The Shadow Newsroom

How Russian disinformation masquerades as European regional media and poisons the online information space

‘If you cannot make them believe you, make them doubt everything else.’

This unspoken rule of the Kremlin’s hybrid warfare is now playing out on the screens of millions of Europeans. Our research shows that after the European Union imposed sanctions on Russian state media, the Kremlin’s information machine did not disappear; it transformed. In place of the overt propaganda of RT and Sputnik, an extensive network of proxy media outlets, cloned news portals and localised news websites disguised as independent European resources is being used with increasing intensity. Through these channels, Russian information narratives return to the European information space, presented as local journalism, expert opinion or public debate. Behind reports on roadworks, weather forecasts or regional news, there increasingly lies a complex system of information influence designed less to persuade than to sow doubt, deepen existing social conflicts and gradually undermine trust in democratic institutions.

In brief:

• Following the imposition of EU sanctions on RT and Sputnik, the Russian disinformation infrastructure shifted to a network of proxy media outlets, cloned portals and localised websites masquerading as European regional media.
• According to VIGINUM, the Portal Kombat network comprised at least 193 websites in February 2024, rising to 224 by April; a significant proportion of these resources are linked to the Crimean web company TigerWeb.
• In the European segment, narratives aligned with Russian messaging follow a cycle of ‘Russian source – local website – re-citation in Russia’, after which they are presented as the position of Western journalists or European public opinion.
• The investigation identified four main groups of influence resources: direct disinformation projects, geopolitical platforms, conspiracy websites, and radical-nationalist and ultra-conservative outlets.
• Using a pravda-pl.com article dated 15 July 2026, we demonstrate Russian legal labelling, transliteration errors and literal calques characteristic of automated translation without editorial review; the article was later deleted.

In March 2022, shortly after Russia launched its full-scale invasion of Ukraine, the European Union took the unprecedented decision to restrict broadcasts by the Russian state media outlets RT and Sputnik. Brussels justified the move on the grounds that these outlets were not independent news organisations but instruments of state information policy, systematically used to justify aggression against Ukraine and manipulate public opinion in EU countries. The sanctions were later extended to other Russian state media outlets.

At first glance, it might have appeared that the Kremlin had lost one of its main channels of influence over European audiences. Yet during 2023 and 2024, European government bodies and independent research centres began to identify a different trend. The Russian information ecosystem had not disappeared; it had adapted.

The most detailed account of this transformation appears in a series of technical reports by VIGINUM, a French government service established to detect foreign information interference and specialising in countering foreign interference and disinformation. In February 2024, it published the findings of an investigation into a network dubbed Portal Kombat. According to the researchers, the network then encompassed at least 193 websites targeting countries around the world. These sites produced almost no original material; instead, they systematically aggregated content from Russian state agencies, pro-Russian social media accounts and official resources of the occupation authorities. Their main purpose was to promote positive coverage of the so-called ‘special military operation’ and discredit Ukraine and its leadership.

A further VIGINUM investigation established a technical link between the Portal Kombat network and the Crimean web company TigerWeb, which, according to French experts, played a key role in creating and administering a significant proportion of these websites. The report’s authors also emphasise that certain technical characteristics and methods of content distribution share features with other previously identified pro-Russian information networks.

What was particularly revealing was that exposure of the network did not lead to its dismantling. In April 2024, VIGINUM recorded further expansion: the number of identified portals had risen to 224, and the new domains targeted not only EU member states but also countries in the Balkans, Africa and Asia. French experts described it as a ‘meticulously constructed information network’ covering almost every country in the European Union.

This evolution forces us to take a fresh look at the effectiveness of sanctions against Russian state media. Studies by the European External Action Service (EEAS) increasingly use the term Foreign Information Manipulation and Interference (FIMI). This approach shifts the focus from individual media outlets to the wider network of tools through which coordinated information operations may be disseminated.

In this context, Poland is of particular interest. A number of local outlets have been identified there that regularly translate, republish or quote material from Russian state media and later themselves become sources for Russian news agencies. This creates a closed loop in which Russian narratives pass through local European platforms and return to the Russian information space as the supposed ‘position of Polish journalists’ or ‘opinion of the European public’.

Poland is only one node in the network

Poland, however, is far from the only example. Analysis by European research centres shows that the same model operates in other Central European countries. Only the names of the websites, the language of publication and the local political context change. The mechanism remains the same: Russian state or affiliated media serve as the original source; local websites adapt the material to the national context; and the resulting publications circulate as supposedly independent European journalism.

Hungary and Slovakia are especially revealing examples: analysts have repeatedly documented a high concentration of media outlets that systematically disseminate pro-Kremlin narratives in both countries. Yet not all of them are anonymous ‘junk sites’. Some have substantial audiences and have operated in their national information spaces for years.

In Hungary, researchers regularly point to Origo, Mandiner, Magyar Nemzet, Pesti Srácok, BalRad, as well as the Hungarian-language section of the international Pravda network. According to analysts, these outlets regularly cite Russian state agencies or reproduce framing characteristic of Kremlin propaganda, from claims about the ‘ineffectiveness of sanctions’ and ‘Western fatigue with Ukraine’ to criticism of the European Union and NATO. Most of the content, however, is presented as ordinary political news or analysis rather than overt propaganda.

Consider Mandiner, one of Hungary’s prominent media outlets and part of the pro-government media conglomerate KESMA (Central European Press and Media Foundation). It regularly uses material from the Russian state media outlets RIA Novosti, Sputnik and RT, as well as other pro-Kremlin platforms in Europe.

Mandiner’s editorial policy often relies on manipulative framing, emotive headlines and narratives aligned with the Kremlin’s information line. Its articles often portray Russia as a strong and invincible state, while shifting responsibility for the war onto Ukraine and its allies.

According to Similarweb, the site receives about 16.5 million visits a month, and its content is regularly used as a source by other pro-Russian Hungarian outlets.

One telling example is the article ‘War Psychosis in Europe’ (Háborús pszichózis Európában), in which Mandiner accuses European leaders of allegedly seeking to prolong the war in Ukraine. The outlet does not emphasise that hostilities could end following the withdrawal of Russian forces from Ukraine’s illegally occupied territories. Instead, the article labels countries that support Ukraine and international law as ‘pro-war’.

Beyond anti-Ukrainian narratives, Mandiner also spreads conspiracy claims. In particular, it has promoted claims about an alleged ‘Soros empire’ that continues to influence Europe, one of the typical themes of pro-Russian information campaigns.

A similar situation exists in Slovakia. A network of so-called ‘alternative media’ plays an important role there. Researchers most often cite Oral, Hlavný denník, InfoVojna, TvoTV, Slovanské Noviny, as well as the Slovak version of the Pravda network. Despite their differing editorial styles, these outlets regularly disseminate the same narrative constructs: the discrediting of Ukraine, the undermining of trust in NATO and the European Union, conspiracy theories, and reports often sourced from Russian state or affiliated media.

Consider Infovojna.bz, which presents itself as an ‘alternative’ media outlet but regularly publishes content bearing signs of disinformation, pro-Kremlin propaganda and conspiracy theories. It is one of the most visited Slovak websites disseminating Russian narratives. According to Similarweb, the site receives around 6 million views a month. After Russia’s full-scale invasion of Ukraine began, Infovojna’s Slovak domain was blocked for disseminating propaganda content. The outlet then moved from Slovakia’s .sk domain to .bz (Belize) and continued operating on the new platform.

Infovojna systematically uses material from Russian state propaganda outlets, notably RT, Sputnik and RIA Novosti. An analysis of links shows thousands of references to these platforms in the site’s content. The outlet also uses visual manipulation. In one example, it published an image placing Ukrainian President Volodymyr Zelenskyy, Ukrainian soldiers from the Azov unit and Adolf Hitler in the same visual frame, creating a false association between Ukraine and Nazism.

Infovojna’s principal narratives echo Russian propaganda: accusing the West of ‘provoking’ the war, justifying Russia’s actions, promoting the Kremlin’s claim about the supposed ‘denazification’ of Ukraine, discrediting the Ukrainian military and spreading claims of Western ‘Russophobia’.

Anatomy of a parasite, or the case of Operation Doppelgänger

Imagine that you live in the Greater Poland Voivodeship. You search Google for information about traffic jams in Poznań or bridge repairs in Ostrów Wielkopolski. The search engine returns a link to wielkopolska24.info. The name sounds credible, the design familiar and the news current. You click, unaware that you have just fallen into a trap.

In fact, the region has a reputable local media outlet, wlkp24.info, owned by the Promax media group. The parasitic site wielkopolska24.info is a classic example of typosquatting and mimicry techniques developed by Russian specialists in information and psychological operations (IPSO).

Ten faces of Kremlin influence: from bots to ‘intellectuals’

Having examined the Polish-language segment of the internet, we uncovered an entire web of resources that at first glance appear unconnected. Yet detailed content analysis and OSINT monitoring demonstrate that they are all cogs in the same machine. We divided these resources into four main groups of influence:

Group A. Direct subversive projects

These are digital footholds created directly by the Russian security services. Among them is pravda-pl.com, part of the global disinformation network Portal-24 (known as the ‘Pravda’ network), which has been officially exposed by European intelligence services. They operate by a simple, crude method: automatically importing translated press releases from the Russian Foreign Ministry and Ministry of Defence. Despite their almost non-existent real audience, research by NewsGuard indicates that resources of this kind are used to disseminate content online at scale; this content may later enter the training datasets of large language models and other artificial intelligence systems. This outlet makes no attempt at concealment. An example appears below.

Group B. Geopolitical conduits

These outlets seek to give Russian aggression an ‘intellectual’ and ‘realistic’ veneer. They target an educated audience that rejects crude falsehoods but is prepared to believe theories about ‘spheres of influence’ and ‘geopolitical realism’ wrapped in complex terminology.

The most influential such player in Poland is myslpolska.info (Myśl Polska). The country’s oldest national-democratic weekly has gradually come under the complete control of forces disseminating content aligned with Russian narratives and has become a platform for legitimising Kremlin policy. Mateusz Piskorski, a former defendant in a case involving espionage on behalf of the Russian Federation who served a prison term on that charge, is a regular contributor. The outlet’s central narrative is: ‘Poland must leave NATO, end its support for Ukraine and recognise Moscow’s leadership to ensure its own survival’; aid to Kyiv is branded ‘suicide in the interests of the Anglo-Saxons’.

Together, these platforms provide an intellectual façade for Russian propaganda, reframing Russia’s war crimes as ‘natural geopolitical processes’.

Group C. Merchants of fear and conspiracy theories

These resources exploit people’s fundamental distrust of state institutions, science and traditional media. Their main aim is to blur the concept of objective truth and immerse readers in a chaos of alternative facts.

The websites wolnemedia.net and bumerangmedia.com. are vivid examples of this strategy. Their method is to create an explosive mixture: in a single news feed, articles about the dangers of 5G towers, UFO landings or vaccines sit alongside pro-Russian geopolitics. The effect is guaranteed. Someone who visits the site to read about flat-Earth theory unwittingly begins to believe false claims about ‘American biolaboratories in Ukraine’. ‘Wolne Media’, incidentally, has itself repeatedly come under scrutiny in journalistic investigations.

A similar audience, approached from a different angle, is targeted by ocenzurowane.pl. Presenting itself as an ‘uncensored’ platform, it preys on users’ desire to find the ‘hidden truth’. In practice, the site aggregates the most alarmist falsehoods about the forced mobilisation of Poles for a war in the East and the West’s inevitable economic collapse because of sanctions against Russia.

By creating an atmosphere of chronic fear and hopelessness, these resources drive audiences to seek salvation in a ‘strong hand’. In other words, they seek refuge in the very image Kremlin propaganda is always ready to provide.

Group D. Radical nationalists and ultra-conservatives

This group of outlets exploits sensitive historical wounds and religious sentiments, using them to inflame inter-ethnic hostility and radicalise society.

The portal magnapolonia.org. occupies a special place here. In this case, a unique paradox is at work: despite the traditionally anti-Russian orientation of Polish nationalism, the outlet has fallen into the trap of the ‘common enemy’ concept, namely the liberal West. It now actively promotes narratives about the ‘Banderisation of Poland’ and demands an immediate end to all aid to Kyiv.

On the other flank is marucha.wordpress.com (Dziennik gajowego Maruchy). It is an ultra-Catholic conspiracy blog in which Russia is skilfully portrayed as ‘the last bastion of traditional Christian values’, waging a holy war against the ‘degenerate West’. The blog effectively converts the religious conservatism of Polish believers into political loyalty to the Kremlin.

To legitimise these ideas among the wider public, neon24.net (formerly neon24.pl) is used. It is an open ‘citizen journalism’ platform. With no moderation, the site has become a digital rubbish dump and a haven for Russian bot farms and fringe propagandists, who mass-produce aggressive anti-Ukrainian content under the guise of ‘the opinions of ordinary Poles’.

How automated propaganda works

Take the Polish-language resource mentioned above, pravda-pl.com, which VIGINUM researchers classified as part of the Portal Kombat network created to disseminate pro-Kremlin content in EU countries. We selected at random the first article we found dated 15 July 2026. At first glance, it did not differ from dozens of other articles on the site. Under the headline ‘Gościnność się skończyła: UE zamyka granice dla ukraińskich poborowych’, the authors claimed that the European Union was allegedly preparing to end temporary protection for Ukrainian men of conscription age. What caught our attention, however, was not the claim itself but the way it was presented.

In the third paragraph, the note ‘Zakazane w Federacji Rosyjskiej’ (‘banned in the Russian Federation’) remained after the reference to the UPA. For a Polish reader, such a note has no legal or editorial relevance. Polish media do not cite Russian legislation as an element of editorial style. In the Russian Federation, however, such formulations are a standard feature of news content. Russian law and state media-regulation practices require special labelling when organisations recognised in Russia as extremist or banned are mentioned.

This passage alone does not prove that the text was written by a specific Russian state institution. It is, however, an important technical indicator that the material was created or translated from a text adapted to the Russian regulatory environment, and that the relevant label was not removed before publication in Polish.

The article’s linguistic features are no less revealing. It uses the form ‘Zieliński’ instead of the standard Polish spelling of the Ukrainian president’s surname, ‘Zełenski’, reflecting transliteration through the Russian linguistic tradition. In some sentences, verbs remain in the infinitive instead of taking finite forms; literal calques from Russian occur; and certain phrases, including ‘ograniczenia zaczęli gotować’, do not conform to Polish norms and appear to be a literal machine translation of the Russian expression ‘начали готовить ограничения’. Likewise, the abbreviation Komisja Europejska (KE) is presented in breach of Polish orthographic conventions.

Any one of these errors could be attributed to editorial negligence. Taken together, however, they form a characteristic pattern of automated content production: the text is first composed in one language and then translated by automated systems without thorough editorial review.

By the time work on this section was completed, the article was no longer available on pravda-pl.com. Its removal cannot be explained, so we make no assumptions about the motives of the site’s administrators. The disappearance of the material does not, however, change the findings of this study. On the contrary, it demonstrates another characteristic feature of modern information operations.

Unlike traditional propaganda, which remained in print newspapers or television broadcasts for years, much of today’s disinformation content has a deliberately short life cycle. Such material can spread rapidly through networks of localised websites, social media and news aggregators, reach a large audience, and then disappear from public access just as quickly. Its information impact, however, often lasts far longer than the original source remains available.

For journalistic investigations, it is therefore essential to record such publications promptly, create archived copies, preserve screenshots and document digital traces. In this case, the article’s content is not the only evidence of particular value; so are the technical and linguistic markers it contained. Those markers allow the process of its production to be reconstructed even after the material has been deleted.

This case points to a much broader trend. Modern information operations increasingly resemble short-lived digital campaigns: content is created, automatically adapted into different languages, rapidly disseminated through a network of localised resources and, when necessary, disappears just as quickly. Yet deleting a single article does not eliminate the narrative itself. It continues to circulate in other materials, on other platforms and within other information environments, changing form while retaining its core message.

The ability of information narratives to outlive individual publications, individual websites and even sanctions against entire media organisations is one of the defining features of modern information warfare. This is the mechanism we will examine in detail in future research.

Why they are losing but remain dangerous

This case shows two things. On the one hand, total degradation: they work on an assembly line, make childish mistakes and leave traces of Russian legislation in their texts. On the other hand, this machine is dangerous because of its scale. If you miss the slip at the first stage, on the junk site pravda-pl.com, then by the fourth stage you will be presented with a perfectly respectable Polish article that contains no mention of the Russian Federation but will still poison your mind with the same Kremlin toxin.

It is important to understand that this is not a single type of information resource but an entire system in which each element performs a distinct function. Media clones, genuine outlets and automated information resources are no longer separate phenomena, but different elements of the same information ecosystem. The combination of these tools allows pro-Kremlin narratives to adapt to local environments and remain visible even after sanctions are imposed on Russian state media.

In these circumstances, the principal means of defence are critical thinking, checking primary sources and understanding who creates and disseminates the information entering the European information space, and how that information is legitimised.

Official Russian and Belarusian sources cited in this text are for informational purposes only. Content from these sources may constitute disinformation or propaganda.