Support us
Our investigation began with a familiar pattern: dozens of accounts posting the same claims about Ukraine, Serbia, NATO, and Western aid within minutes of one another. The profiles appeared independent, used different languages, and often presented themselves as local commentators. Their timing and coordination suggested something more organized.
Over several weeks, our investigative team mapped the accounts, archived their posts, examined domain registrations, and compared public records with open-source intelligence. The evidence pointed to a coordinated influence operation managed from Belgrade, with links to a broader Russian information ecosystem.
The work required patience and restraint. A suspicious account is not proof of a state connection, and a shared political view does not make someone a paid operative. We treated every finding as a lead to verify rather than a conclusion to publish.
The first signal was repetition. Accounts with different names used nearly identical phrases, published the same links, and recycled the same images. Some posts appeared in Serbian before being translated into English, Ukrainian, or Russian. Others promoted stories alleging corruption in Kyiv or claiming that Western governments were preparing to abandon Ukraine.
We collected posts before they could be deleted and recorded their publication times, URLs, images, and engagement figures. Comparing this archive revealed synchronized bursts of activity. A story might receive little attention for hours, then suddenly be pushed by dozens of accounts within a narrow window.
The timing alone did not establish who was behind the network. It did, however, justify a deeper examination of account histories, technical infrastructure, and relationships between the people presenting themselves as unrelated commentators.
Several accounts directed followers to a small group of websites. Their layouts differed, but their source code, analytics identifiers, and image-hosting paths overlapped. Registration data was shielded through privacy services, yet historical records showed domains created within days of one another.
We also traced repeated email addresses in publicly accessible breach notifications, cached pages, and professional profiles. These fragments connected content administrators to a Belgrade-based marketing company that advertised reputation management and multilingual social media campaigns. The company’s public clients did not prove involvement in the influence operation, so we sought corroboration elsewhere.
A review of job advertisements and archived portfolio pages showed that the firm had recruited writers fluent in Serbian and Russian to produce “political commentary” and “crisis communications.” The wording was ambiguous, but it matched the network’s publishing behavior and helped explain how the operation could generate content across several markets.
Our team built a relationship map rather than relying on a single “smoking gun.” It connected accounts through posting schedules, reused media, administrator errors, domain infrastructure, and direct interactions. The strongest links were those supported by multiple independent indicators.
We also tested alternative explanations. Coordinated activity can result from volunteer groups, public relations agencies, or loosely organized activists. Some accounts may have reposted material without knowing its origin. We therefore distinguished between content creators, amplifiers, and ordinary users who encountered the material later.
This discipline matters in war-related reporting, where false attribution can damage public trust and endanger individuals. It also reflects why investigative reporting on war profiteering requires transparent sourcing, careful documentation, and a clear separation between verified facts and informed analysis.
| Signal | What We Found | Why It Mattered |
|---|---|---|
| Synchronized posts | Identical claims appeared within minutes | Suggested centralized coordination |
| Shared infrastructure | Domains used matching code and analytics tools | Connected apparently separate outlets |
| Recycled media | Images and video captions were repeatedly repurposed | Revealed a common content library |
| Staff traces | Hiring language matched multilingual political publishing | Indicated operational capacity in Belgrade |
| Account behavior | Profiles changed names after scrutiny | Suggested efforts to evade detection |
The operation relied on camouflage. Some profiles posted football updates, local traffic complaints, or cultural material between political messages. A seemingly harmless page comparing baseball and cricket helped us test this pattern: accounts that shared ordinary content still shifted into coordinated narratives when a campaign began.
This mixture made the network appear more authentic and helped political messages reach users who might ignore overt propaganda accounts. Posts were frequently framed as personal observations rather than official statements. The language emphasized distrust, fatigue, and resentment, themes that can travel across borders even when the details change.
The campaign also exploited genuine disagreements. Instead of inventing every controversy, its operators selected existing grievances and amplified the most divisive interpretations. That approach made the messaging harder to dismiss and allowed local accounts to adapt foreign narratives to Serbian audiences.
We contacted organizations named in the posts, requested comment from the marketing company, and gave people identified in our reporting an opportunity to respond. We checked translations with native speakers and compared screenshots against platform archives. When a claim could not be independently confirmed, we excluded it or labeled it accordingly.
Visual evidence received the same scrutiny. Reverse-image searches showed that several photographs presented as recent scenes from Ukraine had been published years earlier or depicted different countries. Geolocation, weather conditions, building details, and shadows helped establish when and where images were actually made.
This method is especially important for reporters working near conflict zones. Our work on training journalists on environmental damage has reinforced the value of documenting evidence at the source, preserving metadata when possible, and protecting contributors who may face retaliation.
The Belgrade operation was designed to blur responsibility. Its apparent success did not depend on persuading every reader. Repetition, coordinated engagement, and selective outrage were enough to push narratives into wider conversations and make fabricated claims seem familiar.
Our findings also show why investigations into influence operations must continue after a platform removes individual accounts. Networks can rebrand, migrate to new services, and recruit fresh operators. Public documentation creates an evidentiary record that researchers, journalists, and platforms can use to identify recurring tactics.
For journalists and media activists investigating similar campaigns, several practices proved especially useful:
Independent reporting can expose manipulation that automated moderation misses and give communities the context needed to assess suspicious narratives. Support the Free Press Foundation’s journalism, training, and investigations so evidence-based reporting from Ukraine and beyond can remain accessible to the public.
