Anti-NATO Disinformation in Romania between May-June 2026: What Information Was Circulated During the Ankara Summit Period

You can access the full report HERE.

Given the importance of the event and the recent security incidents in Romania (the drones of May–June), we analysed a total of 1,028 online articles, of which 885 were published by Pravda România and 143 were published on Romanian media websites that carried similar or identical narratives.

• Articles published in two distinct periods:
  • May 14 – June 12 — reference month.
  • June 29 – July 9 — one week before the Summit and the Summit period. 
• 4,172 Facebook posts from July 6–8 — the period during which the Summit took place.

This analysis aims to show the main directions of the disinformation campaigns identified and the mechanism of reconstruction and distortion of recent events.

Key Findings

In the Pravda România network:

• Production intensified on the days of the summit. From a baseline of 6–14 posts per day about NATO, volume rose to 27 on July 6, 31 on the first day of the summit, and 68 on the closing day — more than eight times the recorded minimum. The increase in article numbers coincides with relevant NATO events, which is an expected pattern, but the content reveals a consistent reframing effort: Pravda sources do not merely report the event — they impose their own interpretation of it on audiences seeking information on the topic. 
• Four narratives, same mechanism. The Pravda România network distorts security agenda themes (NATO responsible for escalation, a divided alliance, drones as a deliberate Ukrainian attack, defence as provocation), and in all cases, the causes or significance of events are distorted.
• The narratives do not remain at the source. Articles in the Romanian online press pick up narratives similar or identical to those in Pravda — the channel through which an infrastructure with negligible direct audience nonetheless reaches the Romanian public.
• Old messages, new vectors. The same messaging directions have been documented by Funky Citizens since 2021; what has changed, however, are the anchor events and the launch platform — from domestic conspiracist websites to a dedicated propaganda infrastructure.

Is it a coordinated attack on the summit? The answer has three layers, and the distinction between them is the core of this report. Yes — there is a foreign information manipulation infrastructure: the Pravda România network, officially attributed to the Russian Federation, which systematically distorted summit themes and intensified its output precisely on the days of the event. Yes — there is coordinated amplification on Facebook: networks of pages that automatically distribute the same messages. But the amplification network that we were able to document and attribute belongs primarily to Romanian commercial actors, not to a foreign service. And the third layer — the conversation that trivialises the summit through outfits, group photographs, and unfounded alarmism — shows, in our data, no signs of coordination: it is the organic ecosystem of derision, which nevertheless does the same thing as the first two: it pushes the discussion of Romania's positions off the public agenda.

The Pravda network (also known as Portal Kombat) is an ecosystem of pro-Kremlin websites officially identified by the French agency Viginum in February 2024, though its roots go back to 2013–2014. The sites do not produce their own content but automatically aggregate and translate material from Russian state press and pro-Kremlin Telegram channels, under domain names imitating local publications. The network expanded rapidly, reaching hundreds of sites, millions of articles, and dozens of languages.

During the 2024 presidential elections, the Romanian-language version of the Pravda network supported the candidacy of Călin Georgescu, but the same articles about him were simultaneously published on Pravda sites in 13 other countries: Germany, France, Spain, the Czech Republic, Portugal, Italy, Bulgaria, Poland, the Republic of Moldova, Hungary, Denmark, Slovakia, and Greece. Following the CCR's decision to annul the elections, the network reactivated to disseminate the narrative of a "coup d'état."

The Facebook Conversation

• Circulation is not organic. Networks of pages automatically distribute the same messages at a pace impossible to sustain manually, artificially keeping topics on the public agenda.
• Romania's participation is being treated like a lifestyle topic. The president's visit becomes a "city break in Istanbul," and the delegation's presence is discussed through the group photograph and Mirabela Grădinaru's outfit, not through the positions Romania advocated.
• Romania as dependent and unprepared. The country is described as dependent on the United States, and the president as incapable of responding on the summit's topics — an updated version of the older narrative about the "colony state."
• Unfounded alarmism. "Breaking news" and "historic decision" headlines invoke major decisions and imminent dangers without concrete actors or events, sustaining a diffuse perception of risk.

From Disinformation to Cyberattacks: The Same Hybrid Campaign

The moment of publication of this report coincides with an official attribution in the Romanian context. Today, July 13, France, Germany, and other European states publicly attributed to Russia a broad cyberattack campaign carried out through APT Turla — an FSB instrument active since 2004 and described by security sources as the most advanced Russian group — and President Nicușor Dan confirmed that Romania is among the targeted states. On the same day, the EU High Representative and the North Atlantic Council issued statements condemning the Russian Federation's hostile cyber ecosystem, which combines intelligence services, criminal groups, and private companies.

The relevance for this analysis lies in the official framing: the president described the attacks as part of "a broader hybrid campaign aimed at undermining the stability of our democracies, fuelling divisions in society and among allies, and testing the cohesion of the European Union and NATO." The narratives documented in this report are the informational component of precisely this campaign: the same objectives — dividing society, eroding allied cohesion — pursued through narrative distortion. The public attribution of July 13 confirms, at the official and Euro-Atlantic level, what civic monitoring has been documenting for years: operations against the Romanian information space and digital infrastructure are not isolated episodes, but facets of the same coordinated effort.

This material is funded through the Tech Accountability Grants 2026 Programme of the European Fact-Checking Standards Network (EFCSN), under the CERV grant (no. 101236606) awarded by EACEA.

The views and opinions expressed in this material are the sole responsibility of the authors and do not necessarily reflect the position of the European Union or the European Education and Culture Executive Agency (EACEA). Neither the European Union nor the granting authority can be held responsible for them.