Editor’s note (April 11, 2026):
This analysis was originally published in Macedonian on March 14, 2026. It is published in English to provide background on the methods, narratives, and patterns of digital influence operations identified ahead of Hungary’s parliamentary elections.
By Xhabir Deralla
in cooperation with CIVIL’s Hybrid Threat Monitoring Team (HTMT)
According to reports published in early March 2026, the Kremlin launched a covert and multi-layered digital operation aimed at influencing Hungary’s parliamentary elections scheduled for April 12, 2026.
The operation, described by analysts as part of a broader hybrid influence strategy, seeks to strengthen the position of Prime Minister Viktor Orbán and his party, Fidesz, which is facing a serious challenge from the opposition Tisza party, led by Péter Magyar.
According to some polls published in March, Tisza holds a lead of 10 to 20 percentage points, making these elections the most significant political test for Orbán in the past decade.
Who are the key actors behind the operation
According to the reports, the operation is overseen by Sergei Kiriyenko, First Deputy Chief of Staff of Russian President Vladimir Putin. Kiriyenko has previously been linked to foreign political influence operations, including strategies for manipulating public discourse and electoral processes.
Findings indicate that a team of political consultants, digital technologists, and social media manipulation specialists—linked to Russian intelligence structures—has been deployed to Budapest.
According to reports, some of these individuals operate under diplomatic cover within the Russian embassy in Budapest, providing them with greater operational freedom.
A key role in the strategy is played by the so-called “Social Design Agency,” which develops the campaign’s communication strategy. The organization is linked to the Kremlin, funded by Russian state structures, and is already under Western sanctions.
What narratives are being promoted
The central narrative of the campaign portrays Viktor Orbán as a “strong leader with international allies,” the only figure capable of guaranteeing sovereignty, stability, and peace for Hungary.
At the same time, the opposition is depicted as a “puppet of Brussels”—a political actor lacking genuine international support and leading a force that would allegedly drag Hungary into conflict. As expected, the most aggressive and targeted propaganda attacks are directed at Magyar, the leader of the Tisza party.
Within this communication strategy, Ukraine and its president, Volodymyr Zelenskyy, are used as one of the most powerful tools in Orbán’s propaganda framework—backed by Russian experts in public opinion manipulation.
In the public space, posters, messaging, and visual campaigns present Ukraine as a symbol of war and instability, indirectly reinforcing the narrative that Hungary must choose “peace and sovereignty.”
One of the many examples of this type of communication is a poster campaign in Budapest in which Volodymyr Zelenskyy is portrayed in the context of a message suggesting that Hungary must avoid war.
Such narratives aim to reduce public support for Ukraine while simultaneously presenting Orbán’s government as the only political force capable of protecting the country from being “drawn into conflict.”
- Campaign messaging in Budapest portraying Ukraine as a “danger,” reinforcing fear-based narratives ahead of Hungary’s elections.
Photo: CIVIL (2026)
Geopolitical context: Orbán and Moscow
Since the beginning of Russia’s aggression against Ukraine in 2022, Viktor Orbán has positioned himself as the closest political ally of the Kremlin within the European Union. Budapest has repeatedly blocked or delayed packages of financial and military assistance to Ukraine, as well as certain sanctions against Russia. At the same time, Hungary has maintained intensive energy ties with Moscow, particularly through gas agreements and the Paks nuclear power plant.
For the Kremlin, this position makes Hungary an important political channel of influence within the EU and NATO, further increasing the geopolitical weight of the April elections.
According to analysts, the operation fits into a well-established pattern of Russian political influence operations abroad.
As a parallel, analysts often point to the electoral process in Moldova in 2025, where coordinated troll network activity, localized disinformation, and targeted digital campaigns were observed.
Preparations for such operations typically begin months ahead of elections, with detailed analysis of the media landscape and social networks. These operations have long attracted the attention of European security services, and the situation is closely monitored by structures linked to the EU and NATO. However, the effectiveness and success of Russia’s propaganda “assistance” to authoritarian, pro-Kremlin actors across Europe point to a low level of societal resilience, as well as an inadequate response from the institutions of European democracies.
Regional context and CIVIL’s experience
CIVIL – Center for Freedom has been monitoring electoral processes, political communication, and disinformation campaigns in North Macedonia, the Western Balkans, and beyond for nearly two decades. Through its programs on election observation, propaganda analysis, and hybrid threat monitoring, the organization has documented numerous cases of political influence operations employing similar methods and narratives.
At several critical moments in North Macedonia’s democratic development and its Euro-Atlantic integration process, CIVIL’s analyses have pointed to the direct and aggressive presence of Russian propaganda and intelligence mechanisms. These activities have included both open public pressure and the use of local actors across politics, academia, civil society, and the media.
Such examples were observed during the violent attack on Parliament in 2017, the campaigns aimed at undermining the referendum on the Prespa Agreement, disinformation operations during the COVID-19 pandemic, and political and media campaigns linked to the blockade of the European integration process in 2022. Strong propaganda activity has also been evident in narratives related to Russia’s military aggression against Ukraine, with the aim of weakening public and political support for the humanitarian and military assistance provided by NATO and its allies.
These findings are further confirmed in the comprehensive election monitoring report “Lessons Not Learned,” published in December 2025, as well as in a dozen other publications focused on electoral processes. In addition, through the Democracy Navigator 2025 program, CIVIL has systematically analyzed trends in political communication, the media environment, and election campaigns.
The public also has access to CIVIL’s series of early warning analyses and reports, which identify recurring patterns of disinformation, coordinated digital campaigns, and narratives of political influence emerging in North Macedonia, the Western Balkans, and across Europe.
According to CIVIL’s analyses, such operations often combine digital campaigns, media influence, political narratives, and cyber activities in order to gradually shape public discourse and erode trust in democratic institutions.
Experiences from the Balkans show that influence operations are not confined to a single country. They are typically part of broader regional and geopolitical strategies, in which propaganda narratives and disinformation are adapted to local political and media contexts.
These insights enable a more accurate recognition of similar patterns of influence in other European electoral processes. In this context, CIVIL does not view the case of Hungary as an isolated incident, but as part of a broader model of political influence operations employed by the Kremlin in democratic societies.
A Playbook of Hybrid Influence: How Political Influence Operations Work
Analyses and educational materials produced by CIVIL on hybrid operations show that such campaigns typically follow a clearly recognizable pattern. Rather than relying on traditional propaganda, they combine digital operations, disinformation, cyberattacks, and political narratives to gradually shape public opinion. Below is just a small selection of the propaganda methods identified in these analyses:
Localization of propaganda
Content is adapted to the local language, cultural context, and sensitive political issues in the target country. Instead of overt foreign propaganda, messages appear as domestic political positions.
Use of local intermediaries
Influence rarely comes directly from foreign sources. Instead, local influencers, media outlets, activists, or political commentators are used to relay the messages.
Saturation of the digital space
Social media platforms are flooded with memes, videos, infographics, and short messages that spread rapidly. The goal is not only to persuade the public, but also to create the impression that a particular viewpoint is dominant in society.
Discrediting political opponents
Opposition figures or critics are targeted with disinformation, manipulated content, or compromising narratives. In recent years, there has also been a growing use of AI-generated content and deepfake videos.
Cyber operations and data leaks
Hacking attacks on political parties, media outlets, or institutions are used to steal data. Instead of being released directly, the information is often passed to politically aligned media, which then use it in campaigns against opponents.
Manipulation of “sovereignty” narratives
In many cases, a narrative is promoted in which a particular leader is portrayed as the sole defender of national sovereignty, while the opposition is depicted as an instrument of “external centers of power.”
Long-term preparation
Hybrid operations rarely begin immediately before elections. They are typically prepared months—or even years—in advance, through detailed analysis of the media landscape, social networks, and influential public figures.
Digital strategies and methods
According to reports, the operation employs multiple digital techniques to influence public discourse. These include:
Content creation: Russian operators produce memes, videos, infographics, and short narrative content tailored to Hungarian audiences.
Use of local influencers: To avoid the appearance of foreign interference, content is disseminated through local Hungarian influencers rather than directly through Russian profiles.
Focus on social media platforms: Platforms such as TikTok and Facebook are specifically targeted, where political messaging can spread rapidly and shape public opinion.
Artificial intelligence and disinformation: Reports and CIVIL sources point to the use of AI-generated videos and deepfake content aimed at discrediting opposition leaders.
Cyber operations: A cyberattack on the Tisza party’s application reportedly resulted in data theft, which was subsequently shared with pro-government media outlets.
Electoral Processes as a Frontline for Propaganda and Hybrid Operations
These findings further reinforce the picture of a systematic Kremlin strategy to influence electoral processes in democratic states through digital operations, propaganda networks, and manipulation of public discourse across Europe and beyond. According to numerous studies and analyses by security services and independent organizations, such operations are part of a broader approach to political influence that combines disinformation, cyber activities, and carefully constructed political narratives aimed at deepening political divisions and weakening trust in democratic institutions.
Over the past decade, similar patterns of influence have been observed in multiple electoral processes across Europe and beyond, indicating that this is a long-term strategy rather than a series of isolated incidents. In this context, the case of Hungary fits into a broader geopolitical trend in which elections are increasingly becoming a field of competition between democratic systems and authoritarian models of political influence.
Therefore, the question is no longer whether such operations exist, but how prepared democratic societies are to recognize and counter them in time. In the era of hybrid conflict, elections are increasingly becoming the new battlefield of geopolitical competition. Protecting democratic elections, therefore, also means protecting the information space from organized operations of political influence.
Note
This article is based on publicly available reports, media investigations, and analyses of political influence operations, as well as on the long-standing experience of CIVIL – Center for Freedom in election observation, disinformation monitoring, and the analysis of hybrid operations. The analysis also draws on findings from the Democracy Navigator program, the early warning report series, and the report “Lessons Not Learned” (2025).