoxy — a narrative deeply rooted in pan-Slavic mythmaking and clerical influence.
Moral Order vs. Decadence (Gender/LGBTQ+ Panic)
CIVIL’s election-day monitoring of the 19 October 2025 local elections shows how gender equality, LGBTQ+ rights, and secular values were distorted into symbols of “Western corruption.” This moral-panic frame is strategically deployed to mobilize conservative voters and weaken liberal and pro-EU coalitions.
Two Truths (False Balance and “Everyone Lies”)
A particularly corrosive meta-narrative documented by CIVIL is the idea that all politicians, media, and international actors are equally dishonest — “everyone lies.” This cynicism normalizes distrust, reduces voter turnout, and undermines the legitimacy of Euro-Atlantic reforms. CIVIL’s long-term observation of the 2024 election cycle confirmed a surge in references to manipulation, vote-buying, and institutional capture.
4. Signature Narratives (2024–2025)
Beyond election cycles, these meta-narratives evolve into durable storylines — adaptable across crises, languages, and platforms. CIVIL’s monitoring and regional partnerships show that by 2024–2025, four “signature” narratives dominate North Macedonia’s hybrid-information space:
- “The EU is hypocritical and colonial; enlargement is a trick.”
Goal: Sap enthusiasm for reforms and normalize permanent limbo, portraying integration as a façade for exploitation. - “NATO drags small nations into wars; neutrality is safer.”
Goal: Fracture public support for the Alliance and reframe Euro-Atlantic solidarity as an existential risk rather than security guarantee. - “Traditional values vs. Western decadence.”
Goal: Merge identity politics with foreign policy; justify pro-Moscow stances as moral, not geopolitical, choices. This frame thrives in sermons, talk shows, and party rhetoric that weaponize religion and culture. - “Ukraine fatigue & whataboutism.”
Goal: Undercut support for Ukraine and promote Kremlin-friendly fatalism. This narrative insists that “all wars are the same,” blurring lines between aggression and defence, victim and aggressor. It often couples “peace” rhetoric with moral relativism — asking why the West defends Ukraine but not “Serbs in Kosovo,” or why sanctions on Russia are imposed while “others go unpunished.”
CIVIL’s August-October 2025 monitoring noted a rise in such framing after every major Ukrainian battlefield development, amplified through Serbian-language media and local influencers who echo themes of futility, hypocrisy, and “war exhaustion.”
5. Convergence with Proxy Networks: Impact on Reform & Security
The narratives described above do not spread randomly — they move through highly structured ecosystems. These ecosystems fuse media outlets, clerical institutions, political proxies, and digital influencers into a coordinated web that converts ideology into social influence. Each message, whether about sovereignty, identity, or “moral order,” is engineered to trigger emotional resonance and social division rather than factual persuasion. Over time, these storylines become the connective tissue linking local actors to regional propaganda infrastructures that extend from Belgrade and Banja Luka to Moscow.
CIVIL’s ongoing monitoring reveals that this convergence of channels, platforms, and interests now forms the operational backbone of Russia’s hybrid influence in North Macedonia and the wider Western Balkans. Messaging frequently travels through religious-cultural circuits and Serbian-language media spheres, creating a feedback loop in which domestic portals cite regional tabloids or Sputnik Srbija content, then re-export it as “local perspective.” This technique ensures plausible deniability for pro-Russian actors while amplifying emotional salience and reach.
The impact is profound and measurable. Each cycle of repetition contributes to governance friction, delayed reforms, and institutional fatigue, eroding citizens’ confidence in the state’s capacity to deliver justice, prosperity, or European integration. In effect, the information environment becomes weaponized — not to overthrow the government, but to paralyze it. This is the strategic outcome Moscow seeks: a permanently distracted, distrustful society unable to act as a fully anchored Euro-Atlantic democracy.
EU and NATO institutions have repeatedly warned of this hybrid vector across the Western Balkans, urging member and partner states to adopt targeted countermeasures aligned with the EU’s Foreign Information Manipulation and Interference (FIMI) framework — including transparency of content origin, platform accountability, and regulatory oversight. In this context, media freedom and national security are no longer separate spheres; defending one now depends on protecting the other.
Unfortunately, the situation in North Macedonia remains deeply constrained. Civil society and academia are increasingly marginalized, while much of the media landscape is captured within opaque ownership networks and subject to political or financial coercion. This environment provides fertile ground for hybrid penetration — an open field for influence operations channelled primarily through Serbian media networks, but also directly from Moscow, and at times from Eurosceptic and far-right circles within the EU itself. Such dynamics blur the distinction between external interference and internal decay, creating an information space where propaganda often circulates unchecked and unchallenged.
6. Early-Warning Indicators (North Macedonia – Next 3–6 Months)
In a media environment where civil society is constrained and institutional oversight is eroding, the early detection of hybrid activity becomes the only reliable defense mechanism. CIVIL’s Hybrid Threats Monitoring Team continuously observes cross-platform patterns, identifying subtle narrative shifts before they escalate into coordinated disinformation or political destabilization. The following indicators outline the most probable triggers and vectors of influence over the next quarter, highlighting the need for vigilance among journalists, civic actors, and international partners alike.
The information domain in North Macedonia remains fluid and adaptive. As hybrid actors recalibrate their narratives ahead of key political and institutional milestones, several early-warning signals can help anticipate escalation or coordinated influence activity. Monitoring these indicators enables timely countermeasures, strategic communication, and civic preparedness — preventing narrative manipulation from maturing into institutional or societal disruption.
Narrative spikes (Macedonian & Albanian) linking EU/NATO to “moral corruption,” “loss of sovereignty,” or “economic blackmail.” (based on tracking velocity and coordination across Facebook, X, TikTok, Telegram, YouTube, etc.)
- Cross-border amplification from Serbian-language portals or Sputnik-adjacent channels feeding local outlets within hours or days.
- Clerical–political signaling, including joint statements or liturgies with political subtext, especially ahead of key votes or EU milestones.
- Turnout-suppression narratives (“everyone’s corrupt,” “elections rigged”) surfacing within the final fortnight of national votes or referendum-style decisions.
- Gendered disinformation waves tying reforms to “imposed ideology” against “traditional values” peaking around curriculum debates or EU-accession news cycles.
CIVIL’s analysis shows that such indicators often precede coordinated campaigns — whether online, clerical, or political — that seek to manipulate public emotion and paralyze reform momentum. Detecting these patterns early allows for rapid, factual responses and civic mobilization before disinformation metastasizes into social tension or institutional crisis. In hybrid warfare, awareness is deterrence.
Conclusion: The Battle for North Macedonia’s Democratic Soul
Russia’s hybrid warfare operations in North Macedonia are no longer loud or spectacular — they are quiet, persistent, and deliberate. Gone are the street-level provocations and overt crises that marked the turbulent years between 2017 and 2022. What remains is a slow-burn offensive, waged through narratives that shape minds, networks that shape elites, and cultural codes that shape collective identity.
CIVIL’s more than a decade of monitoring, research, and analysis reveals an evolving strategy of attrition — one that consolidates previous gains and adapts to new political realities. Rather than seeking open confrontation, it now thrives in ambiguity: in institutions compromised by influence, in media stripped of transparency, and in citizens fatigued by disinformation and distrust.
The fight today is no longer for territory or ideology, but for the institutional soul of North Macedonia — for the very capacity of its democracy to think, decide, and believe independently. The question is whether citizens will continue to see their country’s future as part of Europe, or as contested ground shaped by external manipulation and domestic complacency.
If this battle is lost, the consequences will not end at Skopje’s borders. They will ripple across the Western Balkans, undermining the region’s fragile stability and eroding Europe’s collective resilience. Hybrid warfare needs no victory parade; it triumphs when societies grow numb.
Vigilance, transparency, and cohesion remain the only true lines of defence — not just for institutions, but for the democratic spirit itself.
Prepared by: Jabir Deralla and the CIVIL Hybrid Threats Monitoring Team, in cooperation with partners within the Defending Democracy Global Initiative
Date/Place: 28 October 2025, Skopje
Project note: Produced within Democracy Navigator – Strategic Response to Disinformation and Hybrid Threats (2025), led by CIVIL – Center for Freedom and supported by the Federal Foreign Office of the Federal Republic of Germany.
Editorial independence & responsibility: The analysis, findings, and conclusions presented in this report are those of the authors and do not necessarily reflect the views of partners or supporters. CIVIL retains full editorial independence. Any errors remain the sole responsibility of the authors.
Use of AI (methods note): Research, drafting, structuring, and translation support were assisted by ChatGPT (OpenAI) under the authors’ direction. All AI-assisted outputs were reviewed, verified, and edited by humans. Responsibility for the content rests solely with the authors.
Sources & methodology: Open-source intelligence (OSINT), CIVIL monitoring logs, partner briefings, media analyses, and public records. Sensitive sources are anonymized for safety.
Corrections & contact: Please send corrections or comments to the CIVIL editorial team.
License: CC BY 4.0 — attribution required.