By Xhabir Deralla
With contributions from the CIVIL Hybrid Threats Monitoring Team (CHTM)

As Slovenia approaches its parliamentary elections on March 22, 2026, the country has become the target of a complex and deeply coordinated system of foreign information manipulation and interference (FIMI). At the heart of this system lies a transnational network connecting Hungary, Serbia, Russia—and critically—North Macedonia as an operational hub.

This is not just some loose alignment of ideological allies. It is a functional, cross-border infrastructure designed to generate, adapt, and distribute disinformation with precision—manipulating electoral environments within EU member states, eroding trust in democratic institutions, and advancing illiberal political agendas aligned with Moscow and its regional proxies.

We have described this before—in reports, analyses, policy papers, and conferences. The terminology is well established. The warnings have been repeated. And yet—the operations expand. The methods evolve. The impact deepens.

Why?

Because challenges that could be addressed remain unresolved—not for lack of knowledge, but for lack of political will and institutional honesty. Democratic systems continue to speak in abstractions, while their adversaries operate with names, structures, and intent. Institutions hesitate where they should confront directly and decisively. Too often, institutions remain silent, captured by ruling parties and oligarchic interests. Civil society, too often, documents in silence, hides behind academic riddles, and appeases power—rather than speaking the truth. The elites still avoid stating the obvious: this is not mere “influence.” It is coordinated political warfare—an assault on the core of democracy: elections.

Even at the cost of SLAPP lawsuits, intimidation, and isolation, the truth must be spoken—not only for one country or another, but for everyone who seeks to live in a democracy free from fear and manipulation.

That is where resilience begins—with clarity. Not with another framework. Not with another policy paper. Not with another donor-funded call designed to ease institutional conscience.

With clarity.

CIVIL has not only documented these processes—we have named them. Clearly, consistently, and without ambiguity.

What we are witnessing is a system of aggressive and longstanding influence operations: disinformation and large-scale media manipulation coordinated from Moscow and executed through regional proxies in Belgrade and Budapest, with operational extensions in Ljubljana, Bratislava, Rome, and other EU capitals—and increasingly, Skopje.

North Macedonia was once a target. It has now become proxy actor and a node. A relay point. A testing ground. A link in the chain of hybrid threats. Too many reports have concluded that lessons were not learned. The truth is harsher: The lessons were ignored.

Time and again, CIVIL was dismissed—by politicians, by segments of the media, and by parts of the civil society sector itself. We were told we exaggerate. That Russian influence is marginal. That the region is stable. In each of the critical moments—for two decades—we raised the alarm. We were heard at times—but far more often ignored. Mocked, even.

At the same time, donors continued to fund the comfortable voices—those who produce acceptable language, avoid uncomfortable truths, and maintain the illusion of balance while reality drifts further away from democracy.

And now—here we are. Another country standing at the edge—not of military invasion, but of something more insidious: capture through narratives, algorithms, and coordinated deception.

Slovenia in March. Hungary in April. Partial local elections across Serbia. North Macedonia—parliamentary and presidential elections in 2024, local elections in 2025.

Different countries. Same playbook.

These networks coordinate. They finance each other. They learn from failure. They invest in more precise, more efficient systems of manipulation. Let us be clear: What is unfolding is not a series of isolated incidents, nor a matter of “foreign influence” in the abstract. It is a coordinated, transnational strategic campaign to weaken, capture, and reshape democratic systems from within.

The actors are known. The methods are documented. The intent is no longer deniable. What remains in question is not their strategy—but our willingness to confront it.

From “Veles” to a Regional Hub: The Evolution of Influence Operations

What began in the small town of Veles as a cynical business model incorporated by a group of young people producing clickbait for profit (and influence) during the 2016 U.S. elections—did not disappear. It evolved.

By 2018, the infrastructure that once chased advertising revenue had been repurposed into something far more consequential: a political tool. Not improvised, not accidental—but structured, financed, and aligned with broader geopolitical interests. The shift was decisive.

Money began to flow differently. Not through random ad networks, but through companies registered in Skopje, the capital of North Macedonia—linked to political and business circles connected to ruling structures in Hungary and Serbia, and further intertwined with far-right, far-left, and authoritarian networks across Europe. Many of these, directly or indirectly, connect back to the Kremlin, which provides support ranging from know-how to financing.

These entities were not buying traffic. They were purchasing influence—targeted, calculated, and politically aligned. Content followed money—and money followed content. What emerged was not a media ecosystem, but a vast machinery of influence, driven by scientific models and AI, designed to manipulate algorithms, and minds.

Narratives were no longer isolated. They were synchronized—crafted, adapted, and amplified across borders to serve a shared political objective.

This was the birth of a system. A system that launders narratives so that propaganda originating in Moscow appears as “local opinion” in Ljubljana—or in any capital it targets. A system that obscures financial trails while maintaining political coherence. A system that repeats the same message across multiple countries until it acquires the illusion of truth.

And in its most effective form, this system no longer looks like propaganda at all.

It is echoed by experts, repeated by journalists, normalized by opinion makers, adopted by civil society voices, and amplified by politicians—each localizing the same narrative model until its origin becomes unrecognizable.

The corridor

What has emerged since is not a coincidence of aligned interests, but a corridor, a structured pathway through which narratives travel, mutate, and gain legitimacy. At one end stands Moscow, where strategic narratives are produced: anti-Western resentment, anti-EU framing, “neutrality” as virtue, and the normalization of authoritarian logic. Ukraine is central to this narrative ecosystem. The war is not only fought with missiles and drones, but with language: “denazification,” “Western provocation,” “peace through surrender.” These narratives are designed to travel.

They do.

Through Belgrade, where political and media actors take these narratives and embed them in regional emotional frameworks—history, identity, grievance, and the mythology of victimhood.

Through Budapest, where financial and institutional backing transforms messaging into a durable media presence—legitimized, legalized, and shielded within the structures of an EU member state.

And through Skopje—where all of this is localized, tested, translated, and redistributed. North Macedonia is not merely a stop along the way. It is where narratives are engineered to fit. And from where coordinated waves of propaganda are scaled up and launched through digital systems.

The Logic

The same narratives that attempt to justify Russia’s war against Ukraine are not confined to that battlefield. They are exported.

The logic is consistent:

– If Ukraine is “corrupt,” then democratic reform is meaningless
– If Ukraine is “provoking war,” then aggression becomes defensive
– If Ukraine must accept “peace at any cost,” then sovereignty is negotiable

Now replace Ukraine with Slovenia. Or North Macedonia. Or any EU member state.

The structure holds.

– The EU becomes the aggressor
– Liberal governments become “puppets”
– Civil society becomes “foreign agents”
– Elections become “rigged processes”

This is far beyond an accidental overlap. It is narrative interoperability. The same story, adjusted for different audiences.

The Pipeline

The system operates with remarkable consistency.

A narrative is launched by Russian state-controlled media. It is amplified by Serbian outlets, often in more aggressive and sensational forms. It is then adapted by media ecosystems in North Macedonia, where language, tone, and local references make it appear organic.

From there, it is exported into EU information spaces—Slovenia, and beyond—where it reappears as “regional concern,” “public sentiment,” or “independent analysis.”

By the time it reaches its target, it no longer looks foreign. It looks familiar. That is the point.

North Macedonia: From Target to Node

For years, North Macedonia was a target of these operations. Today, it is increasingly part of the machinery. A place where Kremlin narratives are translated into local news, and disinformation is tested before wider deployment.

So close to the EU geographically—and yet so far in terms of democratic standards and the rule of law—it has become an ideal environment for this “business”: building bot networks that amplify messages across platforms. And a space from which cross-border campaigns are conducted, coordinated, and launched—often faster than Europe can respond.

A laboratory. A relay station. A multiplier.

This transformation did not happen overnight. It unfolded through political opportunism and deliberate calculation, systemic media corruption and capture, and the gradual normalization of propaganda as “just another opinion.”

It was driven forward by the rise—and electoral victories—of antidemocratic, nationalist, and authoritarian forces, whose ascent was amplified by influence operations associated with networks operating from Moscow, Belgrade, Budapest, Ljubljana, and beyond.

And while the growth of these structures was often underestimated—or tolerated under the pretext of pluralism and freedom of expression—they have operated with increasing continuity across sectors: politics, economy, culture, religion, media, and civil society.

Now, the time has come for aligned actors within North Macedonia to return the favor. And the system is already in motion.

Construction of an alternative reality

What we are witnessing is not simply the spread of false information. It is the construction of an alternative reality—one in which facts cease to exist, and narratives take control of minds and emotions of people.

It is a reality in which aggression is reframed as defense, democracy is reframed as manipulation, and – yes, that’s happening – truth is reframed as bias, and facts are loudly branded as “fake news.” This is the era when lies are repeated until they become – not truth – but structure.

Ukraine is the frontline—but it is not the only one. The same narratives designed to break Ukraine’s resistance are being deployed to weaken democratic societies across Europe.

Different countries. Same logic. Same objectives.

This is how modern influence works—not through isolated lies, but through systems that produce, adapt, localize, and normalize them. And once such a system is in place, it does not need to convince everyone. It only needs to confuse enough.

The War of Narratives: Slovenia as a Live Hybrid Battlefield

This construction of reality becomes visible in concrete form—in real time. As Slovenia approaches its parliamentary elections on March 22, 2026, monitoring organizations have identified a final, coordinated wave of disinformation targeting voters—an operation that reflects the full maturity of the system. At its core is a set of narratives that are neither spontaneous nor local. They are engineered.

This wave is built around a small number of core narratives designed to generate resentment toward the European Union while amplifying nationalist and “sovereignty” sentiments.

Among the central narratives is the energy and “sovereignty” narrative. It frames EU sanctions on Russia as the primary cause of economic hardship, while presenting Hungary and Serbia as models of “independent” policy. Its purpose is not economic analysis, but political positioning—to normalize alignment with Moscow under the language of pragmatism.

Alongside it operates the “replacement” narrative—the claim that Brussels is orchestrating mass migration to dilute national identity. Amplified through Macedonian and regional portals before entering Slovenian media space, it is designed to trigger fear, resentment, and defensive nationalism.

The third is the “Maidan” narrative—a direct attack on democratic legitimacy. It suggests that election outcomes are predetermined by foreign-funded NGOs and that any liberal victory is inherently fraudulent. Its function is pre-emptive: to delegitimize the result before votes are even cast.

These narratives are synchronized—and they follow a logic that is already familiar. It is the same logic used to justify aggression against Ukraine: the inversion of responsibility, the erosion of trust in democratic institutions, and the normalization of authoritarian alternatives.

The Final 48 Hours: Escalation

As of March 20, the operation has entered its final, and most aggressive phase. In the final 48 hours—including the legally mandated 24-hour period of election silence in Slovenia—the objective is no longer persuasion. It is saturation of public space.

A coordinated war of hashtags has already taken over the digital space:

#SlovenijaPrva (Slovenia First)
#StopMigrantom (Stop Migration)
#BruseljskaLutka (Brussels Doll)

Designed to appear organic, these trends are anything but. They are amplified through coordinated networks to dominate visibility and shape perception—methods now all too familiar to populist and authoritarian actors across Europe.

At the same time, the operation shifts platforms—moving its most aggressive content from regulated spaces such as Facebook and X to Telegram channels, where oversight is minimal and enforcement is weak.

This is where the most toxic elements circulate: AI-generated deepfakes targeting political figures, fabricated audio recordings presented as “leaks,” and forged documents designed to simulate intelligence material.

In parallel, the system deploys information flooding—hijacking official election hashtags and overwhelming them with irrelevant or manipulative content, effectively burying verified information from institutions and civil society.

What we are witnessing has long surpassed the boundaries of political campaigning. It is the shaping of the social environment—designed to influence not only opinions, but the conditions under which opinions are formed.

The influence operation unfolding in Slovenia in the final hours before Election Day illustrates what distinguishes modern hybrid operations from traditional propaganda. They do not seek to convince. They seek to dominate attention, distort reality, and exhaust the capacity for critical judgment.

And once this stage is reached—when narratives, infrastructure, and timing converge—the question is no longer how the system works, but who is driving it, and who benefits from it.

What is unfolding in Slovenia now offers a revealing preview of the dynamics likely to shape the key elections in Hungary in April.

The answer is not difficult to discern: those who control the flow of disinformation and coordinated narratives gain a decisive advantage on Election Day.

The “Skopje Hub”

Narratives are only half the story. The rest is infrastructure.

The “technology” of propaganda currently targeting the March 22, 2026, Slovenian elections is a sophisticated, multi-layered ecosystem. It is not merely a collection of fake news sites, but a coordinated influence environment that connects private intelligence practices, state-linked media ecosystems, and political and business interests across North Macedonia, Hungary, and Serbia.

At its core lies what can no longer be ignored: the Skopje hub—a space where political capital is channeled, narratives are engineered, and operations are coordinated before being deployed into EU information environments.

The foundation of this system includes a network of Hungarian-funded companies registered in North Macedonia which, according to multiple investigative reports over the years, have functioned as intermediaries in cross-border media financing and influence.

Among the most frequently cited entities are Target Media DOOEL Skopje, owned by Hungarian businessman Péter Schatz, and Adinamic Media, linked to Ágnes Adamik. Available reporting indicates that these companies have been involved in channeling resources—often originating from Hungarian state-linked or politically affiliated structures—into Slovenian media outlets such as Nova24TV and Demokracija.

Through this mechanism, stakes in these outlets have been acquired and sustained, ensuring that political messaging aligned with the Orbán–Janša axis is not only present, but structurally embedded.

There are no coincidences in this business. This is a structure. The connection to political actors in North Macedonia is less visible—but no less consequential.

The relationship between these business networks and political actors in North Macedonia remains opaque, but not entirely unknown to the public. Documented interactions and overlapping communication patterns—particularly following VMRO-DPMNE’s return to power in 2024–2025—point to a degree of alignment between media structures, political messaging, and cross-border narratives.

The content strategy: The “Bomba” template 2.0

The methodology used to destabilize political actors in Slovenia reflects a recognizable evolution of earlier tactics seen in North Macedonia. What was once known as the “Bomba” model—leaked audio recordings used in domestic political battles—has, in recent years, evolved into a more complex, technologically enhanced approach.

At its core is the manufacturing of “leaks”: the use of high-fidelity AI-generated deepfakes and “hybrid” audio clips, in which authentic voice fragments are stitched together with fabricated content to produce material that appears credible, yet is fundamentally misleading.

Equally important is the laundering chain that gives such material an appearance of legitimacy. In observed cases, content first appears on Slovenian Telegram channels or Macedonian portals—often using “burn after reading” tactics—before being picked up by Western-based outlets such as the Italian newspaper La Verità, and subsequently reintroduced to Slovenian audiences as “international confirmation” of a scandal.

The narrative hooks circulating within this model are consistent and targeted: allegations of high treason, secret migration arrangements, and corruption in the energy sector—framed in ways that erode trust in Slovenia’s Prime Minister Robert Golob and, more broadly, in institutional credibility.

In the current March 2026 election cycle, one of the most visible patterns centers on a series of “revelations” published by La Verità, which were rapidly re-imported into the Slovenian digital space via Telegram channels such as Resnica 2026, reinforcing the perception of cross-border validation.

A live case: The “Green Scam” chain

This week, the laundering chain followed a recognizable pattern. One of the most visible examples is the so-called “Green Scam” chain.

Its origin is widely assessed—based on monitoring data—to trace back to nodes in Skopje and Belgrade. On March 17, forensic monitoring groups flagged high-volume data transfers between a digital studio in Belgrade—reportedly linked to Israel Einhorn—and servers associated with Target Media in Skopje.

On March 18, 2023, the Italian newspaper La Verità published an investigative article titled “The Green Black Hole of Ljubljana,” focusing on alleged irregular financial flows linked to the energy company GEN-I, previously led by Prime Minister Robert Golob. The report examined transactions in the Balkans, but did not establish any link to Iranian oil or current energy reforms.

Days ahead of the 2026 parliamentary elections in Slovenia, a significantly altered version of this narrative resurfaced. The Telegram channel Resnica 2026 disseminated high-resolution “leaked documents” in Slovenian that appeared to corroborate claims far more explosive than those in the original reporting—including allegations of Iranian oil kickbacks.

By referencing a real Western publication, the material was given a layer of perceived legitimacy. However, the narrative itself represented a clear case of recombination: an existing headline repurposed, expanded, and injected with unrelated elements to produce a more damaging political claim.

By March 20, Slovenian right-wing outlets such as Nova24TV were amplifying the story under headlines such as: “Foreign Press Confirms: Golob Under Investigation for International Energy Fraud,” further blurring the line between documented reporting and constructed narrative.

This sequence illustrates the operational logic of the system: Fabrication → Validation → Amplification. The Slovenian government has already raised concerns about this pattern, identifying cross-border information flows of this kind as a potential threat to electoral integrity and calling for an EU-level investigation.

The use of outlets such as La Verità is not incidental. It appears to serve a strategic function. Its editorial positioning is broadly aligned with political currents associated with figures such as Matteo Salvini, Viktor Orbán, and Janez Janša, while its status as an established Italian publication provides legal and reputational shielding that smaller regional outlets do not possess. This makes rapid legal response during an election cycle significantly more complex.

At the same time, such outlets provide what can be described as “strategic credibility”: for many readers, a report originating from “the Italian press” carries more weight than content circulating through overtly partisan or anonymous digital channels.

This is a model in which narratives are constructed, externally validated, and then reintroduced into the target information space with increased persuasive power.

What begins as allegation returns as confirmation.

This is the “Bomba” template in its most evolved form—no longer confined to domestic political struggles, but operating as a cross-border mechanism involving actors and platforms across both EU and non-EU environments.

The technical muscle: “Veles 2.0” and bot-herding

What was once the decentralized chaos of “Veles” has evolved into a far more centralized and structured system of computational propaganda—one increasingly associated with political consulting, data-driven targeting, and cross-border coordination. Unlike the 2016 phenomenon, the 2026 landscape reflects a shift toward professionalization and strategic management.

This includes networks of automated and semi-automated accounts amplifying narratives across platforms such as TikTok, Telegram, and X; AI-assisted targeting of specific audience segments; and coordinated flooding of high-visibility digital spaces, including official election hashtags. The effect is not simply message distribution, but information saturation—a volume of content capable of obscuring, diluting, or displacing verified information in the public sphere.

Improvisation has largely disappeared. In its place, an industrial-scale model of influence has emerged—one in which voters, whether in Slovenia, Hungary, the United States, or North Macedonia, are increasingly exposed to persistent, algorithmically amplified messaging designed to erode their ability to make informed choices.

In the context of the Slovenian elections on March 22, monitoring data and analytical assessments indicate that the Belgrade–Skopje corridor plays a significant role in this ecosystem. While parts of the media infrastructure are based in Skopje, elements of digital amplification—including bot activity and coordinated social media engagement—have been associated with networks operating from Belgrade and other regional “cyber hubs,” with additional components located in North Macedonia.

Some monitoring reports and investigative findings have pointed to individuals such as Israel “Srulik” Einhorn in connection with broader regional influence networks. While the precise scope and structure of these links remain subject to ongoing investigation, the patterns observed are consistent with coordinated, cross-border digital campaigning, including AI-assisted targeting of Slovenian audiences on platforms such as TikTok and Telegram.

At the operational level, this form of computational propaganda relies on automated scripts and coordinated posting behavior capable of overwhelming key information channels. One observed tactic involves saturating official election hashtags with high volumes of repetitive or manipulative content, reducing the visibility of verified information from institutions, media, and civil society actors.

Operational nodes: Platforms, patterns, and visibility

While official lists of accounts linked to coordinated influence operations are typically not disclosed—both by national intelligence bodies such as Slovenia’s Security and Intelligence Agency (SOVA) and emerging EU-level mechanisms like the European Democracy Shield—investigative reporting and monitoring by organizations including CIVIL and other regional digital watchdogs have identified recurring patterns, nodes, and behaviors across platforms.

As of March 21, 2026, during the election silence period, the last wave of information saturation patterns are particularly visible.

Telegram has emerged as a primary distribution environment for unverified audio material and documents, largely due to limited moderation and enforcement mechanisms compared to major platforms. Monitoring reports have referenced channels such as Resnica 2026, SloveniaLeaks, and Glas Ljudstva – as illustrative examples of this ecosystem. Many such channels operate using so-called “burner” tactics—appearing briefly, disseminating content, and disappearing, only to re-emerge under new names or variants.

These channels typically distribute alleged “leaks,” present content framed as insider or whistleblower information, and mimic the identity of legitimate actors—a tactic widely described in disinformation research as identity mimicry or brand hijacking.

At the same time, TikTok is increasingly used for high-velocity dissemination of emotionally charged content, combining visual symbolism, music, and simplified narratives. Monitoring has identified clusters of accounts—often short-lived or frequently renamed—that focus on migration-related fear narratives, rely on repetitive hashtags such as #Veleizdaja, and use AI-generated imagery, synthetic voiceovers, and templated video formats. While attribution remains difficult, recurring stylistic patterns suggest alignment with broader regional messaging ecosystems.

On X (formerly Twitter), the observed activity aligns with patterns commonly described as coordinated inauthentic behavior (CIB), aimed at shaping visibility, influencing journalists, and accelerating narrative spread. Rather than relying on stable accounts, this layer operates through shifting usernames, disposable profiles, coordinated hashtag campaigns such as #Volitve2026 and #Slovenija2026, and rapid cross-posting of content originating from regional portals. Monitoring indicates periods of unusually high-volume activity consistent with coordinated amplification, affecting the visibility of verified election-related information.

Across these platforms, several recurring indicators point to coordinated activity. Shared files often contain consistent metadata linked to previously identified media infrastructure. Another strong indicator is synchronized posting behavior, with identical or near-identical content appearing across multiple accounts within seconds.

In addition, rapid cross-platform distribution is observed, with content moving from Telegram to X and then to TikTok within short time intervals. Noticeable spikes in social media activity also occur during regulatory gaps—particularly during the legally mandated election silence period.

Individually, none of these elements constitutes definitive proof of centralized control. Taken together, however, they form a pattern consistent with coordinated, cross-platform influence operations, as described in research and institutional assessments of hybrid threats.

This is how the system becomes visible—not through a single account, but through the pattern they form together.

The intelligence overlay: The “Black Cube” factor

As previously reported by CIVIL Media, the 2026 cycle appears to include an additional layer: the involvement—alleged in multiple reports and monitoring findings—of private intelligence actors operating alongside media and digital influence structures.

Among the entities mentioned in this context is “Black Cube,” a private intelligence firm founded by former Israeli intelligence officers. According to available reporting and analyses, individuals associated with such networks have been identified in Ljubljana during the pre-election period, reportedly engaging in activities consistent with what are commonly described as “active measures.”

These activities, as described in investigative reporting and expert assessments, may include staged interactions, targeted information-gathering efforts, and forms of surveillance aimed at obtaining politically damaging material—commonly referred to as “compromat.” While the full scope and verification of these claims remain subject to ongoing scrutiny, their alignment with known hybrid tactics is notable.

Within the broader ecosystem, such intelligence-gathering efforts function as an upstream component: material—whether authentic, manipulated, or taken out of context—enters the same distribution pipelines already described, where it is repackaged, amplified, and circulated through aligned media and digital networks, including those operating within or connected to North Macedonia.

What distinguishes this layer is not only the methods employed, but the degree of integration. Intelligence collection, narrative construction, and digital amplification increasingly operate within a single, interconnected system.

At the structural level, this system is designed for resilience. Content does not depend on a single platform or jurisdiction. If Slovenian authorities restrict access to one outlet, the same material can remain accessible via servers hosted in other countries, including North Macedonia. If one social media channel is removed, alternative platforms—particularly encrypted or semi-regulated environments such as Telegram—continue the distribution cycle.

The result is a synchronized and adaptive machinery of influence, in which North Macedonia functions as one of the key logistical environments for storage, processing, and redistribution of content targeting EU audiences.

The extent of direct state involvement in such operations is, by its nature, difficult to establish conclusively. What is more readily observable, however, is a convergence of interests, infrastructure, and outcomes—allowing influence operations to operate in a space that is both politically consequential and structurally deniable.

Official response: Recognition without resolution

The Slovenian government has, notably, already acknowledged elements of this cross-border dynamic and raised the issue at the European level. In a formal appeal, Prime Minister Robert Golob called on the European Commission to examine emerging reports of coordinated information activity linked to foreign actors, and requested an immediate threat assessment.

As reported by Courthouse News on March 19, 2026:

“The case in Slovenia is the latest to fan fears that the rise of social media and artificial intelligence can enable outside actors to influence elections. Prime Minister Golob called on the European Commission to investigate the reports and referred the matter to the European Center for Democratic Resilience for an immediate threat assessment.”

This response is significant for two reasons. First, it represents a rare moment of explicit political acknowledgment that influence operations targeting elections are not abstract risks, but active and ongoing processes. Second, it highlights a persistent gap: while the problem is increasingly recognized, the response remains largely procedural and institutional, relying on investigation and coordination mechanisms that often move more slowly than the operations they seek to address.

In that sense, the Slovenian case illustrates a broader European dilemma—awareness without proportional response, recognition without immediate deterrence.

Naming the actors

At this point, there is little ambiguity left. The system has structure. It has methods. It has infrastructure. And it has actors.

For too long, discussions about foreign influence in Europe have relied on passive formulations—“external factors,” “malign actors,” “hybrid threats.” These terms describe the phenomenon, but they obscure responsibility. It is time to be precise.

Moscow is the strategic center of this system. Russia does not merely produce propaganda—it produces strategic narratives designed to weaken democratic cohesion, fracture alliances, and normalize authoritarian logic. The war against Ukraine is the clearest expression of this strategy, but it is not confined to the battlefield. The same narratives used to justify aggression—about Western decadence, NATO provocation, and the illegitimacy of democratic institutions—are systematically projected into European political space.

These narratives do not remain where they originate. They are translated, adapted, and amplified.

In the Western Balkans, Serbia under President Aleksandar Vučić plays a central role in this process. Through a highly concentrated media environment, pro-government outlets frequently recycle and intensify Kremlin-aligned messaging—embedding it in regional grievances, identity politics, and historical narratives. This goes beyond political alignment. Serbia functions as an active distribution platform, where geopolitical narratives are reshaped into emotionally charged political content and circulated across borders.

Hungary, under Viktor Orbán, provides what the system requires most: infrastructure within the European Union. Through financial networks, media investments, and political alliances, Hungarian-linked structures have enabled the expansion of influence operations into EU member states—often operating within the protections of EU legal and market frameworks. The Skopje-based media investments are not an anomaly, but part of a broader pattern linking capital, media ownership, and political messaging across borders. Hungary is not outside this system. It operates from within—and, in key respects, enables it.

In Slovenia, these dynamics intersect with domestic political strategy. The alignment between Janez Janša, Orbán, and other illiberal actors has created conditions in which external narratives can integrate with internal political agendas. This is how hybrid operations succeed. They do not replace domestic actors. They work through them.

And then there is North Macedonia.

For years, it stood on the frontline of influence operations—subjected to disinformation, political destabilization, and external pressure. Today, it is increasingly embedded within the system itself. Under the current political configuration, and through networks associated with VMRO-DPMNE, the country has become a space where narratives are localized, media structures are leveraged, and digital operations are coordinated across borders.

This is a structural transformation—one in which a previously targeted state becomes a functional node within a wider network of influence. This is how influence becomes structure—and structure becomes power.

The uncomfortable truth

What connects these actors is not ideology alone. It is a convergence of interests. Moscow seeks to weaken democratic systems. Belgrade amplifies across the region. Budapest enables and finances. Local actors align, adapt, and benefit.

Slovenia is entering its final phase. Hungary is next—within weeks.

This is how modern political warfare operates—not through occupation, but through integration. Not by replacing systems, but by entering and reshaping them from within. None of this is possible without domestic agency.

What foreign influence requires is simple: political actors willing to align, media willing to amplify, and institutions unwilling—or unable—to resist. This is the part most often left unsaid, because it is easier to speak of external threats than of internal responsibility.

“We know who the actors are. We know how the system works. We know what is at stake.” And yet, the question is no longer whether these operations exist. That has long been established. The question is whether democratic societies are prepared to confront not only external pressure—but the internal structures that allow it to grow and persist.

We are long past the phase of awareness. This is the moment of choice. The systems are visible.

The methods are documented. The actors are known. What remains is whether democratic actors are willing—and sufficiently independent—to confront the reality in front of them, or continue to manage it through language that softens, delays, and ultimately protects those responsible.

The cost of hesitation is no longer abstract. It is measured in captured institutions, distorted public debate, and elections shaped not by citizens, but by systems designed to manipulate them.

There is no neutral ground left. Only clarity—or complicity.

This analysis draws on CIVIL’s monitoring, investigative reporting, and AI-assisted research tools.

Sources, References, and Analytical Basis

CIVIL’s media platform

Израелски стручњаци за валкани операции против либерална Словенија, Ljubomir Kostovski, CIVIL MEDIA (March 18, 2026)

Геополитика на празниот простор: Лекцијата што Европа одбива да ја научи, Aleksandar Ivanov, CIVIL MEDIA (March 18, 2026)

Стариот прирачник никогаш не исчезна: Советските „активни мерки“ и битката за демократија, Xhabir Deralla, CIVIL MEDIA (March 16, 2026)

EU Enlargement in the Western Balkans: Geopolitical Necessity or Strategic Illusion?, Gudrun Steinacker, CIVIL Today (March 10, 2026)

The dominance of Russian propaganda: How Putin’s statements are treated by part of the Macedonian media, Dragan Mishev, CIVIL Today (February 26, 2026)

Самитот во Минхен 2026: Западен Балкан – лидери без визија, Diana Tahiri, CIVIL MEDIA (February 16, 2026)

Slovenian government sources

Minister Fajon: The war in Ukraine must end (Informal discussions on FIMI and upcoming elections), Ministry of Foreign and European Affairs, Government of the Republic of Slovenia (February 23, 2026)

Preizkusite se v prepoznavanju dezinformacij in tehnik manipuliranja z vsebinami (Test yourself in recognizing disinformation and content manipulation techniques), Government Communication Office (UKOM) & SI-CERT, Government of the Republic of Slovenia (March 13, 2026)

Slovenia and Germany hold consultations to deepen cooperation against disinformation, Government Communication Office (UKOM), Government of the Republic of Slovenia (September 23, 2025)

Državni sekretar Vojko Volk: Dezinformacije napadajo naše vrednote (State Secretary Vojko Volk: Disinformation attacks our values), Cabinet of the Prime Minister, Government of the Republic of Slovenia (October 15, 2025)

European Union (EEAS & European Commission)

4th EEAS Report on Foreign Information Manipulation and Interference (FIMI) Threats, European External Action Service (EEAS), European Union (March 12, 2026)

Keynote speech at the 2026 Conference on Countering Foreign Information Manipulation and Interference: ‘From Insight to Impact’, Kaja Kallas (HR/VP), European External Action Service (March 17, 2026)

Dismantling the Foreign Information Manipulation and Interference (FIMI) house of cards, EEAS Strategic Communications, European Union (March 10, 2026)

EU-Western Balkans Summit: Strengthening Security and Stability Together, European External Action Service (EEAS), European Union (December 18, 2025)

EU–Western Balkans Media Literacy Conference 2025 strengthens regional cooperation to counter disinformation, European External Action Service (EEAS), European Union (December 25, 2025)

Election infrastructure and electoral integrity, Policy Department for Justice, Civil Liberties and Institutional Affairs, European Parliament (March 13, 2026)

The European Democracy Shield: An overview, European Parliamentary Research Service (EPRS), European Parliament (Updated early 2026)

Council Implementing Regulation (EU) 2026/647 concerning restrictive measures in view of Russia’s destabilising activities, Council of the European Union, European Union (March 16, 2026)

NATO

Countering hybrid threats, North Atlantic Treaty Organization, NATO Official Topic (Updated January 29, 2026)

NATO’s approach to counter information threats, North Atlantic Council, NATO (Updated February 3, 2025)

Copyright © 2026 CIVIL – Center for Freedom. All rights reserved.