By Xhabir Deralla
with the CIVIL Hybrid Threats Monitoring (CHTM) Team

Russian propaganda targeting the Western Balkans and Europe is becoming more sophisticated, more adaptive, and more dangerous, precisely because it is increasingly successful at avoiding the appearance of propaganda. In many cases, it no longer sounds like propaganda at all.

The monitoring of Russian-aligned disinformation ecosystems in the last week shows a sustained push of anti-EU, anti-NATO, nationalist, and polarizing narratives, with Serbian-language media and social media networks continuing to serve as one of the most effective regional relay systems for Kremlin-compatible messaging.

The key development this week is a notable spike in narratives portraying NATO as an aggressor and the European Union as a militarized, authoritarian bloc preparing Europe for war.

A fresh example emerged around NATO’s Gallant Boar 2026 military exercise, which pro-Kremlin ecosystems falsely framed as preparation for an attack on Russia’s Kaliningrad region. The narrative follows a familiar formula: Russia and Belarus are cast as threatened victims, while NATO is depicted as the destabilizing force.

The disinformation itself is predictable. What is more concerning is how efficiently such narratives travel.

They no longer remain confined to explicitly pro-Russian channels. Instead, they are laundered, localized, emotionally reframed, and injected into mainstream political discourse.

This is where the Western Balkans, particularly Serbian-language media ecosystems, play a strategic role.

Figure: Overview of core anti-Western propaganda narratives and their strategic functions. (Click to enlarge; use your browser’s back button to return to the article.)

Serbia as a narrative laundering hub

Russian propaganda enters the Western Balkans after first being amplified through Russian Telegram channels, military blogger ecosystems, and state-aligned influence networks. From there, it flows into Serbian-language portals, nationalist commentators, Telegram groups, YouTube channels, and social media communities, where it is repackaged for regional consumption.

By the time these narratives reach broader audiences in North Macedonia, Bosnia and Herzegovina, Montenegro, and beyond, overt Kremlin branding has often disappeared. What remains is something far more effective.

The core message — that the EU is being militarized and NATO is driving Europe toward war — is repackaged as “peace advocacy,” “neutrality,” and “economic realism.” From there, the narrative evolves further, presenting itself as a call for the “defense of sovereignty” and resistance to “Western pressure.”

This laundering process enables hostile influence operations to circumvent public skepticism toward Russian state propaganda by disguising strategic messaging as ordinary political commentary, grassroots sentiment, or authentic local concerns amplified through social networks — a pattern documented in numerous reports and analyses by CIVIL Media and CIVIL’s Hybrid Threats Monitoring Team.

In North Macedonia, recurring surges of such propaganda are visible through well-established channels of pro-Russian and anti-Western influence, repeatedly identified in CIVIL’s monitoring. These include outlets such as Nova Makedonija (both its print and digital platforms), alongside dozens of online media outlets and, at times, mainstream broadcasters such as Alfa TV, which for years benefited from financial backing linked to Viktor Orbán’s media and political networks.

At the regional level, however, the most influential transmission belt remains the Serbian-language relay ecosystem — including narratives amplified by RT Balkan and Sputnik Srbija, nationalist portals, Telegram networks, and coordinated social media communities. From there, these narratives often penetrate even media outlets that are otherwise more resilient to disinformation. Such outlets are few in number and frequently operate under severe political, financial, and institutional pressure, making editorial resistance increasingly difficult.

From propaganda to political common sense

The most successful Russian narratives today do not ask audiences to support Moscow directly. Instead, they seek something more valuable: confusion, cynicism, fatigue, and distrust.

Based on its multiyear monitoring, CIVIL has repeatedly come to the same conclusion: The objective is not always persuasion. It is destabilization.

One of the strongest narrative clusters now spreading across Europe is built around the claim that the European Union is preparing citizens for war.

The messaging combines security developments, defense spending, NATO exercises, sanctions, economic uncertainty, and inflation into a single emotionally charged conclusion: European elites are pushing the continent toward conflict.

Typical formulations include:

• “Europe is preparing for war”
• “Brussels wants permanent conflict”
• “NATO is escalating tensions”
• “Citizens will pay for elite war agendas”

This proves to be highly effective because it weaponizes real public anxieties.

Economic hardship becomes political grievance. Political grievance becomes institutional distrust. Institutional distrust becomes strategic vulnerability.

That vulnerability is precisely what hostile influence actors seek to cultivate.

The anti-EU narrative evolves

Another major development is the growing sophistication of anti-EU messaging in the Western Balkans.

Earlier propaganda often relied on crude anti-Western rhetoric and overt ideological hostility. Today’s narratives are more subtle, adaptive, and politically sophisticated.

Instead of bluntly claiming that “Europe is bad,” they increasingly promote more nuanced and seemingly rational propositions:

• “EU accession means permanent subordination.”
• “Brussels continuously changes the rules.”
• “Candidate countries are treated as second-class Europeans.”
• “Sovereignty is incompatible with integration.”

These narratives resonate because they feed directly on real frustrations — enlargement fatigue, corruption, democratic stagnation, economic insecurity, and weak institutions.

Disinformation thrives where trust is already fragile.

That is why propaganda rarely creates crises from nothing; it identifies existing fractures, deepens them, and turns them into strategic vulnerabilities.

What makes this trend particularly dangerous is that the Western Balkans increasingly serve not only as a target, but also as a testing ground for anti-EU narratives later amplified elsewhere in Europe.

Far-right convergence across Europe

A parallel — and increasingly interconnected — trend is the growing convergence between Kremlin-compatible narratives and far-right ecosystems across Europe, including AfD-adjacent networks in Germany and other anti-establishment movements.

This convergence is not necessarily ideological in the classical sense. It is primarily functional.

Anti-migration rhetoric merges with anti-EU narratives. Anti-globalism converges with anti-NATO messaging. Sovereigntist politics fuse with anti-elite populism.

The result is a highly portable narrative architecture capable of crossing borders, languages, and ideological communities with remarkable speed.

A message originating in Russian Telegram spaces can, within hours, reappear as nationalist discourse in Belgrade, anti-Brussels commentary in Budapest, or anti-establishment rhetoric in Berlin.

This is no longer a regional phenomenon confined to the Western Balkans, nor merely a problem of fringe political ecosystems. It is an evolving European security challenge.

The Balkans often serve as both laboratory and launchpad – a space where polarizing narratives are tested, refined, normalized, and then projected deeper into Europe. In this sense, the vulnerabilities of the Western Balkans are not peripheral to Europe’s security architecture. They are embedded within it.

What destabilizes the Balkans rarely stays in the Balkans.

The most dangerous propaganda is the one that looks ordinary

No single viral fabrication has dominated the information space in recent days. That, however, should not be mistaken for safety, nor for a weakening of propaganda operations. On the contrary, it may indicate something more concerning: the stabilization of continuous influence operations that gradually capture, normalize, and expand their presence in public discourse across the Balkans and Europe.

The most dangerous propaganda is no longer the obviously false headline or the crude conspiracy theory. It is the narrative that sounds reasonable. The slogan that sounds patriotic, delivered from a political party stage or an academic panel. The commentary that sounds pragmatic. The grievance that feels authentic.

When propaganda stops looking like propaganda, it becomes far more difficult to identify — and far more effective.

This is precisely where hybrid warfare succeeds. It does not need everyone to believe a lie. It only needs enough people to distrust the truth, doubt democratic institutions, and lose confidence in shared facts.

For the Western Balkans, where democratic resilience remains fragile and institutional trust often shallow, this challenge is especially acute. But Europe must understand that the vulnerabilities of the Western Balkans are not peripheral to the continent’s security. They are European vulnerabilities — because instability, distrust, and malign influence do not stop at borders.

In the age of hybrid warfare, every unchallenged narrative can become a strategic weapon, and every ignored vulnerability can become a gateway for deeper destabilization.

This analysis exists because real people spend real time monitoring hostile influence operations, often without adequate resources.

The monitoring and analysis presented in this report are part of the regular work of CIVIL’s Hybrid Threats Monitoring Team (CHTM). This work is conducted continuously through the dedication of CIVIL’s team and contributors, largely on a voluntary basis and with limited public support. Sustaining independent monitoring of disinformation, propaganda, and hybrid threats requires resources. If you value this work, please consider supporting CIVIL’s mission.

YOUR SUPPORT TO CIVIL MATTERS.

Support independent journalism, democratic resilience, and the defense of freedom of expression. Help CIVIL counter disinformation, hybrid threats, and authoritarian influence.

Contribute NOW